The heart rate recorded by your smartwatch, hours of sleep, daily steps, a cycle calendar, a food diary, test results uploaded to an app: many of us carry in our pocket a health record richer than our doctor's. This data is useful for getting to know ourselves better, but it is also among the most sensitive there is. The GDPR gives it stronger protection, and knowing the rules helps you choose which apps to use and how.
What health data is
Article 4(15) of Regulation (EU) 2016/679 defines data concerning health as personal data related to a person's physical or mental health, including the provision of health care services, which reveal information about their health status.
The definition is broad. It covers not only diagnoses and test results, but also information from which someone's health can be inferred: resting heart rate recorded over time, a pregnancy noted in an app, medicines entered in a reminder, membership of an online support group.
Stronger protection
Health data falls within the special categories of personal data in Article 9, along with genetic and biometric data, political opinions, religious beliefs and others. Processing it is prohibited in principle, unless one of the exceptions listed in the article applies. For a wellness app aimed at the public, the most common exception is the data subject's explicit consent.
This has practical consequences:
- consent must be clear, separate and tied to specific purposes, not hidden in the terms of use;
- the app should ask for separate consent for further uses, such as research or sharing with partners;
- you can withdraw consent at any time, as easily as you gave it.
Wellness apps and health services
| Wellness app | Health service | |
|---|---|---|
| Examples | Step counter, sleep app, food diary | Booking appointments, telemedicine, online test results |
| Who runs it | A technology company | A healthcare provider or a supplier acting on its behalf |
| Typical legal basis | Explicit consent | Care purposes and obligations laid down by law |
| Professional secrecy | Usually absent | Applies to healthcare staff |
The difference matters: a wellness app is not bound by medical confidentiality and its business model may include advertising or analysing aggregated data. Reading the privacy notice is therefore even more important.
What to check before using an app
- Who the controller is and in which country it is based. If data is transferred outside the European Union, the notice must say so, along with the safeguards in place.
- What data it collects compared with what is needed. A step-counting app does not need your address book.
- Who it shares data with. Look for references to advertisers, business partners, group companies, research. Any sharing that is not necessary should be optional.
- Where data is stored. Some apps offer on-device storage only, without cloud syncing.
- How to delete it. Check whether there is a feature to delete the account and all associated data.
Useful settings
- Selective syncing: many smartphone health platforms let you decide which apps can read or write each category of data, for example sleep yes, heart rate no.
- Public profile off in sports apps: public leaderboards and routes can reveal where you live and what time you go out.
- App lock with a code or biometrics if it contains particularly private information.
- Discreet notifications: a medicine reminder that appears on the lock screen is visible to anyone who looks at your phone.
Employers and insurers
Some workplace or insurance programmes offer benefits in exchange for sharing physical activity data. Before joining, ask yourself:
- which data is transmitted, and whether it is aggregated or individual;
- who can see it within the organisation;
- whether refusing brings disadvantages that make consent not truly free, as Article 7 GDPR requires.
In employment, the imbalance between the parties makes it especially delicate to base the processing of health data on the employee's consent.
Your rights
You can exercise all your GDPR rights against the app: access to the data collected, including data observed by sensors; portability to another service; erasure after withdrawing consent; and a complaint to the data protection authority if you think the processing breaks the rules.
In short
- Health data also includes inferred information, such as heart rate, sleep or cycle tracking.
- It is a special category under Article 9 GDPR: wellness apps generally need explicit consent.
- Wellness apps are not bound by medical confidentiality: read the privacy notice carefully.
- Use selective syncing, turn off public profiles and protect your notifications.
- Approach workplace or insurance programmes based on data sharing with caution.