Compliant Hosting for a Health Data App in London: Obligations and Prices in 2026

The verdict in three sentences

As soon as an app stores health data for French patients or professionals, the host must be HDS-certified: it is a legal requirement under the French Public Health Code, wherever the publisher is based, London included. For a mid-size app, budget EUR 300 to 2,500 a month (roughly GBP 260 to 2,150), a 40 to 120% premium over standard cloud, plus encryption, logging and a disaster recovery plan. The SecNumCloud qualification from ANSSI is only required for some public contracts and sensitive state data, but it is a decisive selling point with French hospitals and local authorities.

HDS, SecNumCloud, GDPR: who requires what

Note: it is the host that holds HDS certification, not your app. But if you administer the servers yourself (managed services level), you must be certified for that activity. The simplest route is to entrust infrastructure to a host certified for all six activities of the standard. For UK NHS patients, the Data Security and Protection Toolkit applies on top.

Host and price comparison 2026

For 15,000 patients, a typical architecture (two app servers, a highly available managed PostgreSQL database, encrypted object storage, offsite backups) costs EUR 900 to 1,600 a month with an HDS host, against EUR 500 to 800 on standard cloud.

The full budget beyond hosting

The monthly rent is only part of the bill. Plan the initial compliance work: encryption at rest and in transit, access logs kept for at least 6 months, strong authentication for professionals (Pro Sante Connect or CPS card in France, NHS login in the UK), and a disaster recovery plan tested once a year. Order of magnitude 2026: EUR 15,000 to 40,000 of development and configuration, EUR 4,000 to 8,000 for the DPIA and GDPR documentation, EUR 5,000 to 12,000 for an annual penetration test. CNIL fines can reach 4% of global turnover or EUR 20 million, and several healthcare players have been fined in recent years for security failures.

Mini case study

Camille, founder of a London-based home care coordination app serving French regions, manages 15,000 patients and 600 nurses. HDS hosting with a French provider: EUR 1,300 a month, against EUR 700 on standard cloud, an extra EUR 7,200 a year. Compliance: EUR 28,000 of development, EUR 6,000 for the DPIA, EUR 8,000 for a penetration test, so EUR 42,000 in year one. Across 15,000 patients, the total first-year cost (EUR 57,600) comes to EUR 3.84 per patient. This budget opens a EUR 180,000 a year tender from a hospital group that required HDS and an optional SecNumCloud host.

FAQ

Is HDS hosting mandatory for a health app?

Yes, as soon as it stores personal health data of French patients on behalf of third parties. Non-compliance exposes you to criminal penalties and CNIL fines up to 4% of global turnover.

How much does HDS hosting cost in 2026?

Between EUR 300 and 2,500 a month depending on size and required availability. The premium over standard cloud ranges from 40 to 120%.

Is SecNumCloud mandatory?

Not for most private publishers. It is required for some public contracts and sensitive state data, and costs about 20 to 30% more than HDS alone.

Can AWS or Azure be used for health data?

Yes, their European regions are HDS-certified. However, they are not SecNumCloud-qualified, which can shut you out of some French public tenders.

How long does migration to an HDS host take?

Plan 6 to 12 weeks for an existing app, including 2 to 4 weeks of testing and a scheduled overnight cutover. The DPIA can run in parallel over 3 to 5 weeks.

Let's scope your project. Tell us about your app, your patient volume and your target clients: we will frame the right host, the indicative compliance budget and the migration schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.