Healthcare is increasingly built on technology. Patient care, clinical workflows and healthcare administration depend on SaaS platforms, cloud infrastructure, apps, connected devices, data analytics and increasingly AI.
That means legal questions rarely fit neatly into one practice area.
A new digital health service may simultaneously raise questions about patient data, AI, information security, cloud architecture, healthcare regulation, public procurement, intellectual property and contractual responsibility.
Sharp Cookie advises healthcare organisations and technology companies operating at this intersection.
We combine experience in digital health with technology transactions, data protection, AI, cloud services, information security, procurement and commercial contracting.
Our lawyers work with management, product and engineering teams, legal and privacy functions, information security specialists and commercial teams. We understand that the objective is not simply to identify regulatory requirements. Those requirements need to work with the technology, the healthcare environment and the commercial model.
A healthcare technology company’s needs rarely sort themselves into separate legal practice areas.
A SaaS product may need to satisfy GDPR and information security requirements while also being commercially acceptable to hospitals and other healthcare customers.
An AI feature may affect product design, transparency and governance while simultaneously changing the supplier’s contractual position and the customer’s risk assessment.
Moving patient data into a cloud environment can raise questions about access controls, processor arrangements and international transfers alongside technical architecture and customer contracts.
And a solution that works for an initial pilot may require a substantially more scalable legal and contractual model before it can be rolled out across multiple healthcare organisations.
We therefore look at the technology, data, regulatory requirements and commercial model together.
The objective is a position that the organisation can implement, healthcare customers can accept and the business can continue to operate as the technology develops.
Legal and regulatory issues are usually easier to address while a product or service can still be changed.
We work with technology companies during product development, launch, enterprise sales and expansion to identify issues before they become blockers in customer due diligence, procurement or contract negotiations.
Depending on the technology, this can include:
For an eHealth company, we have provided External DPO and privacy leadership through launch and scale-up, integrating data protection into telehealth, AI functionality, its app and clinical workflows as they were being developed rather than reviewing them only after launch.
The work combined ongoing privacy governance with practical support as the product, partnerships and customer requirements developed. The company subsequently expanded its business to a volume level comparable to that of the top 10 hospitals in Europe.
This is representative of how we prefer to work with digital health: legal and compliance decisions made close enough to the technology and business to help the organisation move forward.
For organisations preparing a product for launch, enterprise sales or expansion, our Technology Product Readiness Review provides a structured assessment of product, technology and material legal and commercial risks.
AI is increasingly part of digital healthcare rather than a separate technology category.
But the relevant legal question is rarely whether a product simply “uses AI”.
What matters is what the AI does, what information it uses, what output it generates and how that output affects patients, healthcare professionals and decisions.
Functionality that summarises information presents different risks from technology that identifies patterns, predicts outcomes, prioritises patients or supports professional decision-making.
We advise on issues including:
We have advised on the development and launch of AI-supported functionality directed both towards patients and healthcare professionals, including predictive functionality.
The work has included privacy and data protection, governance, risk assessment, transparency, product design and internal accountability.
This experience matters because AI governance in healthcare cannot be separated from how the functionality is intended to be used in practice.
For companies adding AI to an existing product, our AI Feature Launch Legal Review provides a focused review before launch.
Healthcare involves some of the most sensitive personal data an organisation can process.
But identifying information as “health data” is only the beginning of the analysis.
The practical questions concern where the data comes from, why it is processed, which organisation makes which decisions, how the technology uses it, who can access it and what happens to it over time.
We advise on:
Sharp Cookie Advisors also participated in legislative work relating to the GDPR.
Our approach to privacy in healthcare is therefore not limited to producing policies or DPAs. We help organisations translate data protection requirements into decisions about products, systems, processes and commercial relationships.
Modern digital healthcare increasingly depends on cloud infrastructure and SaaS.
That creates questions which are simultaneously technical, contractual and regulatory.
The legal model needs to reflect how the service actually works.
We have advised on multi-tenant SaaS environments involving patient data, including questions concerning tenant separation, access controls, auditability, processor arrangements, information security, international transfers and customer-facing contractual structures.
These details matter.
A contractual promise about separation, access, location or deletion of data is only useful if the underlying architecture can support it.
Conversely, understanding the architecture can make it possible to resolve a legal or customer requirement without unnecessarily redesigning the service.
This is one reason our technology work starts with the actual product and data flows rather than treating the contract or GDPR analysis in isolation.
Sharp Cookie Advisors acts as External Data Protection Officer for organisations that need independent privacy oversight combined with substantial technology and healthcare experience.
Our DPO work can include:
We take a systematic and risk-based approach, with governance and priorities adapted to the organisation’s privacy maturity, risk profile and management objectives. Our experience includes acting as DPO for start-ups, SMEs and international listed companies.
For digital health companies, technology understanding is particularly important. A DPO may need to understand the implications of a new app feature, an AI model, a clinical workflow, a cloud provider or a healthcare customer’s requirements – sometimes at the same time.
For our eHealth work, privacy governance has been integrated into product and business development rather than operated as a compliance gate at the end.
The underlying approach is deliberately practical: establish proportionate governance, identify when deeper assessment is required and allow routine product and business decisions to move at an appropriate pace.
As one eHealth CTO described our work:
“They combine GDPR and cybersecurity expertise with practical business sense.”
The client specifically linked Sharp Cookie Advisors’s External DPO support to the company’s successful expansion to a major European hospital.
Where we act as DPO, we maintain the independence required for the role and distinguish independent oversight from management decisions and other legal advisory work.
Healthcare organisations can be demanding technology buyers.
Hospitals, regions and other healthcare providers may impose extensive requirements concerning patient data, information security, auditability, business continuity, subcontractors, AI, service levels and regulatory compliance.
Those requirements quickly become commercial questions for the supplier:
We support SaaS, software, AI, cloud and other technology suppliers from preparation and customer due diligence through contract review, procurement and negotiation.
For the complete supplier-side service, see Selling Digital Services to Healthcare.
We also work on the other side of the table.
Healthcare organisations adopting new technology need contracts and procurement processes that address genuine regulatory and operational risks without unnecessarily obstructing innovation.
We advised a leading Swedish private healthcare provider on establishing its IT procurement process and developed new general terms for procurement of SaaS.
The work addressed GDPR and regulatory requirements associated with innovative uses of patient data.
That experience remains particularly relevant to our supplier-side work.
Understanding why a sophisticated healthcare customer asks a particular question makes it easier to distinguish between a requirement with a genuine regulatory or operational purpose and a standard contractual position that does not fit the service being purchased.
For many digital health companies, selling to healthcare also means selling to the public sector.
This adds another layer to the transaction.
Product, security, patient-data and contractual requirements may be fixed through the procurement process, potentially limiting the supplier’s ability to negotiate them later.
Problems therefore need to be identified early.
We help suppliers understand the interaction between:
The question is not merely whether a contractual provision would normally be negotiable. It is what can still be clarified, changed, priced or managed within the particular procurement procedure.
For more, see Selling SaaS and IT Services to the Public Sector.
Digital healthcare extends beyond SaaS.
Connected products can combine hardware, sensors, software, cloud infrastructure, AI and personal data in one service and one supply chain.
This creates legal issues that cannot sensibly be analysed as isolated questions about software, privacy or contracts.
Our technology compliance work has included a focused review for a global IoT manufacturer spanning a device, AI, sensors, SaaS and suppliers, including a medical-device context.
The compliance position was translated into commercial terms across a chain of transactions from subvendor to manufacturer and ultimately to a Swedish municipality customer.
The work established a baseline that could be reused for onboarding and expansion into additional markets.
This is the type of problem where technology compliance has commercial value: the objective is not merely to complete an analysis but to establish a position that can survive the next customer, supplier and market.
We have also advised manufacturers and suppliers of connected products and digital services used in elderly care.
These services can sit at the intersection of healthcare, social care, connected technology and privacy and may involve vulnerable users, sensitive information and several organisations participating in the delivery.
Our work has included external specialist advice, data protection and DPO support for product teams and management.
Again, the relevant legal structure needs to follow the real service: who provides what, who controls which data and technology, and how responsibilities are divided across the ecosystem.
A digital health product that is compliant but cannot get through enterprise contracting is not commercially ready.
Healthcare transactions can involve extensive negotiations around:
We help suppliers distinguish between requirements that reflect genuine healthcare constraints and contractual positions that create disproportionate or unnecessary risk.
Our lawyers can work behind the commercial or in-house legal team, take responsibility for the contractual workstream or participate directly in negotiations.
For a specific customer agreement, see SaaS & Technology Contract Review.
For complex ongoing negotiations, see SaaS & Technology Contract Negotiations.
Our healthcare work also includes matters where privacy and technology questions have moved from internal governance into regulatory scrutiny.
We have represented a healthcare provider in enforcement proceedings before the Swedish data protection supervisory authority.
More broadly, Sharp Cookie Advisors has acted as lead counsel in several enforcement matters involving Swedish and European data protection and cyber regulators, including matters concerning large-scale profiling, platform liability, compelled disclosure and DPO independence.
We have also defended a DPIA concerning critical infrastructure before the European Commission in connection with technology purchased for use across an EU organisation.
Enforcement experience influences how we approach advisory work.
It gives a different perspective on documentation, accountability and risk: if this decision were challenged later, could the organisation explain what it knew, how it assessed the risk and why it made the decision it did?
An initial healthcare pilot can often be handled through bespoke arrangements.
That becomes increasingly expensive as the company grows.
New customers may ask different questions about patient data. One hospital may require additional security commitments. A region may impose public-procurement terms. A new AI feature may change the risk assessment. A customer-specific DPA may conflict with the company’s standard cloud architecture.
Eventually the legal model itself needs to scale.
We help digital health companies distinguish between:
The objective is to avoid rebuilding the legal and compliance model for every new healthcare customer.
Our healthcare and digital health work spans the technology lifecycle.
Developing or preparing a product for market
Product readiness, privacy by design, data use, AI, regulatory boundaries and contracting architecture.
Introducing AI or new functionality
AI Feature Launch Review, GDPR and AI Act assessment, governance, human oversight, claims and customer documentation.
Selling technology to healthcare
Customer readiness, due diligence, SaaS and technology agreements, patient-data requirements and customer contracting.
Selling to regions and other public healthcare organisations
Public procurement, tender requirements, risk assessment and supplier-side contract strategy.
Negotiating an important customer agreement
Contract review, negotiation strategy, fallback positions and direct negotiation support.
Scaling privacy governance
External DPO, DPIA governance, audits, management reporting and systematic privacy work.
Responding to regulatory scrutiny
Investigations, enforcement, incidents, DPIAs and engagement with supervisory authorities.
The appropriate starting point depends on the product, organisation and commercial situation.
Our work includes:
Tell us what you are developing, buying, implementing or selling and where you are in the process.
For technology companies, it is useful to tell us:
For healthcare organisations, tell us about the technology, data or regulatory issue you are addressing and the decision the organisation needs to make.
We will identify an appropriate starting point and propose a proportionate way forward.
