iOS 15 Health Sharing: How Encrypted Access Works

The Health sharing feature introduced in iOS 15 allows users to securely share selected health and wellness metrics with trusted family members and caregivers. This article provides an overview of how this feature functions under Apple’s privacy architecture, detailing the end-to-end encryption protocols, key exchange mechanisms, and user-controlled permissions that ensure personal health data remains strictly private between the sender and the recipient.

End-to-End Encryption Architecture

When you share health data with a family member in iOS 15, the information is protected using end-to-end encryption. The data is encrypted locally on the sender's device before it is uploaded to iCloud for transfer. It remains in an encrypted state throughout transit and while stored on Apple's servers.

Only the designated recipient possesses the private cryptographic key necessary to decrypt and view the data. Because Apple does not hold the decryption keys, the company cannot access, read, or monetize any shared health records or trends.

Public-Key Cryptography and Secure Key Exchange

The sharing process relies on public-key cryptography tied to each user’s Apple ID and device-level hardware:

1. Invitation and Pairing: When a user sends an invitation to share health data, the recipient’s device shares its public key.
2. Encryption: The sender’s device encrypts the selected health data using the recipient's public key.
3. Hardware-Level Decryption: Once synced to the recipient’s device, the data is decrypted inside the recipient's Secure Enclave using their private key.

This ensures that even if transit channels are intercepted, the data remains unreadable to third parties.

Granular Permission Controls

Security in iOS 15 extends beyond encryption to user-level access controls. Senders retain full authority over what information is shared:

• Category Selection: Users can choose specific categories to share, such as heart rate notifications, mobility metrics, cycle tracking, or activity trends, while keeping other data private.
• Alert Notifications: Users can selectively share critical alerts, such as high heart rate notifications or fall detection alerts, without sharing comprehensive daily logs.
• Instant Revocation: Access can be modified or revoked at any time directly within the Health app. Terminating a share immediately halts the transmission of new data and revokes the recipient’s synchronized access.

Read-Only Dashboard for Recipients

Shared health information appears directly within the recipient’s Apple Health app in a dedicated "Sharing" tab. The recipient receives read-only access to trends, alerts, and historical data approved by the sender. Recipients cannot modify the sender's records, export the data to third-party apps without permission, or re-share the stream with other users, preserving the integrity and confidentiality of the original health records.