2(1)This condition is met if the processing is necessary for health or social care purposes.
(2)In this paragraph “health or social care purposes” means the purposes of—
(a)preventive or occupational medicine,
(b)the assessment of the working capacity of an employee,
(c)medical diagnosis,
(d)the provision of health care or treatment,
(e)the provision of social care, or
(f)the management of health care systems or services or social care systems or services.
(3)See also the conditions and safeguards in Article 9(3) of the GDPR (obligations of secrecy) and section 11(1).