Health data in workplace prevention programmes: participation and access limits

A voluntary workplace prevention programme can support employees with exercise, nutrition or stress management. Once the programme collects information about symptoms, diagnoses, measurements, physical capacity or individual health goals, the processing of health data becomes central. Participation and result data may also allow conclusions about a person.

This article explains how businesses can limit the processing, keep participation voluntary and separate access rights. It focuses on the classification under Articles 4(15) and 9 GDPR, the two-level legal-basis assessment, medical professionals and erasure. Sickness administration, mandatory vaccination and general privacy information pursue different purposes.

Article 4(15) GDPR covers personal data relating to physical or mental health that reveals information about a person’s health status. This can include information about illnesses, symptoms, treatment, physiological values or assessed capacity. The information conveyed by the specific entry is decisive.

Registration for a back-care course usually begins as organisational information. A questionnaire about pain, mobility or previous conditions has a different quality. A result such as “high stress risk” may also reveal a person’s health status even without naming a diagnosis. Article 9(1) GDPR classifies health data as a special category of personal data.

Businesses should assess each input and result separately. An attendance confirmation, an individual training plan and a medical consultation note should not fall within one standard role. The employee data protection topic page places these processing activities in the employment context.

An offer described as voluntary needs a real choice. Employees should understand what information is collected, why it is needed and which roles receive it. The decision to take part should remain separate from appraisals, work scheduling, promotion and other employment conditions.

Where processing relies on consent, Article 7 GDPR requires attention to information, proof and withdrawal. Withdrawal must be as easy as giving consent. The consequences for information already collected require a separate assessment of purpose, legal basis and erasure.

The employment context calls for particular care. A signature alone does not prove free choice if managers encourage participation or a refusal becomes visible at work. Design registration and refusal so that employees do not face individual disadvantages or social pressure.

The purpose must be specific. Organising an appointment, individual support by a medical professional, an anonymised health-promotion statistic and later contact after the programme are different purposes. Article 5(1)(b) GDPR requires purpose limitation, while Article 5(1)(c) requires data minimisation.

A legal basis under Article 6 GDPR is not enough for health data. An exception under Article 9(2) GDPR is also required. Depending on the design, explicit consent or the conditions for preventive or occupational medicine may be relevant. The exception cannot be inferred from the label “prevention” alone.

For each type of data, the records should show the purpose, the information required and the Article 6 and Article 9 assessment supporting the processing. The page on privacy governance and compliance supports the allocation of responsibilities and evidence.

For administering a voluntary programme, the employer often needs less information than medical staff. Attendance or the booked session may be enough for appointment planning. A diagnosis, measurement or consultation note is not automatically needed by HR or a manager.

What may be shared depends on the purpose, legal basis and information given to employees. In many settings, a sufficiently anonymised or aggregated evaluation is more suitable for business planning than a list of individual values. Anonymisation must genuinely remove the person from the result with reasonable means.

Articles 25 and 32 GDPR require privacy by design and a level of security appropriate to the risk. Create separate roles for registration, medical support, employer evaluation, provider support and administration. The article on access rights for employee data shows how roles, logs and exceptions can be documented.

An external studio, health platform or medical service can have different roles. Whether Article 28 GDPR applies depends on the actual decisions about purposes and means. A contract headed “privacy” does not settle the role allocation by itself.

Record which systems receive the information, where questionnaires and results are stored, which sub-processors are involved and whether support staff can access the data. Check exports, interfaces and any use by the provider for product development or advertising. Each such use needs its own purpose and legal-basis assessment.

Articles 24 and 30 GDPR require accountable organisation and records of processing activities. If processing is likely to create a high risk, assess the need for a data protection impact assessment under Article 35 GDPR. New measurement devices, a central health platform or broader evaluation may trigger a renewed assessment.

Article 5(1)(e) GDPR requires storage limitation. A retention period for an attendance or appointment list therefore need not match the period for an individual health report. Set purpose, access and the erasure event separately for registration, questionnaire, measurement, consultation result, invoicing and security logs.

When support ends or a person withdraws consent, assess the consequences for each type of data. Article 17 GDPR may give rise to a right to erasure unless a prevailing obligation or another valid reason supports continued storage. Erasure processes must also cover exports, test environments, backups and provider operations.

Employees need clear information and a workable route for their rights under Articles 12 to 15 GDPR. The organisation should decide who handles access requests, how identity and scope are checked and which programme information is actually disclosed. An access process should not unnecessarily broaden access to other employee data.

Attendance is mixed with results: An attendance list suddenly contains questionnaire answers or individual measurements.

Article 6 is assessed alone: The additional requirement for health data under Article 9 GDPR remains unsupported.

Voluntariness exists only in the invitation: Managers can see who declines, or employees fear consequences at work.

The employer receives raw data: Individual values are transferred for planning even though an aggregated evaluation could be enough.

The provider remains unclear: Storage locations, sub-processors, own uses and erasure procedures are not documented.

Start with a complete process map. Record registration, information, consent, appointment, questionnaire, measurement, consultation, result, employer evaluation, support and erasure. Mark the data type at each step and distinguish health data from basic organisational information.

Then check the recipients. For every role, record what it can see, which purpose it serves and how access is controlled. Test refusal and withdrawal with a realistic example. The process must work even when an employee does not want to provide health information.

Finally, bring together the records, provider documents, privacy information, consent text, role matrix, retention plan, security concept and DPIA decision. A process description and the actual forms support the first assessment. This makes it possible to decide whether the offer can operate with limited access and clear accountability.

We review data types, purposes, consent, recipients, provider roles, access controls, retention periods and the decision on a data protection impact assessment. The programme description, forms, provider documents, role matrix and planned information text support the first assessment. This allows prevention and participation to be organised while protecting individual health information.