Germany's national digital identity wallet has a launch date and a growing list of things it is supposed to do. What it does not yet have are settled answers to some basic questions about how it will handle health data.
The wallet, developed under the federal agency SPRIND and operated by Common Codes, will be called "d-you" and is scheduled to open on 2 January 2027. Its project lead, Torsten Lodderstedt, told the TI-Summit 2026 conference that around 50 launch partners are lined up and that more than 300 use cases are already being trialled in a sandbox. Users will set up a digital ID from the online ID function of their national identity card, with a forgotten PIN recoverable through the existing reset service. Keys are released from a cloud security anchor using the phone and the PIN as two factors; the operator, Lodderstedt said, learns neither the person's identity nor the purpose of the presentation.
Health is where that abstraction meets reality. Christian Dransfeld of Gematik, which runs Germany's health IT infrastructure, described two integration stages: first, insured people will be able to use the wallet to set up their GesundheitsID or identify themselves to their health insurer — some insurers want to offer this early in 2027, the rest later in the year. Next, an insurance credential is to become a standalone credential in the wallet, defined in a Gematik rulebook. The Federal Ministry of Health calls the initial combination of wallet and GesundheitsID a "transitional architecture": from 2027, insured people should reach their ePA and e-prescription information that way, with direct wallet access as the medium-term goal.
Two draft laws sketch the destination. Under the health data and digital innovation bill (GeDIG), from 1 December 2028 the wallet plus electronic credentials should serve as proof of insurance in the same way as the electronic health card, and from 1 December 2030 at the latest, for authentication as well. Neither rule is in force; the GeDIG is still moving through the legislature.
Uncertainty starts well before then. Gematik's specification for sectoral identity providers requires support for a PID from a certified EUDI wallet — and Lodderstedt conceded that a wallet not meeting all eIDAS requirements cannot be recognised as an EUDI wallet, which he called a big problem. The federal digital ministry could not give the Bundestag hearing a date for when d-you would be certified and notified to the European Commission. At that same hearing, experts criticised the cloud security anchor and the development process, and asked who would review whether the data a service requests is actually necessary for its purpose — a question a technical filter that rejects over-asking does not answer. Device support is another open thread: many insurers dropped ePA apps on Android 13 and older in July 2026, and it is unresolved whether the same operating-system rules would apply to wallet access to the same data.
For now, the wallet's most consequential health feature is the one still being negotiated rather than shipped.
