What counts as secondary use of health data?

Secondary use means using health data for a purpose other than the one it was originally collected for, typically research, biobanking or, increasingly, training AI models. In Switzerland this engages both the Human Research Act (Art. 17 HFG) and data-protection law, and the permitted basis depends on consent and on whether the data are identifiable; the specific provisions are confirmed at engagement.

Is consent needed, and what is general consent?

Whether consent is required, and in what form, depends on how identifiable the data are and the intended use. Swiss research practice uses a 'general consent' model allowing defined future research use; the firm designs consent frameworks appropriate to the project and advises where anonymisation changes the analysis.

Can health data be used to train AI?

It can, but it sits at the intersection of the HFG, data-protection law and, where the output is a regulated product, medical-device and AI-Act rules. The firm structures the data-sharing and governance so the training use has a sound legal basis; for the product side see the EU AI Act service.

Does the HFG still apply once the data are anonymised?

No. The HFG does not apply to research with anonymised biological material or with anonymously collected or anonymised health data (Art. 2 HFG). The pivotal legal question is therefore whether the data are truly anonymised rather than merely pseudonymised, and data-protection law still governs the processing that precedes anonymisation. The firm assesses that boundary for the specific dataset, since it decides which regime, and which consent model, the project actually needs.

Service

Health-data & research-data law (HFG + DSG).

Using health data beyond the purpose it was collected for, whether for research, biobanks or AI training, engages both the Swiss Human Research Act (HFG) and the Data Protection Act (DSG). The firm advises on the legal basis for secondary use, consent and general-consent frameworks, anonymisation and pseudonymisation, and biobank and research-database governance.

Structure a health-data use

Who this is for

Hospitals, research institutions and biobanks governing secondary use of health data.
Companies sourcing health data for research or for AI training.
Sponsors structuring research-data sharing across institutions or borders.

What's included

Legal basis for secondary use: the further-use pathways for biological material and health-related personal data under the HFG (Arts. 32–34 HFG), including the exceptional route where consent and information requirements cannot be met (Art. 34 HFG).
Consent and general-consent frameworks: informed consent or the right to object to further use at the point of collection (Art. 17 HFG), and the design of general-consent models allowing defined future research use.
Anonymisation and pseudonymisation: the legal effect of de-identification, including that the HFG does not apply to research with anonymised biological material or anonymised health data (Art. 2 HFG), and where the DSG continues to govern.
Biobank and research-database governance: the governance, access and use rules for biobanks and research databases, under the HFG and the HFV.
Data-sharing arrangements: structuring data-sharing and data-use agreements across institutions and borders, including for AI-training uses, with the DSG overlay for health data as sensitive personal data.

How it works

Legal basis. The firm determines the basis for the intended secondary use under the HFG and DSG.
Consent design. The firm designs consent or general-consent frameworks fit for the use.
De-identification. The firm advises on anonymisation and pseudonymisation and their legal effect.
Governance. The firm sets up biobank and research-database governance.
Sharing. The firm structures the data-sharing arrangements, including for AI training.

Indicative pricing

Subscription + fixed-fee modules

from CHF 5,500 / month

Modules CHF 6,000 to 16,000.

Indicative starting prices, net and exclusive of Swiss MWST (VAT) where applicable; final fee per written engagement letter.

Frequently asked questions

What counts as secondary use of health data?: Secondary use means using health data for a purpose other than the one it was originally collected for, typically research, biobanking or, increasingly, training AI models. In Switzerland this engages both the Human Research Act (Art. 17 HFG) and data-protection law, and the permitted basis depends on consent and on whether the data are identifiable; the specific provisions are confirmed at engagement.
Is consent needed, and what is general consent?: Whether consent is required, and in what form, depends on how identifiable the data are and the intended use. Swiss research practice uses a 'general consent' model allowing defined future research use; the firm designs consent frameworks appropriate to the project and advises where anonymisation changes the analysis.
Can health data be used to train AI?: It can, but it sits at the intersection of the HFG, data-protection law and, where the output is a regulated product, medical-device and AI-Act rules. The firm structures the data-sharing and governance so the training use has a sound legal basis; for the product side see the EU AI Act service.
Does the HFG still apply once the data are anonymised?: No. The HFG does not apply to research with anonymised biological material or with anonymously collected or anonymised health data (Art. 2 HFG). The pivotal legal question is therefore whether the data are truly anonymised rather than merely pseudonymised, and data-protection law still governs the processing that precedes anonymisation. The firm assesses that boundary for the specific dataset, since it decides which regime, and which consent model, the project actually needs.

Last updated: 2026-07-08

Discuss a health-data mandate