Certified cloud for hosting health data in Europe

What is an HDS-certified health data host?

Across the European Economic Area, personal health data is a special category of data under the GDPR. France adds a requirement of its own: anyone hosting such data on behalf of a third party must be certified, under article L.1111-8 of the French Public Health Code. The certificate of compliance is issued by a certification body accredited by COFRAC or by the national accreditation body of another European Union member state, is valid for three years, and is subject to an annual surveillance audit. The HDS framework covers six activities, from providing the physical hosting sites to external backup, and requires health data to be stored within the European Economic Area. Its certification requirements are published in English by France’s Digital Health Agency. Clever Cloud holds an HDS certificate under the v2.1 framework, across the six activities.

A commitment to European digital sovereignty

At Clever Cloud, digital sovereignty translates into concrete commitments:

• Health data hosted in France, on our HDS-certified regions, with no exposure to extraterritorial laws such as the Cloud Act or FISA;
• A French company, with French capital, operating an infrastructure it controls;
• Strict compliance with the GDPR and applicable regulations;
• Taking a stand on societal issues that threaten our autonomy as a company and as citizens (challenging the hosting of the Health Data Hub before the Conseil d’État, support for the Open Internet Project, and more);
• Developing and promoting tools and practices that strengthen the security of our customers’ data.

The way we approach the sovereign cloud and European strategic autonomy is set out in more detail on our dedicated page.

A specific contract for hosting health data

To benefit from certified hosting for health data, a specific contract is required. Setting it up starts with an initial conversation. Contact us through the form below and an Account Manager will get back to you within 48 business hours.

The scope of our certification, the list of covered services and the representation of guarantees (actors involved in processing the data) are available on our security page.

FAQ – Health data hosting

What is HDS health data hosting?

HDS health data hosting concerns the hosting of personal health data collected during prevention, diagnosis, care, or social and medico-social follow-up activities. It can be carried out on behalf of a data controller or on behalf of the patient. For digital media, the host must hold an HDS certificate of compliance. This certification aims to frame the hosting of such data under security conditions suited to its sensitivity.

Who must use an HDS-certified health data host?

Any data controller who entrusts the hosting of personal health data to a third party must ensure that this third party holds an HDS certificate of compliance. This can involve healthcare institutions, health software vendors, laboratories, mutual insurers, insurers or digital service providers when their service falls within the scope of HDS hosting. The analysis must be done case by case, depending on the data processed, the role of each actor and the outsourced services.

We are a health organisation based outside France. Can we use Clever Cloud’s HDS hosting?

Yes. As a data controller, you do not need to be French, or HDS certified yourself, to entrust your health data to an HDS-certified host. Your data is hosted on Clever Cloud’s HDS-certified regions in France, within the European Economic Area, under a specific HDS contract that sets out the scope of the certificate and the split of responsibilities. Whether HDS certification is required for your project depends on the law that applies to you: it is a French obligation, and outside France it is used as a level of assurance rather than a legal requirement.

Does using Clever Cloud make my organisation HDS certified?

No. HDS certification is held by the certified host, within a defined scope. By using Clever Cloud under a specific HDS contract, your organisation benefits from HDS-certified hosting within the scope covered by the certification and the associated contract. This does not transfer HDS certification to your organisation and does not automatically cover all of your regulatory, application or GDPR obligations.

Is an HDS contract mandatory?

Yes. The hosting of personal health data is the subject of a contract concluded between the host and its client. This contract specifies, among other things, the scope of the host’s HDS certificate, the services provided, the hosting locations, the service levels, the terms of data access, the guarantees in case of failure, the reversibility conditions, as well as the commitments to return and destroy the data at the end of the service.

Which law governs the hosting of health data?

The hosting of personal health data is governed by article L.1111-8 of the French Public Health Code, decree no. 2018-137 of 26 February 2018, as amended by decree no. 2026-209 of 24 March 2026, and the HDS certification framework published by the French Digital Health Agency (Agence du Numérique en Santé).

Which providers are HDS certified?

The French Digital Health Agency publishes the official list of HDS-certified hosts. Clever Cloud is on it.

What are the conditions for hosting health data?

Using a host certified for the relevant scope, hosting the data within the European Economic Area, and concluding a specific HDS contract that sets out the scope of the host’s certificate.

How much does HDS hosting cost?

HDS hosting requires a specific contract whose scope is defined during a conversation with an Account Manager. It is this scope, and the resources involved, that determine the service.

Do I need to be HDS certified myself?

No, not for the hosting you entrust to Clever Cloud. You act as the data controller and Clever Cloud as an HDS-certified processor across the six activities of the framework: the host’s certification covers the activities it performs for you. However, if your organisation itself carries out an activity within the HDS scope, for example the administration and operation of the information system containing the health data (activity 5), that activity falls under your own responsibility. The exact split of roles is defined in the HDS contract.

Are your servers in France? What guarantee is there on data sovereignty?

For HDS projects, personal health data is hosted and processed in France only, on our regions that hold the HDS certification. Clever Cloud is a French company under European jurisdiction, with no exposure to extraterritorial laws such as the Cloud Act or FISA.

What proves that my hosting is compliant?

The HDS contract concluded with Clever Cloud. Provided for by article R.1111-11 of the French Public Health Code, it sets out the scope of the certificate, the covered activities, the hosting locations and the split of responsibilities. It is the contractual proof that your hosting is compliant. Our certificate is also available at any time on our security page.

What is covered by the HDS certification? Is Docker covered?

HDS certification covers a scope, not isolated products: it covers the platform and the services executed within our certified regions in France. This scope includes the main runtimes (PHP, JavaScript, Java, Python, Go, Rust, Docker, and more) and the managed databases (PostgreSQL, MySQL, MongoDB, Redis, Elastic Stack, Cassandra, Materia KV, and more). Docker is indeed covered.