If someone gives permission to access their HealthKit data, can my website be able to display their most recent HealthKit data—their steps count for example. In other words, does HealthKit report to the cloud that can be accessed with an API? Or does it need to be an app that accesses the HealthKit data locally?
There is no cloud API, you would have to create an app that reads the HelathKit data and reports it to your backend.