What counts as secondary use of health data?

Secondary use means using health data for a purpose other than the one it was originally collected for, typically research, biobanking or, increasingly, training AI models. In Switzerland this engages both human-research law (Art. 17 HFG) and data-protection law (DSG), and the permitted basis depends on consent and on whether the data are identifiable.

Is consent needed, and what is general consent?

Whether consent is required, and in what form, depends on how identifiable the data are and the intended use. Swiss research practice uses a “general consent” model allowing defined future research use; GAWEL Legal designs consent frameworks appropriate to the project and advises where anonymization changes the analysis.

Can health data be used to train AI?

It can, subject to the HFG, data-protection law and, where the output is a regulated product, medical-device and AI Act rules. GAWEL Legal structures the data-sharing and governance so the training use has a sound legal basis; for the product side see the EU AI Act service.

Does the HFG still apply once the data are anonymized?

No. The HFG does not apply to research with anonymized biological material or with anonymously collected or anonymized health data (Art. 2 HFG). The legal question is therefore whether the data are truly anonymized rather than merely pseudonymized, and data-protection law still governs the processing that precedes anonymization. GAWEL Legal assesses that boundary for the specific dataset, since it decides which regime, and which consent model, the project actually needs.

Health and research data

GAWEL Legal advises hospitals, biobanks and health-tech companies on the secondary use of health data under the HFG and DSG, on a retainer. The retainer covers the legal basis for secondary use, consent and general-consent frameworks, anonymization and pseudonymization, and the governance of biobanks and research databases, including data sourced for AI training.

Discuss a health-data project View scope

Planning a secondary use of data

Proposed use: Research, biobanking or AI training
Legal basis: Consent and de-identification
Arrangements: Governance and data sharing

Advice under the HFG and DSG, based on the intended use

Who this is for

Hospitals, research institutions and biobanks governing secondary use of health data
Companies sourcing health data for research or for AI training
Sponsors structuring research-data sharing across institutions or borders

Scope

Legal basis for secondary use:
the further-use pathways for biological material and health-related personal data under the HFG (Art. 32–34 HFG), including the exceptional route where consent and information requirements cannot be met (Art. 34 HFG)
Consent and general-consent frameworks:
informed consent or the right to object to further use at the point of collection (Art. 17 HFG), and the design of general-consent models allowing defined future research use
Anonymization and pseudonymization:
the legal effect of de-identification, including that the HFG does not apply to research with anonymized biological material or anonymized health data (Art. 2 HFG), and where the DSG continues to govern
Biobank and research-database governance:
the governance, access and use rules for biobanks and research databases, under the HFG and the HFV
Data-sharing arrangements:
structuring data-sharing and data-use agreements across institutions and borders, including for AI-training uses, with the DSG overlay for health data as sensitive personal data and, for data from the EU, the GDPR and the EHDS rules on secondary use, which apply from 26 March 2029

How the work proceeds

Legal basis The review determines the basis for the intended secondary use under the HFG and DSG.
Consent design Consent or general-consent frameworks are designed for the intended use.
De-identification Advice covers anonymization and pseudonymization and their legal effect.
Governance The work establishes governance for the biobank or research database.
Sharing Data-sharing arrangements are structured for the intended use, including AI training.

Fees

Retainer + fixed-fee modules

Fixed-fee modules for agreed tasks

Questions

What counts as secondary use of health data?: Secondary use means using health data for a purpose other than the one it was originally collected for, typically research, biobanking or, increasingly, training AI models. In Switzerland this engages both human-research law (Art. 17 HFG) and data-protection law (DSG), and the permitted basis depends on consent and on whether the data are identifiable.
Is consent needed, and what is general consent?: Whether consent is required, and in what form, depends on how identifiable the data are and the intended use. Swiss research practice uses a “general consent” model allowing defined future research use; GAWEL Legal designs consent frameworks appropriate to the project and advises where anonymization changes the analysis.
Can health data be used to train AI?: It can, subject to the HFG, data-protection law and, where the output is a regulated product, medical-device and AI Act rules. GAWEL Legal structures the data-sharing and governance so the training use has a sound legal basis; for the product side see the EU AI Act service.
Does the HFG still apply once the data are anonymized?: No. The HFG does not apply to research with anonymized biological material or with anonymously collected or anonymized health data (Art. 2 HFG). The legal question is therefore whether the data are truly anonymized rather than merely pseudonymized, and data-protection law still governs the processing that precedes anonymization. GAWEL Legal assesses that boundary for the specific dataset, since it decides which regime, and which consent model, the project actually needs.

Discuss your matter

Briefly describe the matter and the legal advice you need.

Discuss a health-data mandate