Samsung Health

Is Samsung Health safe?

Mostly, yes, with one thing to check before you log your most personal data. Samsung Health comes installed on Galaxy phones, has passed a billion installs on Google Play, and stores weight, heart rate, sleep, blood pressure, medications and menstrual cycles. Samsung encrypts that data on the phone with a key held in its Knox security hardware, and we found no breach of Samsung Health data and no fine that names the app.

The catch is a contradiction in Samsung's own disclosures. Its US privacy notice says health data is never used for marketing or personalised ads, while its Google Play label lists health and fitness data as shared with other companies for advertising or marketing. We score it 66/100, level with Fitbit, below Garmin Connect at 70 and ahead of Mi Fitness at 64.

What does Samsung Health share?

The US privacy notice, effective 12 October 2026, says Samsung asks for opt-in consent before it collects health information, and lets you withdraw consent in the app's settings. It says health information "is not used for marketing, nor will it be used for personalized ads". Samsung shares data with its subsidiaries, with business partners that provide features you ask for, with service providers, and with authorities when the law requires it. The Scan Meal feature sends your food photos to a service provider for AI analysis.

Google Play's data safety section tells a broader story. It lists precise location, health information, fitness information, user IDs and device IDs as data shared with other companies, and the purposes for health and fitness data include "Advertising or marketing". The notice also lists mobile advertiser IDs among the device data Samsung collects. Our rule is to score the broader of the two statements, so privacy lands at 54.

The App Store tells a third story, because it covers only a small companion app for older Gear and Galaxy wearables on iPhone. Its label lists health, location, contact info and identifiers as collected but not linked to you.

The 2026 AI-training prompt

In mid-July 2026 Samsung Health users began to see a toggle asking them to consent to the use of health data for AI training and modelling. The notice covered activity, medical records, medication intake and menstrual cycles, and the privacy notice confirms that health data may be used to train Samsung's models with your consent. Users who turned it off reportedly saw a warning that they could no longer sync with their Samsung account and that their health data would be deleted.

After complaints, Samsung clarified that withdrawing consent removes only the data kept for AI training, and that sync keeps working, according to Malwarebytes, which also cites testing by SamMobile. The consent remains optional. The episode matters for transparency and control: a health app should not suggest that refusing an optional use will cost you years of records.

How secure is Samsung Health?

On the phone, the design is strong. Samsung says health data is encrypted with a key from Knox's hardware-backed key store, so it stays protected even on a rooted phone, and that the app refuses to run if Knox detects rooting, malware or tampering. Samsung's Mobile Security Rewards Program pays researchers for flaws in Samsung mobile devices and the apps it ships.

The National Vulnerability Database lists 15 Samsung Health flaws published from 2021 to 2026. All but one need an attacker already on the device, such as a malicious app; the exception, from 2021, let others read cached data through an exposed app component. Samsung fixed them all in updates; the latest four were fixed in version 7.0 in 2026.

What Samsung does not describe is end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary for data synced or backed up to Samsung Cloud, so assume Samsung can read it there. We found no breach of Samsung Health data.

How to use Samsung Health more safely

1. Keep the app updated through the Galaxy Store or Google Play, since most fixes reach it through app updates.
2. Leave the AI-training consent off unless you want to contribute; refusing does not delete your health records.
3. In Together, choose a nickname and photo you are happy for others to see, and think before syncing your contacts.
4. Check which connected apps can read your data, through Health Connect on Android or the app's own settings.
5. Use your Samsung account's two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, since the account holds your synced health history.
6. US users can request a copy or deletion of their data through Samsung's privacy rights portal.

How we scored it

The regulatory record (86) is the strongest factor: no fine or order names the app, though no regulator has examined it in depth either. Security (68) rests on Knox encryption on the device and regular fixes, held back by the lack of end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary in the cloud. Privacy (54) is the weakest, because the Play label lists health data shared for marketing. For a wearable app whose label lists nothing used to track you, compare Oura.