From this tweet by Ryan Jones:

Health data truth, as on Nov 2018.

✅ iCloud Sync, if toggled on
❌ iCloud Backup, never ever

❌ Unecrypted iTunes Backup, never ever
✅ Encrypted iTunes Backup, only if iCloud Sync is off

So, if you get a new phone and it magically disappears from iCloud… F’ed.

— Ryan Jones (@rjonesy) November 6, 2018

And this from the linked post by Michael Tsai:

The Health app can’t import its own data, so you need to use (and trust) a third-party app. Also, chances are you’re going to use iCloud (or some even less secure means) to transport the export file, so why not just include it (optionally) in the iCloud backup. This is a pattern we see from time to time with Apple. You run into the limits of Apple’s idealized solution and then it’s sort of your fault if something goes wrong with the more pragmatic solution that you resort to. But it’s also sort of Apple’s fault for only solving part of the problem that it was in the better position to address.

If you are at all invested in your health data, read the whole post.