For app developers & product teams · Updated 2026
WMHMDA for Apps: What Mobile & Web App Developers Need to Know
App developers are squarely in WMHMDA's crosshairs — the statute's definition of "consumer health data" was written with exactly the kind of data mobile and web apps collect by default: step counts, sleep sessions, mood logs, heart-rate readings, and location pings. If you're building or maintaining an app that touches any of these, here's what applies specifically to you.
In short: If your app touches fitness, sleep, mood, biometric, or location data, you need opt-in consent in onboarding, a linked privacy policy in settings, an SDK data-sharing audit, and a deletion flow that actually deletes health data. App-store privacy labels don't satisfy this — it's a separate legal requirement.
Read the full guide for app developers
Where WMHMDA obligations show up in a typical app
- Onboarding / permissions flow — this is where opt-in consent must live, before you request HealthKit, Google Fit, or location permissions tied to health features.
- Settings / privacy screen — needs a link to your Consumer Health Data Privacy Policy and a mechanism to withdraw consent or request deletion.
- Third-party SDK integrations — analytics, crash reporting, and advertising SDKs can inadvertently collect or transmit consumer health data; each one needs to be inventoried and accounted for in your privacy policy's "sharing" disclosures.
- Push notification triggers — location-based or health-status-based notification logic must avoid the geofencing restriction around health care facilities (see our geofencing guide).
- Account deletion flow — must cascade to actually delete or de-identify consumer health data, not just deactivate the account shell.
A realistic example: a habit-tracking app
Consider a general habit-tracking app that lets users log "sleep," "meditation," and "medication reminders" as custom habit types alongside non-health habits like "read 10 pages" or "drink water." Even though health tracking isn't the app's primary purpose, the moment a user logs medication or sleep data, that data becomes consumer health data under WMHMDA — meaning the app needs the same opt-in consent and privacy policy disclosures as a dedicated health app, at least with respect to those specific data categories.
App-store privacy requirements are not the same thing
Apple's App Privacy nutrition labels and Google Play's Data Safety section are platform-level disclosure requirements — useful, but legally distinct from WMHMDA. Completing your app-store privacy declarations does not satisfy RCW 19.373's specific requirements for a posted privacy policy, opt-in consent, or consumer rights handling. Treat them as separate, parallel obligations.
Consent screen design that satisfies WMHMDA
A compliant consent screen for an app should: name the specific data categories being requested (not just "health data" generically), explain the specific purpose, present an unchecked opt-in control the user must actively select, and — critically — separate the "collect" consent from any "share with third parties" consent as a distinct screen or distinct control, not a single bundled checkbox.
Generate your app's privacy policy and consent form
The WMHMDA Compliance Pack builds all 5 core draft documents from your app's specific data categories, sources, and sharing practices. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99Legal limitations
This guide addresses common patterns in app development but isn't a substitute for a review of your specific app's data flows, especially where multiple SDKs, cross-border data transfers, or unusual health-adjacent features are involved. Have a qualified attorney review complex implementations.
FAQ
Does WMHMDA apply to mobile apps specifically, or just websites?
Both — WMHMDA covers commercial websites, online services, and online applications, including native mobile apps.
Do I need app-store privacy labels AND a WMHMDA privacy policy?
Yes — they're separate requirements. App-store labels are platform rules; a WMHMDA privacy policy is a distinct legal requirement under RCW 19.373.
Where should the WMHMDA consent screen appear in my app's onboarding flow?
Before collecting health data beyond what's strictly necessary — typically right before requesting a relevant device permission or health-data input screen.
Does washington my health my data act apply to apps built outside Washington?
Yes, if the app is available to and used by Washington residents, regardless of where the development team or company is based.