Your medical data in the European Union: GDPR, EHDS and the rights you actually have

Your lab results are at the laboratory. Your discharge letter, at the hospital. Your prescriptions, at the pharmacy and in the national system. All of them are "yours" in a moral sense, but for years the law did not say clearly that you could request them electronically, receive them at once, in a format you could use, and take them wherever you wanted. Since 2025, it does.

This guide explains, in plain language, the two laws that govern your medical data in the European Union: the GDPR, in force since 2018, and the EHDS, the European Health Data Space regulation, in force since March 2025 and applied in stages until 2031. It is not a legal text; it is a map of the rights you have and of when they become concrete.

GDPR: health data is a "special category"

The General Data Protection Regulation (GDPR) treats health data separately from the rest: it is a special category, described in Article 9, alongside genetic and biometric data. Processing it is, in principle, prohibited, with precise exceptions: your explicit consent, medical care, public interest in health, research with safeguards.

What this means for you, concretely:

• Any app, laboratory or clinic processing your health data must have a clear legal basis and tell you, in plain language, what it does with it.
• You have the general GDPR rights for medical data too: access (to see what they hold about you), rectification, erasure (with limits, because medical records have legal retention periods), portability (to receive your data in a structured, commonly used, machine-readable format) and the right to object to certain processing.
• The response deadline for an access request is one month, extendable by two months in complex cases. Access is free.
• Hosting matters. Data may be transferred outside the EU only with safeguards (adequacy decisions, standard clauses). An app that keeps your data in the EU removes that question.

The GDPR gave the rights. What it did not give is the format and the infrastructure: you could request access, but you received a PDF or a stack of paper, in months, and the hospital was not obliged to be able to send it to another hospital. That is exactly the gap the EHDS fills.

EHDS: what it is and why it matters

Regulation (EU) 2025/327 on the European Health Data Space was published in March 2025 and entered into force on 26 March 2025. It is the first European act that says, for all 27 member states, how health data must flow: between you and your doctors ("primary use") and, under strict rules, to research and public policy ("secondary use").

Three central ideas:

1. You have electronic, immediate and free access to your health data, through a national access service, and you can download it, add to it, restrict it and see who read it.
2. Data flows in a common format (the European electronic health record exchange format, EEHRxF), based on standards such as HL7 FHIR, so that a hospital in Spain can read your summary from Romania.
3. Electronic health record systems must meet common requirements for interoperability and logging, with a declaration of conformity, a kind of CE marking for medical software.

Your rights under the EHDS, one by one

The articles in Chapter II of the regulation give you, concretely:

Access. The right to access your electronic health data immediately, free of charge and in an easily readable form, through your country's access service. "Immediately" means without the written request and the one-month wait of the GDPR, with one exception: a doctor may delay access to certain results (a serious diagnosis, for example) until they have told you in person.

Download. The right to receive an electronic copy in the European exchange format, at least for the priority categories, and to transmit it to a healthcare provider of your choice, in any member state.

Insertion. The right to add information to your electronic record (home measurements, for example), clearly marked as entered by you, so the doctor can distinguish it from clinical data.

Rectification. The right to request correction of wrong data, online, through the access service.

Restriction. The right to limit professionals' access to certain data or to the whole record; whoever restricts is informed that, in an emergency, missing information may affect care.

Information about access. The right to see who accessed your data, when and from which institution: the access log becomes mandatory and visible to the patient.

Proxy. The right to designate another person (a parent, an adult child, a guardian) to access your data on your behalf.

Objection to secondary use. The right to object to your data (pseudonymised or anonymised) being used for research, statistics or public policy, under conditions set by each member state. It is not an absolute right, but it exists, and states must implement it.

The priority categories: what flows first

The EHDS does not require everything to be available from day one. It defines priority categories of electronic health data that must exist in the European exchange format and be accessible and transmissible:

1. The patient summary (allergies, medications, conditions, vaccinations; in practice, the International Patient Summary or its European equivalent).
2. Electronic prescriptions and electronic dispensations.
3. Medical imaging and imaging reports.
4. Laboratory results.
5. Discharge reports.

At European level, the MyHealth@EU infrastructure (formerly eHDSI) already links national contact points and allows, between connected countries, the exchange of patient summaries and electronic prescriptions. The EHDS makes it mandatory and extends it to the other categories.

When it actually applies

This is where most press articles get it wrong. The regulation entered into force in 2025, but it applies in stages:

• 26 March 2027: general application of the regulation; member states must have digital health authorities and health data access bodies, and the basic rules become operational.
• 26 March 2029: patient rights and provider obligations for the patient summary and electronic prescriptions (the first two priority categories), the requirements for electronic health record systems, and the first stage of secondary use.
• 26 March 2031: the same obligations for imaging, laboratory results and discharge reports, plus the rest of secondary use.
• For member states that need it, certain deadlines can be extended, with notification to the Commission.

What this means for you: you already have the GDPR rights, now. The EHDS rights become enforceable gradually, starting with the summary and prescriptions in 2029. Until then, many states and providers implement them voluntarily or through national legislation, and serious apps already build on the European format.

What it means for the apps you use

The EHDS regulates, mainly, the systems used by healthcare providers and the national access services. Wellness apps (fitness, sleep, nutrition) have a voluntary regime: the manufacturer can declare that the app is interoperable with an electronic health record system and register it in a European database; it is not an obligation. Apps that keep your personal medical record sit between the two worlds: they are not healthcare providers, but their value rises directly with how closely they follow the European format.

The questions worth asking an app, in the spirit of the EHDS:

• Does it keep my data in a standard format (FHIR, with codes) and export it completely, so I can take it to a provider or to the national access service?
• Does it show me who accessed what in my record?
• Does it let me grant and withdraw access by category and by period?
• Does it clearly mark what I entered versus what came from a doctor or a laboratory (provenance)?
• Does it host my data in the EU?

If the answers are "yes", the app is already where European law wants the whole system to be.

How to use your rights, today

You do not have to wait for 2029 to start.

1. Request access, under the GDPR, from any provider that holds data about you: hospital, laboratory, private clinic. In writing, citing Article 15 of the GDPR; they have one month to respond. Ask for the electronic format and, if they can, a structured one.
2. Use the national portal, where one exists. Several states already offer the patient summary, prescriptions and some results online; check what yours offers and how much of it you can download.
3. Put what you receive into your personal record, coded, so it is exportable and comparable. The guide on lab results explains why codes matter.
4. Request the access log where it already exists (some national systems offer it) and get used to reading it.
5. Write to the privacy@ address of any service when something is unclear. Serious services have a dedicated address and respond.

How Anpheros helps

Anpheros is built on the EHDS principles before they become mandatory: your record is stored as HL7 FHIR R4 resources with standard codes, in the European Union; you can export it completely at any time, including as an IPS summary; every access by a clinic, an app or an AI assistant requires your consent, for a limited period, revocable, and stays in the log you can see; every piece of data has its provenance marked (entered by you, scanned from a document, from a device or from a provider). Requests about your data, including account deletion, are handled at privacy@anpheros.com, within GDPR deadlines.

Frequently asked questions

Does the EHDS mean anyone can see my data across Europe?

No. The EHDS regulates access by healthcare professionals who treat you, with logging and your right to restrict, and secondary use with pseudonymised data, under authorisation by an access body and with a right to object. It does not create a central European database of everyone's records.

Can I request my data in FHIR format today?

Under the GDPR you can request portability in a "structured, commonly used and machine-readable format"; the provider decides the exact format and is not obliged to offer FHIR. Under the EHDS, from 2029 for the summary and prescriptions, the European exchange format becomes mandatory. Until then, ask: many systems already can.

Does my data in a personal record app fall under the EHDS?

The app itself is not a healthcare provider, so the EHDS obligations for providers do not apply to it directly; the GDPR applies to it in full. The EHDS matters to it indirectly: the more it uses the European format, the more easily your data can reach regulated systems.

Can I refuse to have my data used for research?

Yes, the EHDS provides a right to object to secondary use, implemented by each member state (the concrete mechanism differs). Data used for research is pseudonymised or anonymised and accessed only in secure environments, not downloaded freely.

What do I do if a hospital refuses to give me my data?

Send the request in writing, citing Article 15 of the GDPR, and keep proof. If you receive no response within one month (or three, with justification), you have the right to complain to the national data protection authority. From 2029, for the priority categories, you will also have the route of the national access service.