This paper will investigate what is likely to happen when manufacturers would like to develop novel AI-based IoT in the medical sector and have them trained, tested or validated through the data already collected by other manufacturers of IoT. This secondary use of data is now feasible according to the rules provided by the recently adopted Data Act, but new avenues may also emerge in the framework of the proposed European Health Data Space. Against the basic qualification of IoT-generated data as health data, according to the GDPR definition, and the qualification of IoT as medical devices, pursuant to the MDR; the contribution will analyze what are the choices for manufacturers of new IoT devices or software to lawfully process health data. The comparison will highlight that different paths may emerge and depending on the manufacturer's objectives of novel IoT health-data sharing options may be more or less convenient.