The General Data Protection Regulation (GDPR) 2018 requires Locala to process:

Sensitive personal data (Health Records) under 9(2)(h) – “Necessary for the reasons of preventative or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services” and occasionally 9(2)(c) “when it is necessary to protect the vital interests of a person who is physically or legally incapable of giving consent” 

Personal data under 6(1)(e) "Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the organisation (Data Controller)” and occasionally 6(1)(d)“ when it is necessary to protect the vital interests of a person who is physically or legally incapable of giving consent”