Apple Health Export Privacy: What It Contains and How to Keep It Safe

By Josep Mampel Marques, updated November 11, 2026

An Apple Health export is one of the most personal files you can have: years of heart rate, sleep, weight and other health records, your workouts with GPS routes that often start and end at your home, and any ECG recordings, all in an ordinary zip file with no password. Inside the Health app, Apple protects that data with your iPhone's lock and encryption; once you export it, keeping it safe is up to you. Store it somewhere private, share only the parts you need, and prefer tools that work on your own device, such as FitMigrate, which reads the export in your browser without uploading it.

What the export contains

• Health records in export.xml: every measurement stored in the Health app, from steps and heart rate to sleep, weight, blood pressure and anything other apps wrote, with exact dates and times.
• Sources: the names of your devices and of the apps that recorded each value.
• A second copy of health data in export_cda.xml, in a health-record document format.
• GPS routes in workout-routes: the exact path, time and elevation of your outdoor workouts. Taken together they can show where you live, work and train, and when.
• ECG recordings in electrocardiograms, if you used the ECG app on Apple Watch.

The file list is explained in what is inside the Apple Health export.zip.

How Apple protects the data before you export it

Apple's Health privacy page says that when your iPhone is locked with a passcode, Touch ID or Face ID, all your health and fitness data in the Health app, other than your Medical ID, is encrypted and inaccessible by default. Health data in iCloud is encrypted in transit and at rest, and on iOS 12 or later with two-factor authentication Apple says it cannot read the health and activity data synced to iCloud.

None of that applies to the exported zip. It is a normal file that travels wherever you send it: Files, iCloud Drive, AirDrop, email or a messaging app.

Practical steps to keep the export safe

1. Pick the destination carefully. Save to Files or AirDrop it to your own computer. Avoid sending it by email or chat, where copies stay on servers and in other people's devices.
2. Store it on a protected device. Keep it on a computer or drive with a login password and disk encryption, or in an encrypted archive.
3. Clean up copies. After converting, delete extra copies from Downloads folders, email drafts and shared folders. Apple's guide to finding downloaded files shows where to look on the iPhone.
4. Share the minimum. If a coach or a friend needs your workouts, send the FIT files of those workouts, not the whole export. If someone needs your weight history, send that one CSV.
5. Check before you upload. Online converters, spreadsheets in the cloud and AI chatbots receive your data when you upload a file. Read what they do with it first. Importing a CSV into Google Sheets, for example, stores it in your Google account.

How FitMigrate handles your file

• The export is read in your browser tab, in a stream, and is never uploaded.
• CSV and FIT files are built on your device and saved straight to it.
• You can check this yourself: open your browser's developer tools on the Network tab before choosing the file, and you will see no upload of your export.
• FitMigrate converts data and does not interpret it. It gives no medical advice and does not judge your numbers.

Closing the tab ends the session. The files you downloaded are on your device, and handling them follows the same advice as the export.

Before you share routes

GPS routes are the easiest part of an export to overlook. When you upload a workout with a map to Garmin Connect, Strava or any social fitness service, check that service's privacy settings for who can see your activities and maps, and whether it can hide the start and end of a route. Indoor workouts and workouts without a route carry no location. Moving workouts to those services is covered in Apple Watch workouts to Garmin Connect and Apple Health to Strava.

Keep a backup, not just an export

If what you want is to keep your Health data safe over time, Apple's own options are iCloud, where Health data is stored automatically when you are signed in, or an encrypted backup of your iPhone on a computer. An export is a copy for use elsewhere, and it is best treated as a sensitive document.