Do health data rules apply to an online marketplace?
Short answer
Only when health related products or records pass through the marketplace itself. Listing a product is not the same as processing a health record.
Read against the registers 2026-08-26.
Who the role is
A platform where a third party sells to a buyer: the platform carries duties of its own, next to the seller's.
What the topic covers
Health records are a special category everywhere, but the boundary differs. The GDPR follows the data. HIPAA follows the covered entity. PIPL follows the sensitive category and asks for separate consent.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Health data is a special category: processing needs a condition in addition to the legal basis.
United States
- HIPAA Security Rule: Applies to covered entities and business associates, with administrative, physical and technical safeguards.
China
- Personal Information Protection Law of the People's Republic of China: Health data is sensitive personal information: separate consent and a necessity assessment apply.
Where companies usually start
- Decide first whether you are a covered entity in the US sense, then read the EU and Chinese tests separately.
- Write the necessity assessment before the product decision, not after it.
- Keep access logs for health records apart from general application logs.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for online marketplace
- Do ai governance rules apply to an online marketplace?
- Do personal data rules apply to an online marketplace?
- Do cross-border data rules apply to an online marketplace?
- Do cybersecurity rules apply to an online marketplace?
- Do online platforms rules apply to an online marketplace?
- Do consumer rights rules apply to an online marketplace?
- Do product safety rules apply to an online marketplace?
- Do climate disclosure rules apply to an online marketplace?
- Do export controls rules apply to an online marketplace?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
