Your DNA, your medical history, your prescription records, and your hospital visits contain information that could save your life or someone else’s. European researchers and doctors have known this for years. The question has never been whether health data is valuable. The question is who gets to use it, how, and under what rules. The EU is now answering that question with a framework that could make Europe the global leader in personalised medicine done right.
What Is Personalised Medicine and Why Does Your Data Matter?
Personalised medicine, sometimes called precision medicine, is an approach to healthcare that uses detailed information about individual patients to tailor treatments specifically to them rather than applying the same standard treatment to everyone with a similar diagnosis. Instead of prescribing the same chemotherapy drug to every cancer patient with a particular tumour type, personalised medicine asks which specific genetic characteristics of this patient’s tumour respond best to which treatment, and what side effects are they most likely to experience based on their individual biology.
This approach relies on data. Large amounts of it, from many patients, analysed to find patterns that would be invisible in small datasets. Genomic data (information about a person’s genetic code), electronic health records, prescription histories, lab results, and even lifestyle data all contribute to building the kind of detailed picture that makes genuinely personalised treatment possible.
The challenge is that health data is among the most sensitive personal information that exists. A genomic dataset does not just reveal information about you. It reveals information about your parents, your children, and your wider family. A health record can affect your insurance, your employment, and your relationships in ways that other types of personal data cannot. Getting the rules right about who can access this data and how it can be used is not a bureaucratic exercise. It is a profound question about trust, privacy, and the kind of healthcare system Europeans want to live inside.
The EHDS: Europe’s Landmark Health Data Law
The European Health Data Space (EHDS) is a major EU regulation that was approved by the European Parliament in 2024 and represents the most ambitious attempt anywhere in the world to create a structured framework for sharing and using health data at scale while protecting citizen rights.
The EHDS operates on two tracks. The first track covers primary use of health data, meaning the data that flows between you and your doctor, your hospital, and your pharmacist. The regulation establishes that EU citizens have the right to access their own electronic health records and the right to share them with healthcare providers across different EU member states. If a Latvian citizen has a medical emergency in Italy, Italian doctors should be able to access relevant medical history quickly and securely rather than starting from scratch.
The second and more transformative track covers secondary use of health data, meaning using anonymised or pseudonymised health data (data where identifying information has been removed or replaced with a code so that individuals cannot be directly identified) for research, policy-making, and the development of new treatments and medical technologies. Under the EHDS, researchers at a university in Heidelberg, a pharmaceutical company in Lyon, or a health AI startup in Tallinn can apply to access anonymised health data from across the EU for legitimate research purposes, subject to strict oversight and a clear prohibition on using the data for commercial purposes unrelated to health.
This is potentially transformative. The scale of European health data, covering hundreds of millions of patients across diverse populations with different genetic backgrounds, lifestyles, and disease patterns, is an extraordinary resource for medical research. Making it accessible under appropriate rules could accelerate the development of new treatments, improve understanding of how diseases spread and evolve, and enable the kind of large-scale studies that simply cannot be conducted on smaller datasets.
Three European Examples Leading the Way
Estonia’s Digital Health Infrastructure
Estonia is, as so often in discussions of European digital innovation, ahead of the curve. Estonian citizens have had access to their own unified digital health records since 2008, accessible through the same secure digital identity system that underpins the country’s entire digital state. Every prescription, every hospital visit, every diagnostic result is stored in a standardised digital format and accessible to authorised healthcare providers across the Estonian system.
Estonian health data has already been used in significant research projects. The Estonian Biobank, run by the University of Tartu, holds genomic and health data from over 200,000 Estonian volunteers, representing around 20% of the adult population. This is one of the highest rates of biobank participation relative to population size anywhere in the world, and it has made Estonia a disproportionately important contributor to European genomic research despite its small size.
The Estonian model is often cited in Brussels discussions about EHDS implementation as a proof of concept that large-scale health data infrastructure can be built in ways that maintain citizen trust and produce genuine research value.
Finland’s Findata System
Finland operates Findata, a health and social data permit authority that allows researchers to apply for access to combined datasets from Finnish health registries, social welfare records, and other public sources. The system acts as a trusted third party, handling data requests, assessing their legitimacy and ethical basis, and providing access to pseudonymised data in secure environments where researchers can work with the information without being able to download or remove it.
Findata represents a model for how EHDS secondary use mechanisms could work in practice across the EU. It demonstrates that it is possible to make valuable health data accessible to legitimate researchers at scale while maintaining robust controls against misuse. Several other EU member states and the European Commission’s own health data teams have studied the Finnish model closely as they design EHDS implementation frameworks.
Germany’s Electronic Patient Record Rollout
Germany has had a more complicated journey toward digital health records than its Nordic neighbours, partly due to the country’s strong data privacy culture and partly due to the federated nature of the German healthcare system, where responsibilities are divided between federal and state authorities. The electronic patient record (ePA) rollout, which began moving toward opt-out participation in 2025 (meaning patients are included by default unless they actively choose not to be), represents a significant shift in German health data policy.
The opt-out model is important because it dramatically increases participation rates compared to opt-in systems, which tend to attract self-selected populations that do not represent the full diversity of patients. Higher participation rates mean more representative data, which means better research and more reliable results. Germany’s decision to move toward opt-out participation, despite the political sensitivity of health data in a country with deep privacy instincts rooted in historical experience, signals how seriously Berlin is taking the potential of health data infrastructure.
Europe vs. the US: Two Different Models for Health Data
The contrast between European and American approaches to health data is significant and instructive.
In the United States, health data governance is fragmented across a complex system of federal rules including HIPAA (the Health Insurance Portability and Accountability Act, the primary federal law governing health data privacy), state-level regulations, and a large private healthcare sector that operates under commercial incentives to monetise patient data in ways that HIPAA permits but that would be prohibited under European frameworks.
American health data has been used in some impressive research contexts, and the scale of data held by large American health systems and insurers is enormous. But the commercial context creates conflicts of interest that the European model is specifically designed to avoid. In the US, your health data can be sold to pharmaceutical companies, used to target you with advertising, or shared with insurers in ways that could affect your premiums. The boundaries are complex, contested, and often unclear to patients.
The EHDS explicitly prohibits using health data accessed through its secondary use system for insurance decisions, marketing, or any commercial purpose unrelated to health research or treatment development. European patients contributing their anonymised data to research can do so with a clearer guarantee that the data will be used for health purposes rather than commercial ones.
This distinction may prove to be a genuine competitive advantage for European health research in the long run. If patients trust the system and participate at high rates, the datasets available to European researchers will be larger, more representative, and more legitimate than datasets assembled under commercial frameworks where trust is lower.
The Practical Challenge: Making It Actually Work
The EHDS framework is ambitious and the policy vision is genuinely compelling. The practical challenges of implementation are substantial and deserve honest acknowledgement.
Health data across EU member states is stored in wildly different formats, using different coding systems, different languages, and different technical standards that do not easily talk to each other. Building the interoperability layer that allows a French researcher to access and analyse Estonian health data in a meaningful way requires significant technical investment and sustained political commitment from every member state.
Data governance across 27 different national health systems with different legal traditions, different healthcare structures, and different public attitudes toward data sharing is extraordinarily complex. The EHDS sets the framework but the implementation must happen country by country, institution by institution, database by database. Latvia, Lithuania, and the smaller Baltic states face particular challenges around the scale of their health datasets, which are valuable for local research but may be less statistically powerful in isolation for the kind of large-scale European studies the EHDS envisions.
Health AI companies and pharmaceutical researchers operating in Europe also face a more demanding compliance environment than competitors in less regulated markets. The costs of meeting EHDS requirements, combined with GDPR obligations and the EU AI Act’s provisions on high-risk AI in healthcare, are real and add friction to product development cycles.
But the alternative, a fragmented, commercially dominated, low-trust health data ecosystem where patients are reluctant to share their information and researchers work with inadequate datasets, is worse for both science and patients in the long run.
The Future of Your Health Is Built on Data You Choose to Share
Personalised medicine is not a distant promise. It is already saving lives in oncology, rare disease treatment, and pharmacogenomics (the study of how individual genetic differences affect how people respond to medicines). The question for European patients and European policymakers is not whether health data will be central to the future of medicine. It will be. The question is whether that future will be built on a foundation of genuine trust, strong rights, and transparent governance, or on a foundation of commercial extraction and regulatory ambiguity.
Europe is making a clear bet on the former. The EHDS, combined with GDPR and the EU AI Act’s provisions on healthcare AI, creates the most comprehensive and citizen-protective health data ecosystem that has ever been attempted at scale. It will take years to implement fully and it will encounter serious obstacles along the way. But the direction is set and the potential is extraordinary.
💬 Here is the question worth sitting with: Would you be willing to share your anonymised health data with European medical researchers if you were guaranteed it would only be used for health research, never for insurance or commercial purposes, and you could withdraw consent at any time? And what would it take for you to fully trust that those guarantees were real? Tell us in the comments.
#PersonalisedMedicine #EUHealthData #EHDS #HealthTech #DigitalHealth
Leave a Reply