Please note that if you are processing special category data – which includes information about an individual’s health – it isn’t enough to just identify a lawful basis for processing. You also need to satisfy a separate condition for processing special category data. There are 10 of these in the GDPR itself, including where the processing is necessary for the purposes of medical diagnosis or healthcare.