I'm wondering how this works in accordance to gdpr, whichh has explicit guidelines for how to process healthcare related data. This seems conflicting in different ways.