Not not medical. > Details depend on implementation. Might be just a simple API/DB call or more. IIRC your DB data should be encrypted, RDS supports encryption

Not not medical. > Details depend on implementation. Might be just a simple API/DB call or more. IIRC your DB data should be encrypted, RDS supports encryption at rest out of the box. Make sense, but it's more the scaling of this concept that worries me (when you start to have multiple services and DBs). It's easy to forget one API call. > If, by retrieving them, a user can be identified then yes. Can you use an UUID and control the info on the AWS side? Points will be linked to a user via a UUID yes, but (for example) is the temperature of the room at time X considered personal data? I like this idea. Downside is that if you want to view the data to debug a problem in production, it's harder.