Article 15 does not apply to health data to the extent that disclosure would be likely to cause serious harm to the physical or mental health of the data subject or another individual. A controller that is not a health professional may neither withhold health data on that ground nor disclose health data in response to an access request unless it has obtained, within the preceding six months, the opinion of the appropriate health professional (the one currently or most recently responsible for the data subject's care, or another suitable professional) on whether the serious harm test is met, unless the data subject has already seen or knows the data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.