Secondary use of health data: what you should know

Electronic health data are made available for secondary use only for the purposes of Art. 53(1) of Regulation (EU) 2025/327: public health, policy making, official statistics, education, scientific research, the improvement of care, and the development of products and services in the field of health. Access is granted by a data permit of the health data access body (Art. 68) or, for anonymised statistics, by a decision on a health data request (Art. 69). The processing rests on Art. 6(1)(e) and Art. 9(2)(h), (i) and (j) of the GDPR, as Art. 53 and Art. 68 of the Regulation provide. Uses listed in Art. 54 are prohibited: no decisions detrimental to a person, no advertising, no insurance or credit decisions, no re-identification.

• Data are made available only in a secure processing environment (Art. 73); no record leaves it. Outputs are aggregate, and counts below five are suppressed.
• Data are pseudonymised by the trust centre before they reach the environment (Art. 66); anonymised where the purpose allows.
• Every access and activity in the environment is logged with the permit it ran under and kept at least 12 months (Art. 73(1)(e)).
• A data user that does not comply is investigated and may lose its permit, be excluded or be fined (Art. 63, Art. 64); the measures are public.

• To opt out of the secondary use of your personal electronic health data, at any time and without giving reasons (Art. 71).
• To be informed, through this page, which data are used, by whom and for what (Art. 58(1)(f)), and what came of it (Art. 58(1)(g)).
• The rights of Chapter III of the GDPR: information, access, rectification, erasure and objection, as they apply to pseudonymised data (Art. 15 to 22 GDPR).

Sign in to your health record and use the secondary-use opt-out there; it takes effect at once for every future permit. For the GDPR rights, write to the access body named below or to the data holder that keeps your record; the body answers within one month (Art. 12(3) GDPR). A complaint may be lodged with the data protection supervisory authority.

MedReg DE (fictional), did:web:medreg.de:hdab

All organisations on this platform are fictional; no real access body operates it.

No data permit is in force.

Every application, decision, revocation and measure is on the public register.

No data user has communicated results yet. A data user has 18 months after the end of its processing to do so (Art. 61(4)).

Fees cover the cost of making the data available and are split between the access body and the data holder. The schedule is the demo's own and fictional.