Apps reading or writing HealthKit data can't use that data for advertising or sell it to data brokers, and apps running research studies need a documented consent process describing what's collected and how it's used.
Commonly caught when a fitness app's analytics or ad SDK gets broader access to HealthKit-sourced data than its stated research or wellness purpose requires.
"Your app uses HealthKit data for purposes other than health and fitness, or for advertising, which is not permitted per guideline 5.1.3."