By business type

GDPR Policy Generator for healthcare

Written for health data: Article 9 conditions, HIPAA where it applies, and the wellness gap where it does not.

Generate your GDPR policy Read the GDPR policy guide

Health processing is on every supervisory authority’s mandatory DPIA list, which means the assessment is not a judgement call. The other document that gets asked for first in the UK is the appropriate policy document that several Schedule 1 conditions require you to have in place.

Health data is special category data under GDPR and UK GDPR, which means an Article 6 basis is not enough on its own - you also need an Article 9 condition, and the ones available to a private business are narrower than most people expect. Explicit consent, health or social care provision, and public health are the usual candidates, and each carries its own conditions.

In the US the position is more confusing, because most consumer health products are not covered by HIPAA at all. HIPAA reaches covered entities and their business associates; a fitness app, a symptom tracker or a wellness marketplace usually falls outside it - and straight into Washington’s My Health My Data Act, which has a private right of action, and into FTC health breach notification rules.

The recurring failure across both regimes is advertising technology. Pixels on appointment booking pages, symptom checkers and patient portals transmit health-adjacent data to ad platforms, and this has produced some of the largest health privacy enforcement actions and class settlements of recent years.

What a GDPR policy for a healthcare or health-tech business has to cover

The Article 9 condition and, in the UK, the Schedule 1 condition plus appropriate policy document
A completed DPIA covering clinical processing, not just the infrastructure
Records of processing separating care, administration, billing and any research use
Processor terms with practice management, messaging and hosting providers
Statutory clinical retention schedules, reconciled against minimisation

How a healthcare or health-tech business actually moves personal data

Intake forms and symptom questionnaires

Health data collected before any clinical relationship exists, often through a web form with the same tracking as the marketing site.

Appointment booking

The fact of booking with a particular specialist is itself health data, which is why booking pages are the highest-risk place to run advertising pixels.

Clinical records and notes

Retained under statutory schedules, accessible only to those with a clinical need, and subject to access requests with clinical exemptions.

Wearables and connected devices

Continuous measurement data, frequently transmitted through a device manufacturer’s cloud before it reaches you.

Insurance and billing

Claims data links diagnosis to identity and moves between multiple organisations, each with its own role.

Research and secondary use

Using clinical data for research or product improvement is a new purpose needing its own basis and usually its own governance.

Third parties the draft will ask you about

practice management systems · Stripe · Twilio for reminders · AWS or Azure with a BAA where required · lab and imaging partners · insurance clearing houses

The rules that apply

GDPR Article 9

Health data needs a condition in addition to a lawful basis, plus in the UK a Schedule 1 condition and often an appropriate policy document.

HIPAA where it applies

Covered entities and business associates: privacy rule, security rule, breach notification, and business associate agreements down the chain.

The consumer health gap

Washington My Health My Data, Nevada’s equivalent, and FTC health breach notification reach products HIPAA does not.

Clinical records retention

Statutory retention schedules for health records are long and specific, and they override ordinary minimisation instincts.

Professional confidentiality

A duty of confidence separate from data protection, enforced through regulators and the courts.

What the generated GDPR policy contains

Article 13 and 14 transparency notice
The full disclosure set, split by whether the data came from the person or from somewhere else.
Lawful basis register
Every processing activity mapped to one of the six bases, with the legitimate interests assessment written down where you rely on that basis.
Records of processing (Article 30)
The internal register a supervisory authority can ask for at any time, covering purposes, categories, recipients, transfers and retention.
Data subject rights procedure
How a request arrives, how identity is verified, who handles it, and the one-month clock with its two-month extension.
International transfer mechanism
Adequacy, SCCs with a transfer impact assessment, or the UK IDTA/addendum - named per destination, not asserted in general.
Breach detection and 72-hour notification
The internal escalation path, the assessment test, and the template for notifying the regulator and, where required, the individuals.
Processor and sub-processor controls
Article 28 terms, the sub-processor list, and the change-notification commitment your customers will ask for.

Health data compliance essentials

Identify your Article 9 condition and record it
Plus the UK Schedule 1 condition and appropriate policy document where required.
Remove advertising tags from clinical journeys
Booking, intake, symptom and portal pages. Verify with a scan rather than a policy statement.
Determine your HIPAA status honestly
And if you fall outside it, work out which consumer health statutes apply instead.
Put BAAs or DPAs in place down the chain
Including hosting, messaging and analytics vendors that touch health data.
Apply statutory retention schedules
Clinical records have their own periods that override general minimisation.
Separate care processing from marketing
Different systems where possible, different bases always.

Where this usually goes wrong

Advertising pixels on booking or symptom pages

The specific pattern behind the largest health privacy enforcement and class actions of recent years.

Assuming HIPAA covers you, or that not being covered means no rules

Both are wrong for most consumer health products. The state consumer health laws are the ones that bite.

Relying on consent alone under GDPR

Consent in a care context is often not freely given. Health or social care provision is usually the better condition.

No appropriate policy document in the UK

Several Schedule 1 conditions require one, and its absence invalidates reliance on the condition.

Marketing to patients from clinical records

A different purpose from care, requiring its own basis and usually explicit consent.

Sharing data with a device manufacturer without disclosure

Wearable data usually passes through the manufacturer’s infrastructure before it reaches you.

Frequently asked questions

Is health data different from other personal data?

Yes. Under GDPR and UK GDPR it is special category data requiring an Article 9 condition in addition to a lawful basis, and in the UK often a Schedule 1 condition with an appropriate policy document.

Does HIPAA apply to my health app?

Usually not. HIPAA applies to covered entities and their business associates. Most direct-to-consumer health and wellness products fall outside it - and inside state consumer health laws and FTC breach notification rules instead.

Can I run analytics on a patient booking page?

Not without extreme care. The fact of booking with a particular provider is health data, and transmitting it to an ad platform is the pattern behind the largest enforcement actions in this area.

How long must clinical records be kept?

Statutory schedules apply and vary by record type and jurisdiction, often running to decades. They override the instinct to minimise.

Does GDPR apply to a business outside the EU?

Yes, where you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) is about where the person is, not where you are - and Article 27 may also require you to appoint an EU representative.

What is the difference between EU GDPR and UK GDPR?

The text is nearly identical, but they are separate laws with separate regulators, separate fine ceilings in different currencies, and separate transfer regimes. A business serving both needs both named, not "GDPR" as shorthand.

Do I need a Data Protection Officer?

Only where your core activities involve large-scale regular monitoring or large-scale special-category data, or you are a public authority. Many businesses do not need one - but if you do not have one, say who is accountable instead.

Is a GDPR policy the same as a privacy policy?

No. The privacy policy is the outward-facing notice. The GDPR policy set is the internal machinery - lawful basis register, ROPA, rights procedure, breach plan - that lets you answer a regulator when they ask how the notice is honoured.