It may be challenging to find an appropriate legal basis for processing health data for development and innovation purposes. This article examines the most promising legal bases under the General Data Protection Regulation (GDPR) and the Estonian and Finnish national laws. Both Member States have supportive ecosystems for development and innovation activities leveraging health data, yet not all the options to promote development and innovation have been used in national laws. The article shows that in many cases it is possible to rely on the scientific research exemption for development and innovation activities with health data. In exceptional cases, reliance on other legal bases is possible. The article also examines the Commission proposal for the new European Health Data Space (EHDS) and its linkage with the GDPR's legal bases, concluding that the proposal does not comply with the GDPR legal basis requirements.