The most important question for any health app is regulatory: is it a medical device? The answer decides the effort more than any technical choice. An app with a medical purpose falls under the Medical Device Regulation, with conformity assessment and CE marking. An app that documents and accompanies without diagnosing or treating usually stays outside, but is fully subject to data protection rules for health data.
The intended purpose decides
What matters is what the manufacturer intends the app for, not what it can technically do. An app that stores blood glucose readings and shows them as a trend is different from an app that recommends an insulin dose from the same readings. The intended purpose appears in instructions, advertising and app store descriptions, and all three must match. A marketing claim such as “detects heart rhythm disorders” can turn a lifestyle app into a medical device.
Classification under Rule 11
Software with a medical purpose is classified under Rule 11 of Regulation (EU) 2017/745. Software providing information for diagnostic or therapeutic decisions is at least class IIa and therefore needs a notified body; where serious consequences are possible, the class rises. That means clinical evaluation, a quality management system, technical documentation and post-market surveillance, an effort that must be in the budget early.
Data protection runs in parallel
Regardless of medical device status, health data are special categories under Article 9 GDPR and sensitive personal data under the Swiss FADP. You need a sound legal basis, usually explicit consent, a data protection impact assessment for large-scale processing, strong technical safeguards and a clear decision on which data stay on the device and which go to the server. Advertising and analytics tools in a health app are a common and avoidable mistake.
Germany: DiGA
In Germany, certain digital health applications can be listed by the Federal Institute for Drugs and Medical Devices after review and then reimbursed by statutory health insurance. Requirements include CE marking as a medical device, data protection and security criteria and evidence of positive care effects. For manufacturers this is a reimbursement route, not a substitute for the MDR.
Switzerland
Switzerland regulates medical devices in its Medical Devices Ordinance, aligned with the MDR. Because the mutual recognition agreement with the EU has not been updated since May 2021, Swiss manufacturers need an authorised representative in the EU for the EU market, and foreign manufacturers need one in Switzerland for the Swiss market. For AI-based medical software, the AI Act adds high-risk duties in the EU market through product law from August 2028.
Settle it before development
Define the intended purpose first, in writing and agreed with marketing. Classification, data protection concept and the question of a notified body follow. Building first and clarifying later often means building twice. Our glossary entries on the MDR and Article 9 GDPR explain the terms; a compliance assessment maps the duties for a specific product.