Sovereignty

Health data: what GDPR actually guarantees you

European hosting, minimisation, portability, erasure: what regulation requires from health apps and the questions to ask before handing over your data.

In short

GDPR classifies health data as sensitive, which requires explicit consent, a precise purpose, data minimisation and rights of access, portability and erasure. Before using a health app, check the hosting location, the list of processors, the retention period and whether a DPO contact exists.

Key takeaways

Health data falls under GDPR article 9: special category, explicit consent required.
Four rights apply without justification: access, portability, rectification, erasure.
Hosting location and processor lists are public information: if you cannot find them, that is already an answer.
The best protected data remains the data that was never collected.

Contents4

A sleep log, a supplement list and a blood panel draw an extremely precise portrait of a person. That is why GDPR places this information in the special categories of data.

Sleep, stack and blood work combined say more about you than any advertising profile.

The four rights that matter day to day

Access: obtain a copy of what is stored about you.
Portability: export your data in a readable, reusable format.
Rectification: correct wrong data.
Erasure: request deletion, without justification in most cases.

Questions to ask before signing up

1
Where is the data hosted?
Country and jurisdiction determine who can legally access it, including outside any contractual relationship with you.
2
Which processors access it?
The list must be public and current, with each purpose stated. An analytics vendor has no business inside a biomarker database.
3
How long is it kept?
A retention period must be announced for after account closure. «Indefinitely» is not a duration.
4
Is there a reachable DPO?
A dedicated email address and a public processing register are worth more than any trust badge.
5
Is the data used for advertising?
If the answer is not a plain no, it is a yes with intermediate steps.

Minimisation: collect less to risk less

The best protection is the data never collected. A well designed app asks only for what the service requires, not one field more. Consent must be granular: accepting the service should never force you to accept a newsletter or analytics.

« Data sovereignty is not a legal checkbox, it is an architecture decision. »

Where Helix stands

Helix is built in Europe, with European hosting, a public processing register, granular consent for non essential cookies and a direct DPO contact. Sensitive data stays local-first on your device. No advertising, no data resale.

Want to check for yourself before signing up?

Read the processing register

Sources

Frequently asked questions

Can a health app resell my data?

Not without explicit, separate and revocable consent covering that exact purpose. Consent buried in terms accepted in bulk does not meet the bar. In practice the question is simple: do resale or ad sharing appear in the privacy policy, and can you refuse without losing the service?

Where should health data be hosted in Europe?

GDPR does not mandate European hosting as such, but it strictly frames transfers outside the EU. In practice European hosting simplifies compliance and removes dependence on fragile transfer mechanisms. For health data processed on behalf of a French healthcare professional, HDS certification stacks on top.

How do I exercise my right to erasure?

A written request to the controller or the DPO is enough, without justification in most cases. The response deadline is one month, extendable to three for complex requests. If nothing comes back, the supervisory authority can be contacted.

What does local-first actually mean?

That data is written on your device first and stays there by default. Sync, when it exists, goes through your own cloud rather than a central server. Direct consequence: there is no central database to breach, and erasure is immediate because the reference copy is yours.

Educational content. Helix is not a medical device and does not replace professional medical advice.

Comments

Moderated before publication

Loading comments…