Editing PHKG Business Opportunities (section)

=== Privacy — Near-Blocking Constraint in EU ===

The wiki earlier noted "employee privacy concerns" briefly. In the EU/Norway, this is a near-blocking constraint, not a soft concern:

* Health data is GDPR Article 9 special category data — requires explicit consent or specific legal basis.
* '''Employer-employee consent is presumptively invalid under GDPR''' because of power imbalance (EDPB Opinion 2/2017). You can't get free consent from an employee for their employer-funded health program.
* Norwegian Datatilsynet has been particularly active on employer data processing.
* Even with "employee sees own data, employer sees aggregates" model, the processor (Stamen) handles Article 9 data on behalf of an employer that arguably can't lawfully be the controller.
* '''Required architecture:''' Employee-as-controller, employer-as-payer, with no employer access even to aggregates of identifiable subgroups. Harder to sell than the wiki implies.