Shop data protection: handling health and genetic data the right way

Reviewed by Dr. Daniel Wallerstorfer, molecular biologist and founder of Novogenia · Updated: 15 October 2026 · Reading time: 10 min

In short

Genetic data and health data are special categories of personal data; processing them is prohibited in principle unless your customer gives explicit consent for specified purposes (Art. 9(1) and (2)(a) GDPR). Even order data can be health data if they allow conclusions about a person’s health (CJEU, C-21/23). So keep shop data such as orders and payments separate from questionnaires, analyses and reports, give service providers only what they need, and never use health information for advertising profiles. For customers in Switzerland, the Swiss Federal Act on Data Protection applies: genetic and health data are sensitive personal data, and any consent required must be explicit (Art. 5(c) and Art. 6(7) FADP).

Two drawers: what an order can reveal

A name, a delivery address, a product in the cart – sounds harmless. The Court of Justice of the EU saw it differently in 2024. A pharmacist sold pharmacy-only but non-prescription medicines through an online platform. The information customers had to enter when ordering – such as name, delivery address and details needed to individualize the medicines – is health data, the court ruled (judgment of October 4, 2024, C-21/23). In the same judgment, the court made clear that the GDPR does not preclude national rules allowing competitors to pursue data protection violations as unfair commercial practices in the civil courts. Data protection is a competition issue, too.

For a shop selling genetic analyses and personalized products, the picture is clear: imagine two drawers. One holds what every shop needs – order, address, payment, shipping. The other is locked: questionnaire, health information, genetic data, report. Good shops keep the two apart and open the second only when they really have to. Here is how. The basics for practitioners are in Genetic data and the GDPR, and the roles of brand and lab in Data protection for white-label genetic tests. This article is orientation, not legal advice for your specific case.

Which data your shop touches

The General Data Protection Regulation (GDPR) distinguishes two worlds. Genetic data are data on a person’s inherited or acquired genetic characteristics that give unique information about their physiology or health (Art. 4(13)). Data concerning health relate to physical or mental health and reveal information about a person’s health status (Art. 4(15)). Both are special categories whose processing is prohibited in principle (Art. 9(1)).

Drawer	Examples	What applies
Order and contract data	name, address, payment, order history, shipping status	processing to perform the contract (Art. 6(1)(b)); take care if the order itself allows conclusions about health
Questionnaire and health information	goals, complaints, blood values, lifestyle details	anything that reveals health status: explicit consent (Art. 9(2)(a))
Genetic data and report	analysis results, report in the portal	explicit consent; ideally not stored in the shop system
Marketing and tracking	cookies, newsletter, ad pixels	consent for non-essential cookies (Germany: Section 25 TDDDG; Austria: Section 165(3) TKG 2021); no health data in advertising profiles

Explicit consent: its own step in the checkout

For consumer genetic tests, explicit consent for one or more specified purposes is the central legal basis (Art. 9(2)(a) GDPR). For it to hold up, build it into the checkout as a step of its own – not as a clause buried in your terms:

Clear and specific: which data, for what purpose, who processes them – and whether you as a partner see the reports.
Active: A pre-ticked box is not consent (Recital 32).
Provable: You must be able to show that your customer consented (Art. 7(1)).
Revocable: Withdrawing consent must be as easy as giving it, and your customer is told so beforehand (Art. 7(3)).
On time: Consent belongs before the sample, not after it. How registration and consent work technically is something you set up with Novogenia.

Member states may introduce further conditions for genetic and health data (Art. 9(4)). Which ones apply in Germany, Austria and Switzerland is covered in Data protection for white-label genetic tests.

Keep shop data and genetic data apart

Data must be limited to what is necessary for the purpose (Art. 5(1)(c) GDPR), and by default only the data needed for each specific purpose may be processed (Art. 25(2)). In practice, this means for your shop:

The shop knows the order, not the result: Customer service and shipping need order status and shipping details. Genetic results and reports stay in the secure portal.
No questionnaire in the CRM: Health information does not belong in your newsletter tool, ticket system or spreadsheets half the team can open.
Access by role: Only people who need a piece of information for their task can see it.
No report as an email attachment: Protect reports with appropriate technical and organizational measures (Art. 32); a secure portal is built for that.
Choose your view deliberately: At Novogenia, you as a partner decide whether to see your customers’ reports. If you don’t need them, your second drawer stays empty – and your risk stays small.

Your service providers: processors under contract

An online shop rarely runs alone: shop software, payment provider, shipping service, email tool, customer-service chat. Anyone who processes data on your behalf must provide sufficient guarantees of appropriate technical and organizational measures (Art. 28(1) GDPR), and you sign a data processing agreement with each of them (Art. 28(3)). Check where your tools process data: transfers to countries outside the EU are only allowed under the conditions of Chapter V (Art. 44). And your privacy notice names the recipients or categories of recipients (Art. 13(1)(e)).

Which role you have in relation to Novogenia – controller, processor or joint controller (Art. 4(7) and (8), Art. 26) – depends on the model. Clarify it in writing before launch; the basics are in Data protection for white-label genetic tests.

Marketing without a health profile

Cookies and ad pixels require your visitors’ consent unless they are strictly necessary for the service the user has requested (Germany: Section 25 TDDDG; Austria: Section 165(3) TKG 2021). With genetic tests, a second limit applies: online platforms may not show ads based on profiling that uses special categories of personal data (Art. 26(3) of the Digital Services Act, Regulation (EU) 2022/2065).

That leads to a simple rule for your marketing: genetic results, questionnaire answers and health interests do not go into advertising profiles, retargeting lists or audience uploads – unless your customer has explicitly consented to exactly that. Promote your offer with what it shows, not with what you know about individual people. What you may say in advertising is covered in Marketing personalized products.

Impact assessment and data protection officer

Two obligations depend on scale. For large-scale processing of special categories of data, you carry out a data protection impact assessment in advance (Art. 35(3)(b) GDPR). If your company’s core activities consist of such processing, you need a data protection officer (Art. 37(1)(c)). Whether your shop qualifies also depends on how you set it up: the more firmly the second drawer stays shut, the fewer special-category data you process yourself. Have this assessed before you launch.

Switzerland: the FADP instead of the GDPR

For customers in Switzerland, the Federal Act on Data Protection (FADP, in German DSG) applies. You know its basic ideas from the GDPR, but the details differ:

Sensitive data: Data on health and genetic data are sensitive personal data (Art. 5(c)(2) and (3) FADP). Where consent is required, it must be explicit for these data (Art. 6(7)).
Information: At a minimum, you provide the controller’s identity and contact details, the purpose and, where applicable, the recipients; if data go abroad, also the country (Art. 19).
Impact assessment: Large-scale processing of sensitive personal data means high risk, so you carry out a data protection impact assessment in advance (Art. 22).
Representative in Switzerland: Private controllers based abroad designate a representative in Switzerland if they process data in connection with offering goods or services on a large scale and regularly, and the processing involves a high risk (Art. 14).
Cookies: Switzerland does not require prior consent, but information about the processing and its purpose and a notice that users can refuse (Art. 45c of the Telecommunications Act, FMG).

One difference comes before data protection: in Switzerland, you do not sell lifestyle genetic analyses as home tests (Art. 13 GUMG). What that means for your shop is covered in Selling genetic tests online: DE, AT, CH.

Checklist: data protection in your shop

You know which data your shop processes – and which of them are genetic or health data.
Explicit consent is a separate, active step before the sample, provable and easy to withdraw.
Shop data and genetic data are kept apart; reports stay in the secure portal.
Questionnaire answers do not end up in CRM, newsletter or ad tools.
Data processing agreements are in place with all service providers; transfers abroad have been checked.
The roles between you and Novogenia are set out in writing.
Cookie consent under Section 25 TDDDG or Section 165(3) TKG 2021; for Switzerland, information and an option to refuse under Art. 45c FMG.
Impact assessment and data protection officer have been checked – under the GDPR and, for Switzerland, the FADP.
Your privacy notice names the controllers, purposes, recipients and storage period.

Frequently asked questions

Are order data already health data?

They can be. In 2024, the Court of Justice of the EU ruled that the information customers enter when ordering pharmacy-only medicines online – such as name, delivery address and details needed to individualize the medicines – is health data, even without a prescription (C-21/23). In any case, treat questionnaire, analysis and report data as a special category under Art. 9 GDPR.

Is a checkbox in my terms enough for consent?

No. Consent to the processing of genetic or health data must be explicit and given for specified purposes (Art. 9(2)(a) GDPR). You must be able to prove it (Art. 7(1)), withdrawing it must be as easy as giving it (Art. 7(3)), and a pre-ticked box is not consent (Recital 32).

Can I target genetic-test customers with advertising?

Do not use genetic results, questionnaire answers or health interests for advertising profiles, retargeting or audience lists unless your customer has explicitly consented to exactly that. Online platforms are in any case not allowed to show ads based on profiling that uses special categories of personal data (Art. 26(3) of Regulation (EU) 2022/2065).

Do I need a data protection officer?

Under the GDPR, you do if your company’s core activities consist of processing special categories of data on a large scale (Art. 37(1)(c)). Large-scale processing of such data also requires a data protection impact assessment in advance (Art. 35(3)(b)). The less genetic data ends up in your shop, the smaller this question becomes – but have it checked anyway.

What applies to customers in Switzerland?

The Swiss Federal Act on Data Protection (FADP): genetic and health data are sensitive personal data (Art. 5(c)), any consent required must be explicit (Art. 6(7)), and you inform people about the controller, purpose, recipients and, where applicable, the country abroad (Art. 19). Private controllers abroad need a representative in Switzerland under certain conditions (Art. 14). For cookies, Art. 45c of the Telecommunications Act requires information and the option to refuse.

Personalized products for your shop?

Tell us about your brand and your channels – we will show you which model fits.

Request a project →Offer for e-commerce

Note: This guide is general information for businesses and professionals and does not replace medical or legal advice. The genetic traits determined in a genetic analysis are well documented (each gene included is backed by at least three independent studies); recommendations derived from them are logical conclusions, not scientifically proven. Regulations can change; errors and changes excepted.