HDS hosting in France: what a health app must get right before launch

If your product stores personal health data on behalf of French clinicians, care facilities or patients, it must run on an HDS-certified host (HDS stands for hébergeur de données de santé, health data host). At the latest from 26 September 2026, that data must also be stored inside the EU or the European Economic Area, and any remote access from elsewhere is treated as a transfer. The hard part is not picking a cloud with an HDS badge. It is proving that certificates cover your entire hosting chain, including what your own team or your development partner does in production.

This guide is written for founders and product leaders, often outside France, who are launching a health product in the French market: patient follow-up, scheduling for clinicians, remote care, software for care networks, SaaS for healthcare professionals. It reflects the official texts as of 7 November 2026. It is not legal advice: French counsel should review any case where your scope is unclear.

The texts that actually apply

Most English-language content on HDS predates the 2026 changes. Go to the sources:

• Article L1111-8 of the French Public Health Code, in force since 1 July 2025, which creates the obligation;
• Articles R1111-9 to R1111-11, which define the six hosting activities and the mandatory contract clauses, as amended by Decree 2026-209 of 24 March 2026;
• the certification page of the French digital health agency (ANS) and its list of certified hosts.

The official texts are in French. If a vendor, consultant or blog post contradicts Légifrance, Légifrance wins.

Are you in scope? Three questions

Article L1111-8 applies to anyone hosting personal health data collected during prevention, diagnosis, care, or social and medico-social follow-up, on behalf of the people who produced or collected that data, or on behalf of the patient. That gives three tests.

1. Is it health data? The French data protection authority (CNIL) reads the GDPR broadly: data that is medical by nature (history, treatments, test results), data that reveals health once combined with other data (weight combined with activity levels), and data used for a medical purpose.

2. Was it collected in a care or prevention context? This is what triggers HDS. A clinician's notes, a nurse's patient follow-up, a remote consultation: yes. A consumer running app with no healthcare professional involved: usually no, even though the GDPR still treats much of its data as sensitive.

3. Are you hosting it for someone else? A clinic keeping records on its own server, on its own premises, is not hosting for a third party. A vendor storing its clinician customers' patient files in a SaaS product is.

Note that the rule follows the activity, not your incorporation. A US, UK or Canadian company serving French clinics is in the same position as a French one.

The six activities: why "our cloud is HDS-certified" is not an answer

Article R1111-9 splits hosting into six activities. A provider is certified for some of them, not necessarily all.

A physical infrastructure certificate covers activity 1; a managed hosting certificate (hébergeur infogéreur) covers the others. A hyperscaler certified for activities 1 to 4 does not, by default, cover the administration of your application or a backup service you added yourself.

Activity 5 is the grey zone. The ANS has published guidance on it (webinar), because the line between administering an information system and maintaining an application is debated. Use a method rather than a rule of thumb:

1. list everyone who touches production: cloud, your engineers, your managed service provider, your development partner, your backup tool;
2. write down which activities each one actually performs;
3. check certificates and the ANS list to confirm every activity is covered by a certified party;
4. have French counsel or the certification body confirm the map.

According to the ANS, a certificate is issued for three years by an accredited certification body, with a surveillance audit every year. Ask for the current certificate and its scope, not a marketing page.

What the March 2026 decree changed

Decree 2026-209 implements France's May 2024 law on securing the digital space. It entered into force the day after publication, except two points of its Article 1 that apply six months later, on 26 September 2026: check Légifrance for the date attached to each obligation. Three changes matter to any vendor, and even more to a non-European one.

• EU or EEA storage. New Article R1111-9-1 requires storage of hosted health data exclusively in an EU member state or an EEA country.
• Remote access is a transfer. Any transfer outside that area, including remote access by a support or engineering team, requires a European Commission adequacy decision or, failing that, appropriate GDPR safeguards. The contract must say so and describe the safeguards.
• Disclosure of foreign laws. If the host or a subcontractor is subject to a non-EU law that could force a transfer or unauthorised access, the contract must list those laws, the mitigation measures and the residual risks. The host must also publish and maintain a map of transfers and access risks.

The decree does not ban non-European providers. It forces the risk into writing, and French hospitals and public buyers now read that section closely. For a broader view of hosting options, including sovereign cloud qualifications, see our guide to hosting a business application in Europe.

The hosting contract: the mandatory clauses

Article R1111-11 lists what the contract between the host and its customer must contain, at minimum. The ones a founder should read personally:

• the scope of the host's certificate and its dates;
• the hosting locations;
• service levels, how they are measured and any penalties;
• use of external technical subcontractors;
• a ban on using the data for anything other than hosting;
• exit terms: return of all data, destruction without copies, and what happens if the host loses its certification;
• since September 2026, transfers outside the EU and EEA and the foreign laws that apply.

If you are a vendor relying on a certified host, paragraph II of the same article requires your contract with your own customers to repeat those clauses. Your terms of service must reflect what your host guarantees. Our articles on SaaS agreement clauses and on planning your exit from a software vendor cover the surrounding terms.

What HDS does not cover

The certificate applies to the host, not to your product. You still own:

• GDPR compliance: lawful basis, patient information, records of processing, retention periods, data subject rights. Health data is a special category, and a data protection impact assessment is often mandatory. Our GDPR checklist for business applications is a starting point;
• application security: role-based access, access logs, encryption, penetration testing. A certified host cannot stop your app from showing one patient's file to another. See our security essentials for business applications;
• forgotten copies: application logs, error tracking, email delivery, customer support tools, staging environments seeded with real data. Each copy lives somewhere, and that somewhere is part of the chain.

Mistakes we see in foreign health-tech launches

• Assuming the hyperscaler certificate covers everything. Activities 5 and 6 are often performed by the vendor itself.
• Piping patient data into US-hosted tools. Support desks, analytics, error trackers and email services that receive record contents become part of the hosting chain, and now part of the transfer rules.
• Global on-call rotations. An engineer outside Europe who can read production data is remote access, and therefore a transfer.
• Testing with production data. A staging copy of real records needs the same protection as production, or use synthetic data.
• Treating HIPAA as equivalent. HIPAA controls help, but HIPAA has no official certification and no EU storage requirement. HDS needs its own evidence.
• Deciding late. Moving a live product into a certified, EU-only chain costs more than designing for it from day one.

What drives the budget

We do not publish price ranges: certified hosting offers vary too much by architecture, and no official benchmark exists. What actually moves the cost:

• how managed your stack is: a certified managed database costs more than a virtual machine, but may keep you from performing a certifiable activity yourself;
• who runs production, and with what on-call coverage;
• backups and archiving, now explicitly in scope;
• the rest of the chain: support, email and monitoring tools that can stay in the EU.

Ask at least two certified hosts to quote the same architecture and service level, and budget the compliance work on your side, not just the hosting bill.

Build, or buy something already certified?

If an existing health software product, already hosted by a certified provider, covers your need, it spares you from carrying the hosting chain yourself. That is often the right call for a single clinic or care facility. Custom development makes sense when your care pathway, your organisation or your service model does not fit those products, or when you are the vendor of a health service yourself.

In that case, settle the hosting questions before writing code: which data, on whose behalf, which host, who runs production, which copies. A prototype lets you validate the workflow with synthetic data, without hosting anything real. That is how our free prototype, shown before you commit, works: you see the product before deciding where, and with whom, it will run.