HDS-certified hosting for a health app in France: rules and prices

The verdict in three sentences

If your app stores health data on patients treated in France, on behalf of a clinician or a care provider, it must be hosted by an HDS-certified provider, and being a UK or German company does not exempt you. Expect, as a 2026 order of magnitude, EUR 300 to 2,500 excl. VAT per month depending on redundancy, a 30 to 80 % premium over equivalent standard cloud. The real budget risk sits less in the monthly bill than in the contract, encrypted backups and security audit that French hospitals will ask for before they buy.

What the HDS rule actually requires

HDS certification comes from article L.1111-8 of the French Public Health Code. The revised framework published in 2024 tightened two points that matter for a London or Berlin healthtech: data must be hosted inside the European Economic Area, and the host must disclose any risk of access from a third country. A UK region, however good, no longer qualifies. For a post-operative monitoring app, the scope covers vitals entered by patients, wound photos, pain questionnaires and messages with the surgical team.

The certified scope runs from physical infrastructure to virtual infrastructure, platform, system administration and backups. You can buy only the IaaS layer and run the application yourself, but you then own everything above it: patching, logging, access management and disaster recovery. Many founders find this out when they receive their first hospital security questionnaire.

Comparing offers without getting lost

Three families of providers serve the French market. Certified hyperscalers offer wide coverage but usage-based billing that is hard to forecast. French certified clouds publish clearer price lists and support in French. Specialist health managed-service providers cost more but run operations end to end, which relieves a team of three developers.

For a London team used to paying around GBP 350 a month for a standard setup, a multi-zone HDS environment will typically land between EUR 600 and 1,200. Before signing, check four clauses: the exact certified levels and certificate number, data retention and return at contract end, reversibility terms (format, delay, cost), and sub-processing under GDPR article 28. A missing reversibility clause can cost weeks of work the day you switch provider.

What the application itself must deliver

A certified host does not make your code compliant. The application needs strong authentication for clinicians, tenant isolation per care provider, field-level encryption for sensitive data, a retention policy and an exportable access log. At Kolonell, an app of this kind usually falls in our mid-complexity application tier, 4,000,000 to 7,000,000 FCFA (EUR 6,100 to 10,670), or in the complex tier, 7,000,000 to 15,000,000+ FCFA (EUR 10,670 to 22,870+), when it includes secure messaging and connectors to hospital software. The HDS hosting itself, selected with you, is quoted on request. Application maintenance runs at 35,000, 75,000 or 120,000 FCFA per month (EUR 53, 114 or 183) depending on service level. See our custom web application offer.

Mini case study

Jonas, co-founder of a Berlin healthtech, monitors 4,000 post-operative patients for two clinics near Paris. His prototype runs on a standard cloud at EUR 450 per month. The equivalent multi-zone HDS environment costs EUR 720 per month, 60 % more.

First-year maths: hosting premium of EUR 270 x 12 = EUR 3,240, security audit EUR 5,000, DPIA done in-house with a lawyer for EUR 2,500. Total: EUR 10,740. A single contract with a third clinic is worth EUR 18,000 a year. Compliance pays for itself with the first signature, and without it the tender was closed to him.

FAQ

Does a pilot-stage startup already need HDS hosting?

Yes, as soon as real patient data is collected for their care, even for 50 people. Only a prototype running on synthetic data can stay on a standard cloud. Allow 4 to 10 weeks for the switch before the pilot.

Can we keep backups in a UK or US region?

No, the 2024 framework requires hosting inside the European Economic Area. An encrypted backup on a second European site usually costs EUR 40 to 250 per month.

Does encryption remove the need for HDS?

No, encrypted data is still health data if you hold the keys. The obligation applies to the host whatever encryption you use.

How long does an audit take before selling to a hospital?

An application penetration test takes 5 to 10 person-days, billed EUR 3,000 to 8,000 as a 2026 order of magnitude. Plan 2 to 3 weeks of fixes afterwards.

Who is liable after a data breach?

The publisher, as controller or processor depending on the setup, must notify the regulator within 72 hours. The host answers for its certified scope, which is why the liability clause matters.

Let's scope your project. We define with you the architecture, the HDS host and the compliance timeline for your health app, in 6 to 12 weeks depending on scope. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.