Health Data

Health data is personal data related to the physical or mental health of a person that reveals something about their health status, such as a diagnosis, a previous illness or test results. Under UK GDPR Article 4(15) it is data concerning health, and under Article 9 it is special category data: processing needs a lawful basis plus a separate condition, for example explicit consent.

What is health data?

Health data is personal data that relates to a person's physical or mental health and reveals something about their health status. UK GDPR Article 4(15) calls it “data concerning health”, and the ICO quotes the definition as “personal data related to the physical or mental health of a natural person”. Data that arises when someone receives health care, for example at a GP surgery, in hospital or in a care home, is covered too.

The source does not matter. A consultant's letter counts, and so does a client's chat message saying she was treated for a bad back last year. Typical examples:

Conditions and treatment: diagnoses, disabilities, medication and therapy, including mental health.
Test results: medical reports, lab results and fit notes.
Booking details: an appointment with a specialist can reveal a condition too.

Why is health data specially protected?

Health data is special category data under UK GDPR Article 9, alongside genetic and biometric data, religious beliefs or sexual orientation. The ICO's guidance says an organisation needs a lawful basis under Article 6 and, in addition, a separate condition under Article 9 to process it. The reason is risk: a medical detail in the wrong hands can follow a person into a job or the next insurance application.

Article 9 lists the conditions. The explicit consent of the person for a specified purpose is one of them. Which condition applies to your own processing is a question for your data protection lead.

Anyone who processes health data also needs protection that fits the higher risk. That covers your own technical and organisational measures and every provider that processes data on your behalf, which needs a data processing agreement (DPA).

Which health data does an insurance brokerage handle?

In insurance, health data arises in two places: the medical questions on an application and the claim. Typical examples:

Income protection: past illnesses, treatment and therapy, including mental health. A claim adds GP and consultant reports.
Private medical insurance: questions about treatment and medication. Later, almost every claim form or invoice names a diagnosis.
Life and critical illness cover: questions about past conditions and hospital stays, and for higher sums sometimes a medical examination.
Personal accident cover: after an accident, medical reports, the course of treatment and how serious the injury is.

For a brokerage this means health details often pass through the office on their way to the insurer. Clients also send them unasked, for example by asking whether a slipped disc would affect their income protection. How brokerages organise client communication otherwise is covered in our guide to customer communication for insurance brokers, and what SendSeven offers them on the insurance industry page.

Do appointment reminders count?

They can. A reminder that names the type of cover or the reason for the call already says something about a client's health. Keep reminders neutral: date, time and who the client is meeting, without the cover, the reason or any result.

Can you ask for health details on WhatsApp?

We advise against it, even though UK GDPR does not ban any particular channel. Processing health data needs one of the Article 9 conditions and protection that fits the risk. On top of that come Meta's rules.

Meta's WhatsApp Business Messaging Policy (as of 23 September 2026) contains two relevant points:

Health information: businesses should not use WhatsApp for telemedicine, and should not send or ask for health information where applicable rules prohibit passing it to systems that do not meet the higher requirements for health data.
Sensitive identifiers: businesses should neither share nor ask clients to share full payment card numbers, account numbers, ID numbers or other sensitive identifiers.

So our everyday rule is simple: health details are not asked for in the chat. Our entry on GDPR-compliant messaging covers messaging rules in general. How your brokerage handles health data is for your compliance consultant or data protection lead to settle.

How do you keep health details out of the chat?

The rule is about process, not technology. The chat carries the route, not the content:

In the chat: appointment suggestions, callback requests, reminders about missing documents and status updates without detail.
Not in the chat: health questions, diagnoses, medical reports, photos of fit notes and full card, account or ID numbers.
Instead: the conversation in the meeting or on the phone, and documents through a secure upload or a client portal.

If a client sends health details anyway, do not engage with the content. A short reply is enough, for example: Thanks for your message. I'd rather go through your health questions in person. Does Thursday at 10am work for a call? Agree with your data protection lead beforehand how the team handles such messages.

One more point: a WhatsApp opt-in covers contact through the channel. It is not explicit consent to process health data under Article 9.

Practical example

Ellery Insurance Brokers in Shrewsbury answers client questions on WhatsApp too. One evening a client in her thirties writes that she would like income protection and had a course of therapy two years ago. The team replies the next morning, does not respond to the therapy and suggests a call.

On the phone, Daniel Ellery and the client go through the health questions together. She uploads the therapist's report through a secure upload link. Afterwards the chat shows only what was needed to organise things: the appointment, a reminder, a confirmation. In SendSeven the team records in an internal note that the health questions were discussed by phone, not the details themselves.

This is general information, not legal advice. Check the details with your data protection lead or compliance consultant.