8(1)The processing is necessary for medical purposes and is undertaken by—
(a)a health professional, or
(b)a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.
(2)In this paragraph, “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.