Do health data rules apply to an online seller?
Short answer
Yes when the shop sells health products with records attached. The category test is what the record reveals, not what the product is called.
Read against the registers 2026-08-26.
Who the role is
A trader who sells to a consumer at a distance, on its own site or through a marketplace.
What the topic covers
Health records are a special category everywhere, but the boundary differs. The GDPR follows the data. HIPAA follows the covered entity. PIPL follows the sensitive category and asks for separate consent.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Health data is a special category: processing needs a condition in addition to the legal basis.
United States
- HIPAA Security Rule: Applies to covered entities and business associates, with administrative, physical and technical safeguards.
China
- Personal Information Protection Law of the People's Republic of China: Health data is sensitive personal information: separate consent and a necessity assessment apply.
Where companies usually start
- Decide first whether you are a covered entity in the US sense, then read the EU and Chinese tests separately.
- Write the necessity assessment before the product decision, not after it.
- Keep access logs for health records apart from general application logs.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for seller in distance selling
- Do ai governance rules apply to an online seller?
- Do personal data rules apply to an online seller?
- Do cross-border data rules apply to an online seller?
- Do cybersecurity rules apply to an online seller?
- Do online platforms rules apply to an online seller?
- Do consumer rights rules apply to an online seller?
- Do product safety rules apply to an online seller?
- Do climate disclosure rules apply to an online seller?
- Do export controls rules apply to an online seller?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
