Introduction

Healthcare applications handle some of the most sensitive personal information, from medical histories and prescriptions to diagnostic results and mental health records. Under the General Data Protection Regulation (GDPR), this information receives special protection, placing specific obligations on organizations that collect, store, or process it. While obtaining user consent may seem like the simplest way to meet these requirements, consent alone does not automatically make data processing lawful. Healthcare apps must establish an appropriate legal basis under Article 6, satisfy an applicable condition under Article 9 when processing special-category data such as health information, and comply with other relevant data protection requirements. Understanding how these provisions work together is essential for building healthcare applications that protect users' privacy while meeting their legal obligations.

Understanding GDPR and Health Data

Health data encompasses a wide range of information about an individual's physical and mental wellbeing, from medical histories and diagnostic test results to lifestyle information collected through wearable devices. When collected and analysed responsibly, this information can improve diagnoses, support personalised treatments, advance medical research, and help public health organisations identify emerging health risks. However, its sensitive nature makes protecting it essential, particularly as healthcare increasingly relies on digital systems, data sharing, and artificial intelligence (AI).

1. What Counts as Health Data?

Health data extends far beyond traditional medical records. It includes diagnoses, prescriptions, hospital visits, treatment plans, laboratory results, medical scans, and genetic information. It also covers healthcare interactions, such as appointments and hospital stays, as well as records maintained by pharmacies, dental practices, mental health services, and social care providers.

Lifestyle information can also contribute to an individual's health profile. Exercise habits, dietary patterns, sleep data, and other information collected through fitness trackers and health applications can provide insights into overall wellbeing. Depending on its content and context, this information may qualify as personal data concerning health under the General Data Protection Regulation (GDPR).

Health data supports a growing range of applications. Healthcare professionals use medical histories to improve diagnoses and treatment decisions, while researchers analyse large datasets to investigate diseases, evaluate treatments, and identify potential medical breakthroughs. AI and machine learning can help identify patterns in medical images, and genetic information can support the development of personalised medicine. At a population level, health data can also help policymakers monitor disease outbreaks, understand health inequalities, and plan healthcare resources more effectively.

These benefits, however, depend on collecting, using, and sharing information responsibly.

2. What Is GDPR and Why Does It Matter for Health Data?

The General Data Protection Regulation (GDPR) is the European Union's data protection framework, which came into effect on 25 May 2018. It establishes requirements for organisations that process personal data, including certain organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there.

Under the GDPR, personal data is information relating to an identified or identifiable individual. Health data receives additional protection because it is classified as a special category of personal data under Article 9. This recognises the particularly sensitive nature of medical information and the potential consequences of its misuse or unauthorised disclosure.

For healthcare providers, research institutions, digital health companies, and organisations developing AI-powered healthcare solutions, GDPR compliance involves more than simply keeping information confidential. Organisations must establish a lawful basis for processing personal data, satisfy an applicable condition for processing special-category health data, and implement appropriate safeguards throughout the data lifecycle.

3. Key GDPR Principles for Protecting Health Data

The GDPR establishes several principles that guide how organisations collect, process, store, and share personal data.

• Lawfulness, fairness, and transparency: Organisations must have a valid legal basis for processing data and explain their practices clearly to individuals.

• Purpose limitation: Health data should be collected for specified, explicit, and legitimate purposes. Further use must be assessed against the GDPR's requirements.

• Data minimisation: Organisations should collect and process only the information necessary for their stated purposes.

• Accuracy: Personal data should be accurate and kept up to date where necessary.

• Storage limitation: Identifiable information should not be retained longer than necessary, subject to applicable legal retention requirements.

• Integrity and confidentiality: Appropriate technical and organisational measures must protect information against unauthorised access, loss, destruction, or disclosure.

• Accountability: Organisations must be able to demonstrate that they comply with these principles.

These requirements are particularly relevant to health data because information may pass between general practitioners, hospitals, laboratories, pharmacies, research institutions, and technology providers. Each stage introduces potential privacy and security risks that organisations must assess and manage.

4. Consent, Data Sharing, and Individual Rights

Consent is an important consideration in health data processing, but it is not the only legal basis permitted under the GDPR. Organisations must identify an appropriate basis under Article 6 and, when processing health data, a valid condition under Article 9. Depending on the circumstances, these may involve explicit consent, healthcare provision, public health, scientific research, or other applicable legal grounds.

Where consent is relied upon, it must meet the GDPR's requirements, including being freely given, specific, informed, and unambiguous. For special-category health data, explicit consent may be required when it is the applicable Article 9 condition. Individuals must also be able to withdraw consent, although the legal consequences depend on the basis and circumstances of the processing.

Transparency is equally important when health data is shared between organisations. Individuals should receive clear information about how their data is used, who may access it, and the purposes of processing. Appropriate contractual arrangements, access controls, and security measures help ensure that third-party service providers handle information responsibly.

The GDPR also grants individuals rights concerning their personal data, including rights of access, rectification, erasure in applicable circumstances, restriction of processing, data portability, and objection. These rights help individuals understand and exercise control over how organisations use their information.

5. Privacy and Security in the Age of AI

As AI, wearable devices, and predictive analytics become more common in healthcare, the volume and variety of health data continue to grow. These technologies can support earlier diagnoses, improve treatment planning, and accelerate research. However, they also raise questions about data minimisation, transparency, access, and the potential for sensitive information to be misused.

Anonymisation can reduce privacy risks by removing information that identifies individuals. Nevertheless, organisations must consider whether individuals could be re-identified by combining supposedly anonymous information with other datasets. Pseudonymised data, which replaces direct identifiers with alternative identifiers, generally remains personal data under the GDPR when individuals can still be identified using additional information.

Organisations must therefore implement appropriate technical and organisational safeguards. Depending on the risks, these may include encryption, access restrictions, staff training, secure data storage, documented processing procedures, and privacy considerations built into systems from the design stage. The GDPR also requires organisations to assess whether a personal data breach must be reported to the relevant supervisory authority, generally within 72 hours of becoming aware of it where the applicable reporting threshold is met.

Building trust requires more than meeting minimum legal requirements. Individuals need confidence that their health information will be handled securely, used appropriately, and protected against unnecessary disclosure. Without that trust, people may become reluctant to share information that could otherwise support healthcare improvements and scientific discovery.

6. Building the Skills to Use Health Data Responsibly

Understanding the relationship between GDPR and health data is increasingly important for healthcare professionals, researchers, technology developers, and organisations working with digital health solutions. Responsible data use requires not only technical knowledge but also an understanding of privacy principles, legal obligations, ethical considerations, and the limitations of AI-driven analysis.

Developing these skills helps organisations make better use of health data while protecting individual rights and maintaining public trust. As healthcare becomes increasingly data-driven, the challenge is to balance innovation with responsible information management, ensuring that advances in research and technology contribute to better patient outcomes without compromising privacy.

The Six Lawful Bases Under GDPR Article 6

For a digital health app, identifying the correct legal basis for processing personal data is one of the fundamental requirements of GDPR compliance. Under Article 6 of the General Data Protection Regulation (GDPR), personal data may only be processed when at least one of six lawful bases applies. The appropriate basis depends on the purpose of the processing, the relationship between the app provider and the user, and the circumstances in which the data is collected.

1. Consent (Article 6(1)(a))

Consent applies when a user has freely agreed to the processing of their personal data for one or more specific purposes. For digital health apps, this may include agreeing to share personal information with a healthcare provider or allowing certain data to be used for a specified additional purpose. Consent must be informed, freely given, specific and unambiguous. Users must also be able to withdraw their consent.

2. Performance of a Contract (Article 6(1)(b))

Personal data may be processed when it is necessary to fulfil a contract with the user or to take steps requested by the user before entering into one. For example, a digital health app may need to process a user's account information and appointment details to provide a paid consultation or medication management service. However, this basis only covers processing that is genuinely necessary to deliver the contracted service.

3. Compliance with a Legal Obligation (Article 6(1)(c))

This basis applies when an organisation must process personal data to comply with a legal obligation imposed on it. For example, a digital health app provider may be required to retain certain records to meet applicable healthcare, accounting or regulatory requirements. The obligation must arise from applicable European Union or Member State law.

4. Protection of Vital Interests (Article 6(1)(d))

Processing may be lawful when it is necessary to protect the vital interests of the user or another individual. This basis is generally associated with situations involving serious threats to someone's life or physical well-being. For instance, a health app may need to share relevant medical information with emergency responders when an individual is unconscious and unable to provide consent.

5. Performance of a Task in the Public Interest (Article 6(1)(e))

This basis applies when processing is necessary to perform a task carried out in the public interest or under official authority granted to the organisation. For example, a digital health platform operating under a public healthcare programme may process personal data to support an officially mandated public health initiative. The task and the authority to perform it must have a basis in applicable EU or Member State law.

6. Legitimate Interests (Article 6(1)(f))

An organisation may process personal data when doing so is necessary for its legitimate interests or those of a third party, provided these interests are not overridden by the individual's fundamental rights and freedoms. For example, a health app provider may rely on this basis for certain fraud-prevention activities or measures to maintain network and information security. However, the organisation must conduct a balancing assessment to establish that its interests do not outweigh the individual's rights. This basis cannot be used by public authorities when processing personal data in the performance of their official tasks.

7. Applying Article 6 to Digital Health Apps

Although Article 6 establishes six lawful bases, selecting one does not automatically make the processing of health data lawful. Health information is classified as a special category of personal data under Article 9 GDPR and is subject to additional restrictions.

Consequently, digital health app providers processing health data must generally satisfy two separate legal requirements: identify an appropriate lawful basis under Article 6 and establish an applicable exception under Article 9(2). For example, a provider may rely on Article 6(1)(a) (consent) alongside Article 9(2)(a) (explicit consent) when processing health information with the user's express permission.

The distinction is particularly important when app providers intend to use collected information for additional purposes, such as research, product development or data sharing. A lawful basis for providing the original service does not automatically authorise these additional activities. Under Article 6(4), further processing must also be assessed for compatibility with the original purpose, unless it is based on the user's consent or an applicable legal provision.

Ultimately, digital health app providers should identify and document the appropriate legal basis for each processing activity before collecting personal data. This ensures that data processing is not only lawful but also transparent, proportionate and consistent with the fundamental principles of GDPR.

The Additional Requirement: GDPR Article 9 and Health Data

While Article 6 GDPR establishes the lawful bases for processing personal data, it is not sufficient on its own when that data falls into a special category. Article 9 GDPR provides additional protection for sensitive personal information, including data concerning health, genetic data, biometric data used to uniquely identify individuals, and information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation. As a general rule, processing these special categories of personal data is prohibited unless one of the exceptions specified in Article 9(2) applies.

For digital health apps, this distinction is particularly important. Information collected through symptom trackers, medication management tools, online consultations, fitness applications and other health-related services may qualify as health data and therefore receive this additional protection. Providers must consequently establish not only an appropriate legal basis under Article 6 but also a separate condition under Article 9 that permits the processing of the relevant data.

1. When Can Health Data Be Processed?

Article 9(2) identifies ten exceptions to the general prohibition on processing special categories of personal data. Several are particularly relevant to digital health applications:

• Explicit consent (Article 9(2)(a)): Users may explicitly consent to the processing of their health data for one or more specified purposes, provided that applicable EU or Member State law does not prohibit reliance on consent in the circumstances. Consent must be explicit, informed, specific and freely given. Users must also be able to withdraw it. However, consent should not be treated as a universal solution: where individuals cannot genuinely refuse without disadvantage, its validity may be questionable.

• Healthcare and medical treatment (Article 9(2)(h)): Processing may be permitted when necessary for preventive or occupational medicine, medical diagnosis, the provision of health or social care, treatment, or the management of health or social care systems and services. This exception is subject to specific conditions, including the requirements of Article 9(3) concerning professional secrecy or an equivalent obligation of confidentiality.

• Public health (Article 9(2)(i)): Health data may be processed when necessary for reasons of public interest in public health, including protection against serious cross-border health threats and ensuring high standards of healthcare and medicinal product safety. This exception requires a basis in EU or Member State law and appropriate safeguards for individuals' rights and freedoms.

• Scientific research and statistics (Article 9(2)(j)): Processing may be permitted for scientific or historical research, archiving in the public interest or statistical purposes, subject to the applicable legal requirements and safeguards under Article 89(1). This may be relevant to digital health app providers seeking to use health data for research and development, but the exception does not provide unrestricted permission to reuse information for any commercial or analytical purpose.

Other exceptions cover specific circumstances, including employment and social protection obligations, the protection of vital interests when an individual is incapable of giving consent, certain activities of qualifying nonprofit organisations, information manifestly made public by the individual, legal claims and substantial public interest. Their applicability depends on the circumstances and, in several cases, the existence of a specific legal basis or additional safeguards.

2. Why Explicit Consent Is Not Always Enough

Although explicit consent is an important route for processing health data, it is not the only exception available under Article 9. Equally, obtaining consent under Article 9 does not eliminate the need for an appropriate legal basis under Article 6.

Consider a digital health app that allows users to monitor symptoms and manage medication. If the provider relies on consent to process the user's health information, it must establish that the consent satisfies the requirements of Article 6(1)(a) and Article 9(2)(a). By contrast, a service providing medical treatment may, depending on the circumstances, rely on another Article 6 basis together with the healthcare exception under Article 9(2)(h), provided all applicable conditions are met.

The appropriate legal route therefore depends on the nature of the service, the purpose of the processing and the legal obligations governing the provider. Simply including a consent checkbox in an app does not automatically make every subsequent use of the collected information lawful.

3. Additional Safeguards for Health Data

Article 9 compliance must also be considered alongside the GDPR's broader data protection requirements. Providers should identify the specific health data they need, restrict access to authorised personnel, establish appropriate retention periods and implement technical and organisational safeguards proportionate to the risks involved. Pseudonymisation may reduce the risks associated with processing, particularly for research and analytics, although pseudonymised information remains personal data where individuals can still be identified using additional information.

Furthermore, Article 9(4) permits Member States to maintain or introduce additional conditions and restrictions concerning the processing of health data. Providers must therefore consider the national laws applicable to their operations rather than assuming that satisfying the GDPR's general requirements is always sufficient.

Ultimately, Article 6 establishes why personal data may be processed, while Article 9 determines whether sensitive personal data may be processed under an additional permitted condition. For digital health app providers, satisfying both provisions is a fundamental step towards lawful data processing. These requirements should be assessed before processing begins and documented alongside the app's purposes, data protection measures and applicable legal obligations.

Why Consent Alone Often Isn't Enough

Consent is an important mechanism for protecting users' privacy, but it is not always the most appropriate legal basis for processing personal data. Under the GDPR, consent must be freely given, specific, informed and unambiguous. Where special categories of personal data are involved, including health data, Article 9(2)(a) requires explicit consent when this exception is used. However, obtaining consent does not automatically make every processing activity lawful.

For digital health app providers, the challenge is ensuring that users have a genuine choice over how their personal information is used. Consent may be inappropriate when users cannot realistically refuse, when processing would continue regardless of their decision, or when access to a service is conditional on agreeing to unnecessary data processing.

When Is Consent Inappropriate?

1. When users have no genuine choice

Consent must be freely given. If an app requires users to agree to data processing that is not necessary to provide its core service, their consent may not be valid. For example, a fitness app might require users to consent to sharing their health information with advertising partners before allowing them to access basic exercise-tracking features. Because advertising-related data sharing is not necessarily required to provide those features, making it a condition of access may undermine the validity of consent.

2. When processing would continue without consent

Consent can be misleading if an organisation would continue processing the same data under another legal basis even if the user refused or withdrew consent. In such circumstances, users may believe they have control over their information when their decision would make little practical difference.

For example, a digital health app provider may need to retain certain records to comply with a legal obligation. If those records must be retained regardless of whether the user withdraws consent for another processing activity, the provider should clearly distinguish the two purposes and identify the appropriate legal basis for each. It should also explain which processing activities will stop and which records must be retained.

3. When there is an imbalance of power

Consent may not be freely given when there is a significant imbalance of power between an organisation and an individual. This can arise in relationships involving employers, public authorities or healthcare providers, where individuals may fear that refusing consent could affect their access to services or treatment.

For example, a patient might feel pressured to agree to the sharing of health information with a third-party organisation if a healthcare professional presents that sharing as a routine part of treatment. To support valid consent, the provider should make clear that the additional service is optional, identify the organisation receiving the information, explain how the data will be used and ensure that refusal will not result in adverse consequences where participation is genuinely optional.

What Are the Alternatives to Consent?

Article 6 GDPR provides several other lawful bases for processing personal data, depending on the circumstances. These include contractual necessity, compliance with a legal obligation, protection of vital interests, performance of a public task and legitimate interests. For example, a health app provider may rely on contractual necessity for processing genuinely required to deliver a service, or on a legal obligation when processing is necessary to meet a statutory requirement.

However, these alternatives cannot simply be selected to avoid obtaining consent. The provider must establish that the chosen basis genuinely applies to the intended processing activity. Legitimate interests, for instance, requires an assessment of whether the organisation's interests are overridden by the user's rights and freedoms.

The distinction becomes especially important when health data is involved. Even where an alternative Article 6 lawful basis applies, the provider must also identify an applicable exception under Article 9(2). Depending on the circumstances, this might include the healthcare provision exception under Article 9(2)(h), the public health exception under Article 9(2)(i), or another applicable condition. Each has its own requirements and safeguards.

The Importance of Transparency and Accountability

Not relying on consent does not remove an organisation's obligation to inform users about how their personal data is processed. Under Articles 13 and 14 GDPR, where applicable, users must receive clear information about the purposes of processing, the legal basis relied upon, relevant recipients and their data protection rights.

Digital health app providers should therefore determine the appropriate legal basis and any required Article 9 condition before processing begins. They should document their reasoning, ensure that the selected basis matches the actual processing activity, and establish procedures for handling consent withdrawals where consent is relied upon.

Ultimately, consent should be used when users can make a genuine, informed choice—not as a blanket authorisation for every use of their health data. By identifying the correct legal basis for each processing activity and respecting the additional protections applicable to health data, digital health app providers can strengthen GDPR compliance while building users' trust.

A Practical GDPR Compliance Checklist for Healthcare Apps

1. Before collecting health data

• Identify the personal data the app collects.

• Document the specific purpose of each processing activity.

• Identify the applicable Article 6 lawful basis.

• Determine whether Article 9 applies and identify an appropriate condition.

• Establish whether a data protection impact assessment is required.

2. When designing consent and privacy controls

• Request consent where appropriate and ensure it meets the relevant legal requirements.

• Separate consent requests for distinct purposes when necessary.

• Explain data use in clear, accessible language.

• Provide a practical way to withdraw consent.

• Explain who receives the data and how it is used.

3. During ongoing operations

• Collect only the information necessary for the intended purposes.

• Establish appropriate access controls and security measures.

• Define retention periods and deletion procedures.

• Review third-party processors and data-sharing arrangements.

• Reassess processing activities when purposes or circumstances change.

• Maintain documentation demonstrating compliance.

Conclusion

In conclusion, GDPR compliance is essential for healthcare applications that collect and process sensitive personal information. Developers and providers must understand the distinction between Article 6, which establishes the lawful bases for processing personal data, and Article 9, which imposes additional conditions on the processing of health data. Obtaining consent alone is not always sufficient; organisations must ensure that their chosen legal basis is appropriate, processing is limited to legitimate purposes, and adequate safeguards protect users' information. By implementing data minimisation, strong security measures, transparent privacy policies, and effective mechanisms for exercising individual rights, healthcare app providers can reduce privacy risks and build user trust. Ultimately, responsible health data management enables organisations to benefit from digital innovation and AI while respecting individuals' privacy and meeting their legal obligations.