Handles health records, in Serbia

Law on Personal Data Protection, arts. 16-19 (special categories of personal data and minors), Official Gazette RS No. 87/2018 · Read the law's page

• Do not process data revealing racial or ethnic origin, political opinion, religious or philosophical belief, or trade union membership, or process genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the person's explicit consent for one or more specified purposes.
• Where a minor is 15 years old or older, their own consent is enough to process personal data for an information-society service; below that age, get consent from the parent exercising parental responsibility or another legal representative, and take reasonable steps to verify it.
• Process data about a person's criminal convictions, offences, or related security measures only under the control of, or as specifically permitted by law for, a competent authority, and keep any unified register of criminal convictions solely under that authority's control.
• Where a competent authority processes special categories of personal data for law-enforcement or national-security purposes, apply Article 18's narrower list of exceptions instead of Article 17's, and only where necessary and accompanied by appropriate safeguards.