Flutter Health Connect, from Android to your backend

A Flutter Android app can send permitted Health Connect data through a native bridge to the HC Sync Android SDK, or upload mapped records through REST. Your backend then reads REST or receives signed webhooks. This guide uses Android integration code; it does not assume a Flutter HC Sync package.

Last updated: 2026-11-04. API source: HC Sync documentation.

How does Flutter connect to the Android SDK?

Implement an app-owned platform channel to your Android host. Keep Health Connect availability, permissions and SDK lifecycle handling in Kotlin. Register the Connect contract in the Android Activity and launch it from your channel handler after explicit consent. Return its connected, failed or cancelled result to Dart. The following is the native side to adapt to your Activity:

// settings.gradle.kts
dependencyResolutionManagement {
  repositories { google(); mavenCentral(); maven("https://hcsync.dev/maven") }
}
// app/build.gradle.kts
implementation("dev.hcsync:hcsync:0.3.0")

val connect = registerForActivityResult(HcSync.connectContract()) { r ->
  when (r) {
    is ConnectResult.Connected -> toast("Synced ${r.uploaded} records")
    is ConnectResult.Failed -> log(r.kind)
    ConnectResult.Cancelled -> {}
  }
}
connect.launch(ConnectOptions(appName = "My Coach", userToken = token,
  types = setOf("steps", "sleep", "heart_rate"), privacyUrl = "https://myapp.com/privacy"))

How do you mint credentials and read records?

# On your authenticated backend; derive user_id from the signed-in session.
curl -X POST https://hcsync.dev/v1/user-tokens \
  -H "authorization: Bearer $HCSYNC_SECRET" -d '{"user_id":"maya"}' 

Pass the returned user token to the signed-in app over your authenticated API. Never embed your project secret key in Dart or Kotlin.

curl 'https://hcsync.dev/v1/records?user_id=maya&type=steps' \
  -H "authorization: Bearer $HCSYNC_READ_KEY"

Can a Flutter app upload through REST instead?

If you implement Health Connect reads yourself, map them to the documented record shape and preserve stable record IDs. This sample assumes your Android bridge already read a permitted steps record. It is a Dart upload fragment using package:http, not a Health Connect reader.

import 'dart:convert';
import 'package:http/http.dart' as http;

Future<void> uploadSteps(String userToken,
    Map<String, dynamic> mappedRecord) async {
  final response = await http.post(
    Uri.parse('https://hcsync.dev/v1/sync'),
    headers: {'authorization': 'Bearer $userToken',
      'content-type': 'application/json'},
    body: jsonEncode({'records': [mappedRecord]}),
  );
  if (response.statusCode != 200) throw Exception('Sync failed');
  final result = jsonDecode(response.body);
  if (((result['rejected'] as List?) ?? []).isNotEmpty) {
    throw Exception('Record rejected');
  }
}

Use the SDK wrapper’s record mapping as a reference: records have id, type, start, end, value and source. POST /v1/sync accepts up to 1,000 records, with each value under 8 KB; inspect rejected records. Send device deletions through POST /v1/sync/delete with {ids}. Persist change positions only after handling upload results.

What should you check before release?

Before upload, collect explicit consent explaining your purpose, selected types, US storage through HC Sync and withdrawal. Declare only needed Android permissions and request them at runtime. Follow the consent and publishing checklist. Keep the secret and read keys on your backend; a device user token can only write one user. Stop sync and clear credentials on logout or withdrawal.

Test unavailable Health Connect, denied permissions, account switching and device deletions. For webhook reads, use the signed webhook receiver guide.

Python guide · Expo guide · API documentation

Create a free project