Health data are among the most strictly protected data in European data protection law. Article 9 GDPR prohibits their processing in principle and allows it only under exhaustively listed conditions. In Switzerland they are sensitive personal data under the FADP. For organisations working with such data, from medical practices to insurers to app providers, the right legal basis decides whether the whole offering is lawful.
What counts as health data
Health data are all data relating to a person’s physical or mental health that reveal information about their health status. This includes diagnoses and findings, but also information from which a health status can be inferred. In October 2024 the Court of Justice of the EU ruled that the details entered when ordering pharmacy-only medicines online can be health data. The line lies earlier than many assume.
The exceptions in Article 9
The main bases are explicit consent, processing for healthcare purposes by professionals bound by secrecy, reasons of public interest in public health, and research and statistics with appropriate safeguards. In Germany, section 22 of the Federal Data Protection Act specifies several of these exceptions. For most commercial offerings outside healthcare provision, explicit consent remains the only practical route.
Requirements for consent
Explicit consent must clearly refer to the health data and the specific purpose, be freely given and be revocable at any time. A general note in the terms of use is not enough. The Swiss FADP likewise requires consent to be explicit where consent is needed for processing sensitive data.
Impact assessment and safeguards
Large-scale processing of health data generally requires a data protection impact assessment. Technically, encryption, strict access rights, logging of access and a clear separation of identity data and health data are standard. Organisationally, you need a deletion concept and contracts with every provider that has access.
Typical mistakes
- Analytics and marketing tools in applications that process health data.
- Consent texts that do not mention health data explicitly.
- Health information in email and messengers instead of protected systems.
- Unclear responsibility between app provider, practice and service provider.
Switzerland and the EU together
Anyone serving people in Switzerland and the EU must meet both sets of rules. In practice it pays to implement the stricter requirement for both. How this looks for apps is described in our article on digital health apps; the term is explained in the glossary entry on Article 9 GDPR, and a compliance assessment maps the duties for your organisation.