The situation
A description of patient data flows and the purposes planned for them
Your company runs a booking and video-consultation platform used by 300 practices in Germany. Product wants to use appointment and symptom data to improve triage, marketing wants to send check-up reminders, and a university in Leipzig has asked for a research dataset. The data protection officer has asked legal for one memo before any of it starts.
The prohibition is easy to state. The hours go on matching each purpose to a lawful basis and to a special-category exception, checking what German law adds, and working out where consent is the only route and what happens if a patient withdraws it. Each purpose gets a different answer.
What the research has to settle
The rules behind the answer
- Two tests, not one
- Processing health data needs a lawful basis under Article 6 GDPR and one of the exceptions in Article 9. Meeting one test does not satisfy the other, so each purpose is checked against both.
- Health data is read broadly
- The Court of Justice has treated data from which health information can be inferred as special-category data. Symptoms, appointment types and order details can qualify even when no diagnosis is stored.
- Care and research rely on further law
- The GDPR allows processing for health care under professional secrecy, and for scientific research, but both depend on EU or national law for the basis and safeguards. In Germany, the Federal Data Protection Act and sector laws supply those conditions.
- Large-scale processing needs a DPIA
- Processing special-category data on a large scale requires a data protection impact assessment before it starts. A platform serving hundreds of practices should expect to assess each new purpose.
How it runs in azta
From the question to the document
The question, as you would type it
German video-consultation platform used by 300 practices. We want to use symptom and appointment data to develop triage rules, send check-up reminders, and give pseudonymised data to a university. What Article 6 and Article 9 GDPR basis fits each purpose, and what does the BDSG add?
You start with
A description of patient data flows and the purposes planned for them
- 01
Set out each purpose
List the data, the purposes and the parties. azta searches the GDPR, the EDPB material it holds, the German Federal Data Protection Act and the sector legislation.
Cited research· Free - 02
Find the decisions on special-category data
Ask for the Court of Justice and German decisions on what counts as health data and on consent. azta summarises each and links the full text.
Case-law search - 03
Draft the memo
Ask for a memo with one section per purpose: basis, exception, safeguards and open points. Edit it in Canvas.
Canvas · Ask azta· Pro - 04
Export for the DPO
Export to Word for the data protection officer and keep the cited research with the record of processing.
Word export· Pro You send
A memo setting out the legal basis and special-category exception per purpose
What you get
A memo setting out the legal basis and special-category exception per purpose
Legal memo · draft
Patient data on the platform: legal basis per purpose
Care delivery. Booking and consultation data processed so that practitioners can treat their patients can rely on the health-care exception, as it is processed under the responsibility of professionals bound by secrecy. Our working assumption is that the platform acts for the practices here, and the processing agreements should say so.
Product development. Using the same data to develop triage rules is a new purpose of the platform itself, and none of the care-related exceptions covers it on its face. Unless the data can be anonymised, explicit consent is the realistic route. Section 3 sets out what a withdrawal would mean for the feature.
Research and reminders. The university request may rely on the research exception with the safeguards German law requires, subject to the pseudonymisation and access terms in Annex B. Reminders sent for marketing need consent. Reminders sent by a practice for a booked treatment are assessed separately.
Outcomes on your numbers
What azta is worth on this task
Pro pays for itself after
14 minutes a month
At €120 an hour, that is all the time Pro (€27 a month) has to take off your desk to cover its price.
Example figures. Replace them with your own.
- Hours back a year
- 43
- Capacity at your rate
- €5,184
- More data-protection memos a quarter
- 1.4
- Return on Pro
- 16×
- Research
- Drafting
- Your review
A scenario you set, not a promise. The hours that come back go to another client, or deeper into this one.
Want these numbers on your team’s real workload?
Book a demoSources azta searches here
- EUR-Lex · Curia
- EDPB
- Gesetze im Internet
- Rechtsprechung im Internet
What stays with you
- The data map: what is collected, where it flows and who has access.
- The risk decision on each purpose, and the impact assessment.
- What the DPO and the supervisory authority are told.
Frequently asked questions
- Does azta hold the German supervisory authorities’ guidance?
- It holds EDPB material, EU law and German legislation and case law. Guidance from the German data protection authorities is not in the corpus, so check it separately where it matters.
- Will it tell us that consent is needed?
- It shows which bases and exceptions are available for each purpose and cites them. The choice, and the consent wording, stay with you and the DPO.
- Is our data map safe to upload?
- Client documents are never used for training on any plan and stay in the EU/EEA. On Enterprise, a sealed tenant and SSO are available.
