Shenzhen Residents' Health White Paper Released: Key Points on Personal Information Protection and Medical Compliance Behind Health Points and Dual Prescription Services
Lead
On August 22, 2026, the fifth "Shenzhen Residents' Health White Paper (2025 Annual Edition)" was released at the Shenzhen Health Activity Month event. Data shows that Shenzhen residents' health literacy rate reached 52.13%, physical fitness compliance rate reached 92.5%, nearly half of residents exercise regularly, and the health insurance coverage rate ranks first among first-tier cities. Meanwhile, Shenzhen launched a resident health points system and community health center "dual prescription" services to encourage citizens to participate in health management. However, behind the rapid advancement of digital health, what legal risks are involved in the collection, use, and redemption of health data? How can Shenzhen citizens protect their rights while enjoying convenience? This article, from a lawyer's perspective and in conjunction with the Personal Information Protection Law, the Civil Code, the Basic Healthcare and Health Promotion Law, and other regulations, analyzes the key legal points in health points and dual prescription services, providing compliance guidance for citizens and enterprises.
Health Points System: Legal Boundaries of Personal Information Protection
Over a month since its launch, Shenzhen's resident health points system has attracted 32,200 users, with a cumulative 192,000 check-ins and a points pool reaching 9.16 million. Residents earn points by signing up with family doctors, donating blood, walking 6,000 steps a day, and managing sleep, which can be redeemed for 55 benefits including marathon slots, free parking, and discounted health checkups. This innovative model encourages healthy behaviors, but it involves the collection and processing of large amounts of personal health data.
According to Article 28 of the Personal Information Protection Law, health information constitutes sensitive personal information, and processing such information must have specific purposes and sufficient necessity, and obtain the individual's separate consent. The Shenzhen Health Points Platform emphasizes the "minimum necessary" data principle and end-to-end encryption protection, which complies with legal requirements. However, in actual practice, citizens need to pay attention to the scope of authorization. For example, step count data may be automatically uploaded by mobile applications—has the purpose been clearly communicated? When signing up with a contracted family doctor, has consent been given for data sharing with third-party redemption platforms?
Lawyers advise that when registering and checking in, citizens should carefully read the privacy policy to confirm whether the scope of data collection is limited to what is necessary for points calculation. If the platform uses data beyond the authorized scope, such as for commercial promotion or provision to third parties, citizens have the right to withdraw consent in accordance with Article 15 of the Personal Information Protection Law and request deletion of their information under Article 69. As Shenzhen is a demonstration zone for rule-of-law advancement, regulators impose relatively severe penalties for violations involving health data. Enterprises should establish compliance systems to avoid administrative penalties or civil claims arising from data misuse.
Legal Nature of Points Redemption: Contractual Relationship and Consumer Rights
Health points redemption benefits may appear simple, but in fact constitute a civil contract relationship. Citizens earn points by completing health tasks, and the platform provides redemption services in accordance with the rules, with both parties forming contractual rights and obligations. Pursuant to Article 464 of the Civil Code, a contract legally formed is legally binding on the parties concerned. If the platform unilaterally adjusts the points rules or redemption conditions, it may constitute breach of contract.
For example, benefits such as marathon entry quotas and free parking at children's hospitals constitute consideration promised by the platform. If the platform is unable to fulfill these due to limited quotas or technical reasons, citizens may claim compensation under Article 53 of the Consumer Rights Protection Law. However, lawyers remind that points redemption typically constitutes a conditional gift or reward, and platforms may include disclaimer clauses in their rules. Citizens should retain screenshots or agreements before redemption, clearly specifying the redemption conditions and restrictions, to avoid difficulties in providing evidence in the event of a dispute.
Additionally, points redemption involves third-party service providers (such as hospitals and event organizers). If services cannot be fulfilled due to reasons attributable to a third party, citizens must clarify the responsible party. Under Article 593 of the Civil Code, a party that breaches a contract due to a third party's actions is still liable to the other party for breach of contract. As the contractual counterparty, the platform cannot evade responsibility by citing third-party causes. Lawyers advise that platforms should improve user agreements to clearly define the allocation of responsibilities, while citizens, when encountering issues, should collect evidence and protect their rights in accordance with the law.
Community Health Dual Prescription: Medical Risks and Legal Safeguards
The "dual prescription" service at community health centers is another innovation in Shenzhen's health management. Currently, 49 community health centers across the city can issue nutritional dietary prescriptions and exercise prescriptions. Community health center physicians first conduct a comprehensive assessment, then provide a 21-day measured diet plan and a customized exercise program. This service enhances personalized health management, but it touches upon the legal boundaries of medical practice.
According to Article 16 of the Basic Healthcare and Health Promotion Law, medical and healthcare personnel shall comply with medical ethics and protect patients' right to informed consent. Dual prescriptions constitute a health intervention measure, and physicians must ensure accurate assessment and that the prescription is suitable for the individual's condition. If citizens' health is harmed due to assessment errors or inappropriate prescriptions, liability for medical damages may arise. Pursuant to Article 1,218 of the Civil Code, where a medical institution or its medical personnel is at fault, the medical institution shall bear compensatory liability.
Lawyer's note: When issuing dual prescriptions, community health center doctors should inquire in detail about the patient's past medical history and allergy history, and provide written notification of risks. When receiving prescriptions, citizens should truthfully provide health information; if harm results from concealed information, the medical provider's liability may be reduced. Furthermore, although dual prescriptions are not traditional medical acts, if they involve disease treatment—such as developing an exercise plan for a hypertension patient—the applicable diagnosis and treatment standards must still be followed. It is recommended that community health institutions establish risk response plans, conduct focused assessments for special populations (such as pregnant women and patients with chronic diseases), and retain assessment records for evidentiary purposes in the event of disputes.
Health Data Sharing: Corporate Compliance and Citizen Rights Protection
The Shenzhen Health White Paper shows that the city has 6,011 medical and health institutions, and its medical insurance participation rate ranks first among first-tier cities. The health points and dual prescription systems involve data sharing among multiple parties, including hospitals, community health centers, app platforms, and welfare providers, which increases data security risks. According to Article 27 of the Data Security Law, data processors shall establish data security management systems and adopt measures such as encryption and desensitization.
When enterprises participate in health projects, attention should be paid to the following: first, data collection must follow the principle of minimum necessity to avoid excessive collection; second, data sharing requires explicit user consent and the signing of a data processing agreement; third, in the event of a data breach, the regulatory authorities and users should be notified in a timely manner in accordance with Article 57 of the Personal Information Protection Law. If citizens discover that their health data has been misused, they may file a complaint with the cyberspace administration department, or request deletion or correction in accordance with Article 1037 of the Civil Code.
Lawyers suggest that Shenzhen may refer to the "Shenzhen Special Economic Zone Data Regulations" to further refine health data protection rules. Enterprises should conduct regular compliance audits and retain legal counsel to assess risks. Citizens should enhance their data protection awareness, regularly review app authorizations, and avoid using unofficial channels to participate in points activities. Those who suffer losses due to data breaches may claim compensation in accordance with the law, and law firms can provide professional support.
Conclusion: Healthy Cities Require Legal Safeguards
The Shenzhen Resident Health White Paper demonstrates the achievements of healthy city construction, but as emerging initiatives, health points and dual prescription services carry legal risks that cannot be ignored. Guangdong Zhiming Law Firm, with deep expertise in the field of health data compliance, can provide enterprises with privacy policy review and data security assessment services, and offer citizens rights protection consultation. A healthy Shenzhen requires both technological innovation and legal safeguards to achieve steady and long-term progress.
