Health data is different from most other personal data. It can affect your insurance, your employment, and your most intimate relationships. It reveals things about your family as well as yourself. And unlike a leaked password, a leaked medical record can't be changed.
This is why how your health data is stored, processed, and accessed matters — perhaps more than for any other category of personal information.
The GDPR framework: health data as a special category
In Europe, health data is classified as a "special category" under Article 9 of the General Data Protection Regulation. This means it receives the highest level of legal protection available — separate from, and more stringent than, protections for ordinary personal data.
Under Article 9, processing health data is prohibited by default. There are specific legal bases that allow it — explicit consent being the most relevant for health services — but each one comes with conditions. Consent must be freely given, specific, informed, and unambiguous. It can be withdrawn at any time. And the controller must be able to demonstrate that consent was properly obtained.
What this means in practice
If a European health service processes your biomarker data, GDPR requires:
- A clear legal basis for every processing activity — what are they doing with your data and why? - Purpose limitation — data collected for one purpose cannot be repurposed without consent - Data minimisation — only the data necessary for the stated purpose can be collected - Storage limitation — data cannot be kept indefinitely; retention periods must be defined - Your right of access — you can request a copy of all data held about you, at any time - Your right to erasure — you can request deletion, and the controller must comply unless there's a specific legal obligation to retain it - Your right to portability — you can receive your data in a machine-readable format and transfer it to another service
These aren't aspirational guidelines. They're enforceable legal obligations, backed by fines of up to 4% of global annual turnover for serious violations.
The data sovereignty difference
Beyond the legal framework, EU data residency matters practically. Data stored on servers within the European Union is subject to EU law. It cannot be compelled by non-EU government orders (such as US CLOUD Act warrants) in the same way data held by a US-based company can.
US health data companies, even if they have European users, frequently store data on servers in the United States. This exposes that data to US legal jurisdiction — meaning government agencies can, under certain legal authorities, request access without the user's knowledge.
Health data held in Europe, by a European entity, under EU law, operates in a different legal environment.
Data portability as a design principle
The right to data portability is often described as a right in theory that's difficult to exercise in practice. Many services make export cumbersome, require support tickets, or provide data in formats that are effectively unusable.
A genuinely privacy-respecting health service should make export easy, deletion straightforward, and data formats standard. These should be features, not friction.
foreverbetter is built in Lisbon, processes data under GDPR, and treats export and deletion as first-class features — not afterthoughts. You can download your data in standard formats or request complete deletion at any time. No waiting periods, no explanations required.
A note on genetic data
Genetic data receives even higher protection than standard health data under the GDPR, specifically classified in Article 9(1) as a special category requiring explicit consent. Genetic data is uniquely sensitive because it is immutable, it identifies biological relatives, and its implications cannot always be fully known at the time of collection.
If you're considering sharing genetic data with any health service — European or otherwise — the key questions to ask are: where is it stored, who has access to it, what is it used for, and can you delete it?