# GDPR and health data for developers > Article 9 health data as engineering tasks: legal basis, DPA, EU residency, security, access and erasure, DPIA — mapped to what Anpheros covers. HIPAA: planned. Not legal advice. Source: https://developers.anpheros.com/guides/gdpr-health-data-developers **Under the GDPR, health data is a special category of personal data (Article 9): processing it is prohibited unless one of a short list of conditions applies, such as the person's explicit consent or the provision of health care, and it needs stronger safeguards than ordinary personal data.** For software teams this turns into concrete design decisions: a documented legal basis, a processor agreement with every vendor that touches the data, EU data residency or a lawful transfer, access control and logging, and ways to give people their data and erase it. This page maps those requirements to engineering work and shows which parts a health data platform such as Anpheros already covers. It is technical guidance, not legal advice. ## The requirements, as engineering tasks | GDPR requirement | What it means in code and operations | In Anpheros | |---|---|---| | Article 9 legal basis | Decide and record why you process health data (explicit consent, healthcare, public health, research…) | Yours to decide and document; access by other apps goes through explicit OAuth consent, and each grant records the purpose the app declared | | Article 28 processor agreement | Sign a data processing agreement with every processor | Production access requires a signed DPA | | Chapter V transfers | Keep data in the EU/EEA, or use a lawful transfer mechanism | Stored and processed in the EU (Google Cloud `europe-west4`, Netherlands) | | Article 32 security | Encryption, access control, isolation, logging, resilience | Per-project isolation, pairwise patient ids, encrypted documents with a customer-managed key, an access log | | Article 15 right of access | Give the person a copy of their data | `Patient/$everything` (full FHIR record) and `$summary` (IPS) | | Article 17 right to erasure | Delete when the basis ends or the person asks | Delete through the API; deletions are soft and versions are kept for audit — plan how your retention policy handles them | | Article 25 data protection by design | Collect only what you need; limit who can see it | SMART scopes and category filters limit what each app reads | | Article 30 records of processing | Document what you process and why | Provenance on every write: author, organisation, source system | | Article 33 breach notification | Detect and report within 72 hours | Your incident process; the platform logs every access | | Article 35 DPIA | Assess high-risk processing before you start | Yours to write; the platform documents its own measures | ## Consent is not the only legal basis Explicit consent (Article 9(2)(a)) is common for patient apps, but clinics usually rely on the provision of health care (Article 9(2)(h)) and research projects on Article 9(2)(j) with national law. Choose the basis per purpose, record it, and do not ask for consent you will not honour: consent must be as easy to withdraw as to give. In Anpheros, a person revokes an application's access from the consent page and the next request fails. ## The European Health Data Space adds to the GDPR Regulation (EU) 2025/327 (EHDS) keeps the GDPR and adds rights and formats: people get electronic access to their priority data (patient summary, prescriptions, lab results, images, discharge reports) and can share it, and EHR systems must support the European exchange format. See [EHDS for developers](https://developers.anpheros.com/guides/ehds-for-developers). ## And HIPAA? The GDPR applies to people in the EU; HIPAA applies to covered entities and their business associates in the US. Anpheros is built for the GDPR and EU data residency. HIPAA support, including a business associate agreement (BAA), is planned for the US market and not available yet. ## Frequently asked questions ### Is health data special category data under the GDPR? Yes. Article 9 lists data concerning health among the special categories; processing it requires one of the Article 9(2) conditions in addition to an Article 6 legal basis. ### Do I need explicit consent to process health data? Not always. Explicit consent is one condition; others include the provision of health or social care, public health and scientific research under national law. Choose and document the one that fits each purpose. ### Must health data be stored in the EU? The GDPR does not require EU storage, but transfers outside the EEA need a lawful mechanism (an adequacy decision or appropriate safeguards). Keeping the data in the EU avoids that question; some national rules are stricter. ### Is Anpheros GDPR compliant? Anpheros is designed for the GDPR: EU data residency, a data processing agreement for production, consent controlled by the patient, isolation between applications and an access log the patient can read. Compliance of your product also depends on your own legal basis, documentation and processes. ## Related - [Security, privacy and data residency](https://developers.anpheros.com/guides/security) - [European Health Data Space (EHDS) for developers](https://developers.anpheros.com/guides/ehds-for-developers) - [Patient consent platform for health apps](https://developers.anpheros.com/guides/patient-consent-platform) - [Medical data provenance explained](https://developers.anpheros.com/guides/medical-data-provenance) - [EHR API and medical records API](https://developers.anpheros.com/guides/ehr-api)