Short answer: under the GDPR, data concerning health is a special category. Article 9(1) prohibits processing it; Article 9(2) lists the exceptions that lift the prohibition. For a product team, four matter: (a) explicit consent of the person, (h) healthcare provision by or under the responsibility of a professional bound by secrecy, (i) public health, and (j) scientific research with safeguards under Article 89. An Article 9 exception is needed in addition to an ordinary legal basis under Article 6, not instead of it. Processing health data at scale also triggers a DPIA (Article 35) and a data protection officer (Article 37).
What counts as health data
Under the GDPR, data concerning health is personal data related to a person's physical or mental health, including the provision of health care services, that reveals information about their health status (Article 4(15)). Read widely, it covers lab values, diagnoses, medications, appointments and sick-leave notes, and any data from which a health condition can be inferred.
Article 4(15) defines data concerning health as personal data related to the physical or mental health of a person, including the provision of health care services, which reveal information about their health status. Recital 35 and the case law read it widely: a lab value, a diagnosis, a medication, a doctor's appointment, a sick-leave note, a step count combined with a heart condition, a search for a symptom tied to an account. Data that reveals health status is health data even if it was not collected as such. The Court of Justice confirmed in 2022 (OT, C-184/20) that data from which a special-category fact can be inferred is itself special-category data.
The exceptions that matter
The GDPR Article 9(2) exceptions that matter most for health products are explicit consent (a), used by consumer health apps and patient-controlled records; healthcare provision (h), used by clinics and their software suppliers under professional secrecy; public health (i); scientific research (j) with Article 89 safeguards; and substantial public interest (g), on which the EHDS relies for secondary use.
| Article 9(2) | Who typically uses it | Conditions |
|---|---|---|
| (a) Explicit consent | Consumer health apps, wellness services, patient-controlled records | Freely given, specific, informed, unambiguous, by a clear affirmative act, as easy to withdraw as to give; not bundled with the service unless the service needs the data |
| (c) Vital interests | Emergency access | Only when the person is physically or legally incapable of consenting |
| (h) Healthcare provision | Clinics, hospitals, GPs, their software suppliers as processors | Necessary for diagnosis, care, treatment or management of health systems, under EU or national law or a contract with a professional, and under professional secrecy (Article 9(3)) |
| (i) Public health | Public health authorities, pharmacovigilance | Based on law providing for suitable measures |
| (j) Research, statistics, archiving | Research institutes, registries, platforms enabling research | Based on law, proportionate, with Article 89 safeguards (pseudonymisation, minimisation) |
| (g) Substantial public interest | National health data infrastructures | Based on law; the EHDS relies on it for secondary use |
A personal health record controlled by the patient runs on (a): the person decides what to store and with whom to share. A clinic writing into that record runs on (h) for its own processing, and the patient's consent governs the sharing. A platform that serves both is a processor for the clinic (Article 28 contract) and a controller for the account it offers the person. Writing this down, per processing operation, is the core of the records required by Article 30.
Consent that actually holds
Explicit consent for health data under the GDPR holds only when it is a separate, specific statement per purpose, given by a clear affirmative act, informed about the recipients, recorded with the time and method, and revocable as easily as it was given. Pre-ticked boxes, bundled purposes and apps unusable without consenting to analytics have all been ruled invalid.
Regulators have invalidated consent for health apps for the same reasons repeatedly: pre-ticked boxes; consent requested for everything at once; no way to use the app without consenting to analytics; consent texts that do not name the recipients; no withdrawal path. Valid explicit consent for health data means a separate, specific statement ("I agree that Anpheros stores the lab results I upload"), granular per purpose (storage; sharing with a named clinic; anonymised statistics), with a record of when and how it was given, and a switch that revokes it with immediate effect on future processing. Children's data needs the holder of parental responsibility, with age thresholds set by each member state between 13 and 16.
Secrecy, Article 9(3)
GDPR Article 9(3) sets the secrecy condition for the healthcare exception: health data may be processed under Article 9(2)(h) only by or under the responsibility of a professional bound by professional secrecy under EU or national law, or by another person subject to an equivalent obligation of secrecy.
Software suppliers to clinics meet this by contract: the processor agreement imposes confidentiality on staff with access, and access is logged.
Beyond Article 9
An Article 9(2) exception is not the only GDPR obligation for health data. Processing also needs an Article 6 basis, usually a DPIA under Article 35 and a data protection officer under Article 37, limits on automated decisions under Article 22, a Chapter V tool for transfers outside the EU, 72-hour breach notification, and national health-record laws.
- Article 6 still applies: contract (6(1)(b)) for providing the service the person asked for, consent (6(1)(a)), legal obligation, public task or legitimate interests, which cannot be used to override Article 9.
- Article 35 DPIA is mandatory for large-scale processing of special categories; most health apps and all platforms qualify. See DPIA for a health app.
- Article 37 DPO is mandatory for core activities consisting of large-scale processing of special categories.
- Article 22 limits decisions based solely on automated processing with significant effects, which includes automated triage or eligibility; health data may be used for them only with explicit consent or a legal basis in law, with safeguards.
- Article 44 onward: transfers outside the EU need adequacy (the EU–US Data Privacy Framework for certified US companies), standard contractual clauses with a transfer impact assessment, or another Chapter V tool. Hosting in the EU avoids the question for the data at rest; support staff abroad does not.
- Article 33–34: breach notification to the authority within 72 hours and to the people when the risk is high, which for health data it usually is.
- National law adds layers: medical secrecy laws, health record laws, retention periods, and in some countries specific rules for health apps (France's HDS hosting certification, Germany's DiGA framework).
The EHDS on top
The European Health Data Space regulation (2025/327) does not change Article 9. It adds rights to access and port health data in a common format, obligations for EHR systems, and a permit system for secondary use that relies on Article 9(2)(g), (h), (i) and (j) with its own safeguards and an opt-out. See Your medical data in the EU.
In Anpheros
Anpheros processes health data on the person's explicit consent for the record they keep (Article 9(2)(a)), per purpose and revocable in the app, and as a processor for clinics that write into that record under their own Article 9(2)(h) basis. Every access by a clinic requires the person's approval for a scope and a duration and appears in their access log. See Patient consent platform and Who viewed my medical record?.
This page explains regulation for product and engineering teams. It is not legal advice; the texts linked under Sources are the authority, and your data protection officer, notified body or counsel decides for your case. Last reviewed: October 2026.
Related pages
- DPIA for a health app: checklist and template
- Your medical data in the EU: GDPR, EHDS and your rights
- HIPAA vs GDPR
- De-identification of health data
- Patient consent platform
- Health data regulation map
- GDPR for developers (developer site)
Sources
- GDPR Article 9, EUR-Lex
- GDPR Article 4(15) and Recital 35, EUR-Lex
- EDPB: Guidelines 05/2020 on consent
- CJEU, C-184/20 (OT v Vyriausioji tarnybinės etikos komisija), 2022
- EDPB: Guidelines on processing of health data for research in the COVID-19 context (03/2020)
- Regulation (EU) 2025/327 (EHDS), EUR-Lex
Frequently asked questions
Is a step count health data?
On its own, usually not. Combined with other data that reveals a health status (a diagnosis, a rehabilitation programme, a heart condition), or processed to infer one, it becomes data concerning health. Regulators look at the purpose and the inference, not only the raw field.
Can I use legitimate interests for health data?
No. Legitimate interests is an Article 6 basis; health data additionally needs an Article 9(2) exception, and none of them is legitimate interests. Analytics on health data needs consent or anonymisation.
Does a clinic need the patient's consent to keep records?
Not under the GDPR: it processes under Article 9(2)(h) and national health law. Consent becomes relevant when the data is used for something else (sharing with an app, research, marketing) or when national law requires it.
How long may health data be kept?
The GDPR says no longer than necessary; national health-record laws set concrete retention periods for clinical records (often 10 to 30 years). A personal record the person controls is kept as long as they want it, and deleted on request.
Try it free in the sandbox
Your first FHIR call in 5 minutes. An HL7 FHIR R4 API with the patient's consent built in: try it in the sandbox, then connect your own app or clinic system.
Free · 30 synthetic patients · no card
Anpheros builds a medical record that the patient controls and can share with any clinic, on an HL7 FHIR R4 platform, based in the EU. These guides help you understand and organise your health; they do not replace your doctor.
About Anpheros →
AnpherosThe more you log, the clearer your record
Your health history in one place, under your control.
Free · Works in your browser · No card
