[mulmen]

I prefer the corporations not have the data at all. The problem is Apple is simultaneously the best and also pretty bad at stewarding such an ecosystem. In theory all my actual health data would live on a device I own, encrypted, and accessible only by the apps I approve. In reality Apple can't or won't provide those mechanisms. Every other corporation wants to collect and sell my data.

Apple had a chance to make on-premise data storage a thing. They had AirPort, which combined with a Mac Mini could provide full iCloud functionality from the home. iCloud itself could have simply been an encrypted offsite backup, like Tarsnap with no options.

Instead Apple built a system that still puts clear user data within their reach.

[frogblast]

What you wish for is exactly what HealthKit is. All app access is gated by ACLs that require per-app and per-record-type user approval, and always encrypted when transmitted off of your device. This is a quote from the Apple Health Privacy Policy:

> When your device is locked with a passcode, Touch ID, or Face ID, all of your health and fitness data in the Health app — other than your Medical ID — is encrypted and inaccessible by default. Additionally, if you are using iOS 12 or later and turn on two-factor authentication, Apple will not be able to read your health and activity data synced to iCloud.

The two factor authentication is the mechanism for key distribution such that HealthKit data can be synced and migrated between your own devices, without being decryptable by apple.

[mulmen]

Sure except Apple owns my device. So it’s all moot.