A Local-First Architecture for Privacy-Preserving Personalization in iOS Health and Fitness Applications

Health and fitness applications increasingly adapt goals, reminders, and recovery flows from behavioral and physiological signals. On iOS, these signals may be adjacent to health data even when a product is marketed as wellness rather than medical software. The privacy problem is therefore not only a consent or notice problem; it is an architecture problem concerning where raw signals are transformed, stored, linked, and exported. This article proposes the Local-First Personalization Envelope (LFPE), a conceptual architecture for privacy-preserving personalization in iOS health and fitness applications. Using a design-science-oriented synthesis of mobile health privacy research, privacy engineering theory, EU and U.S. governance, and Apple platform requirements, the paper maps legal and platform principles to app-level controls. LFPE places raw health-related inputs, local feature extraction, and personalization decisions inside the device trust boundary where feasible. Remote feedback is limited to tightly scoped aggregate metrics, differentially private telemetry, or federated updates that pass a disclosure-threshold review. The paper contributes a regulatory-to-engineering matrix, a disclosure-threshold protocol, and a personalization ladder that assigns controls to local rules, compact on-device models, aggregate telemetry, federated learning, and cloud personalization. The framework does not claim legal compliance or empirical utility without implementation evidence. It provides a structured starting point for iOS teams that need personalization without treating raw health-related data as ordinary analytics telemetry.