you're totally right on all these points: for the time being, i've only put out information that's okay being 'public', but i imagine when you do want to share a set with a small group (let's say your physicians), you'll want an additional layer of access control.
* Secure access. It's great you decided to share everything publicly. I'm looking at fairly confidential data like blood tests, though.
* How do you express permissions? It's likely you'd give out sets of data, not per-url permissions. (I.e. my photos from date A to date B, in this general vicinity - your vacation pics)
* How can others discover what data sets & types you've shared?
* Related: A type description. Some events cover time ranges. Some are momentary samples. They all use different units. Some have location info attached, some don't. (I.e. my heart rate doesn't. Pictures do. Steps/day - geolocation is meaningless)
Either way, it's exciting to see people push ahead on this - many of these questions will probably be answered as we go.