Health data under GDPR + AI Act

Health data = special category personal data

GDPR Art. 9 prohibits processing health data unless there is an explicit legal basis. For AI training in healthcare: patient consent, scientific research, or vital interest. The AI Act adds Art. 10: data governance requirements for training, validation, and testing.