Apple has very explicitly stated in very clear terms that the health app does not share data with other apps or devices unless you give permission. And as someone who has given that permission (twice, once to give a meal tracker write permission and once to link to my doctors office’s application for read and write) it’s for every application. It’s not a “hey you need to let everyone have access or no one”. You can get fairly granular.
There’s always the possibility of lying but usually when a company goes that hard on saying the same thing is so many different ways it’s legit. They don’t commit like that unless they know they won’t get in trouble. Those kinds of statements could open them to false advertising claims if it got out they were taking your health data.