Privacy: split Health Connect import permissions by data category #645

Summary

The Android Health Connect import flow requests the full importer permission set at once. The importer can handle partial grants later, but the first permission prompt still asks for a broad set that includes body composition, VO2 max, exercise, distance, sleep, heart rate, HRV, calories, and more.

Why this matters

Health data permission prompts should be as narrow and explainable as possible. Requesting every supported Health Connect read scope at once increases consent friction and asks for data the user may not expect when they only want a core import.

Evidence

• android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt:91 defines one READ_RECORDS list for all imported record types.
• android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt:114 derives PERMISSIONS from the entire list.
• android/app/src/main/java/com/noop/ui/DataSourcesScreen.kt:294 launches HealthConnectImporter.PERMISSIONS when no matching grants exist.
• android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt:159 already supports partial permissions after the grant, so the import logic is close to supporting a narrower UX.

Suggested fix

• Split Health Connect read permissions into categories, for example:
  • Core recovery: heart rate, resting heart rate, HRV, sleep, respiratory rate, oxygen saturation.
  • Activity: steps, calories, exercise, distance, VO2 max.
  • Body composition: weight, body fat, lean body mass.
• Request only the category the user chooses.
• Keep partial-grant behavior so users can decline categories without breaking the whole import.

Acceptance criteria

• A user can import core recovery/sleep data without being asked for body composition permissions.
• Body composition and workout/activity imports are separately understandable in the UI.
• Tests or UI-state coverage verify partial grants still import available data and skip missing data without failure.