Is It Safe to Share Your Health Data for Research?

This guide quotes the law and the research directly: the EU's General Data Protection Regulation, the US HIPAA Privacy Rule's de-identification standard, and a peer-reviewed study of re-identification. It is general information, not legal advice. Read on 6 November 2026.

Sharing your health data can help research learn what actually works for people with your condition, and it can be paid. It also carries a real risk: health information is among the most sensitive data there is, and a careless service can expose it. Both things are true, so the useful question is not "is it safe?" in general, but "what exactly is shared, with whom, and what protects me?".

This guide explains what the law requires, what de-identification removes and what it cannot, how real the risk of being re-identified is, and the questions worth asking any service before you share, including us.

Health data has the strongest legal protection there is

In the EU, health data is a "special category". Article 9 of the General Data Protection Regulation starts from a ban: processing "data concerning health" and "genetic data" "shall be prohibited". It is only allowed under specific conditions, the first of which is that "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes". Explicit means you said yes to that use, not that you failed to say no.

In the US, the HIPAA Privacy Rule protects health information held by doctors, hospitals, labs and insurers. It does not cover everything: it applies to health plans, healthcare clearinghouses and healthcare providers (its "covered entities"), so a health app or a consumer genetics company that is none of those can fall outside it. Before sharing with one, read its own terms.

What de-identification removes

Research rarely needs to know who you are. It needs what happened: the condition, when it started, what was tried, what worked. De-identification is the process of keeping the second and removing the first.

The clearest legal definition is the HIPAA "safe harbor" standard in 45 CFR 164.514. Information counts as de-identified when 18 kinds of identifiers are removed, including:

• Names.
• "All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code" (with a narrow exception for the first three digits of large zip code areas).
• "All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death", and ages over 89.
• Phone numbers, email addresses, social security, medical record and health plan numbers, account numbers, device identifiers, web addresses, IP addresses, biometric identifiers, and "full face photographic images".

And the organisation must not "have actual knowledge that the information could be used alone or in combination with other information to identify an individual". The underlying principle, in the rule's own words: information is not identifiable when "there is no reasonable basis to believe that the information can be used to identify an individual".

European law draws the same line differently. The GDPR does not apply to truly anonymous information, which it describes as data "rendered anonymous in such a manner that the data subject is not or no longer identifiable". But data that has only been pseudonymised, with names swapped for codes, still counts as personal data: in the regulation's words, it "should be considered to be information on an identifiable natural person". In Europe, that means removing your name is not enough to take data outside the law.

What de-identification cannot promise

Removing identifiers lowers the risk; it does not remove it. A 2019 study in Nature Communications modelled how many people could be singled out by combining ordinary facts about them, and found that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes. The more detail a record carries about a person's life, the easier it is to match.

That has two practical consequences. First, what a dataset contains matters as much as what it removes: a record with age range, sex and country is very different from one with exact birth date, zip code and job title. Second, technical protection needs legal protection beside it. A good research licence forbids any attempt to re-identify people and name the use the data may be put to, so that a buyer who tried would be in breach of contract as well as of the law.

The risk people do not think about: what happens when the company changes hands

One risk people rarely consider is what happens to their data when the company holding it changes hands. When 23andMe went bankrupt, its customers' genetic data was part of what was for sale: a federal bankruptcy court approved the sale of the company to TTAM Research Institute on a $305 million bid, after a bidding war with Regeneron. The same report notes that nearly 2 million of its 15 million customers had deleted their accounts by then.

Most privacy policies, ours included, allow personal information to move with a business if it is sold or merged; that is how company law works. What protects you in that case is what kind of data is held and on what terms: whether the research data is de-identified, whether your consent is for named uses rather than everything, and whether you can withdraw and have your data deleted at any time.

Questions to ask any service before you share

Whether it is a research study, an app or a data marketplace, these questions tell you most of what you need to know:

1. What exactly leaves your hands? A de-identified summary, or your full records with your name on them?
2. What is removed? Names, places smaller than a region, exact dates, contact details and record numbers should be the minimum.
3. Who receives it, and under what terms? A licence for a named use that forbids re-identification, or a sale with no strings?
4. Do you consent per use? Or does one tick-box cover everything forever?
5. Can you withdraw? And does withdrawing keep your data out of future use?
6. Do you see what is shared? Can you read the record before it goes anywhere?
7. Are you paid, and how is it decided? If your data is valuable enough to sell, the price should be open.

How CureCircle answers them

We built CureCircle around those questions, so here are our own answers, plainly:

• What is shared is a de-identified research record of your story: the condition, how it started, what was tried and how well it worked in your own ratings, and the records you choose to add. The AI writes it with no names of people, doctors, clinics or hospitals, no place finer than a country, no exact dates (a month and year, or "3 months after onset"), and no employer, school or other detail that could identify you. Your age is kept as a range.
• Documents you upload are read, not kept. The AI reads a lab report or a letter into your medical file, and the file itself is discarded.
• You read the record first. Before anything is submitted, you see the summary a research partner would receive, check your ratings and consent to research use for that story.
• Licensed, not sold. Research partners license datasets for a named use, under terms that forbid re-identification.
• You can withdraw a story at any time, and it is left out of every future dataset.
• You are paid, a share each time a licence includes your story, and how we value health data is public, figure by figure.

Sharing your health data is a choice, and it should be an informed one. If a service cannot answer the questions above, that is your answer. If it can, your experience can help research learn what works for the next person with your condition. Read what your data is worth, or start with your story.