According to a security researcher[1], a 0-day in Analyticsd allowed any installed app to access the users health data.

[1] https://habr.com/en/post/579714/

EDIT: Found the link to the previous HN discussion about this: https://news.ycombinator.com/item?id=28637276