The verdict in three sentences
As soon as your app stores health data on behalf of patients or healthcare professionals in France, hosting with an HDS-certified provider (Hébergeur de Données de Santé) is a legal requirement under article L.1111-8 of the Public Health Code, not an option. Typical budgets range from 200 to 1,500 EUR a month excl. VAT depending on managed services, plus 5,000 to 15,000 EUR to bring the application into compliance. Plan 4 to 8 weeks before launch: this is the lead time foreign vendors most often underestimate.
Who is affected and what the law says
HDS certification applies to any entity hosting personal health data collected during prevention, diagnosis, care or social-medical follow-up, on behalf of a third party. Telehealth apps, patient follow-up tools, practice management software and appointment platforms recording medical reasons all fall within scope. A US or UK vendor selling to French clinics is subject to the same rule.
The HDS framework revised in 2024 tightens two points: data must be stored within the European Economic Area, and the provider must disclose any possible access from a third country. Providers had until late 2026 to align, so check that yours is certified under the new version.
| Risk | Legal basis | Maximum penalty |
|---|---|---|
| Hosting without HDS certification | Public Health Code, L.1115-1 | 3 years' imprisonment and 45,000 EUR fine |
| Data security failure | GDPR, article 32 | 10 M EUR or 2% of global turnover |
| Unlawful processing of health data | GDPR, article 9 | 20 M EUR or 4% of global turnover |
| No data protection impact assessment (DPIA) | GDPR, article 35 | 10 M EUR or 2% of global turnover |
| Failure to notify a breach | GDPR, article 33 | 10 M EUR or 2% of global turnover |
| Breach of contract with a hospital | Contract clauses | lost client, penalties |
Beyond fines, the CNIL (French data protection authority) regularly publishes sanctions in healthcare, and no hospital will sign with a vendor unable to produce its HDS certificate.
How much HDS hosting costs in 2026
Price depends mostly on what you delegate. Infrastructure-only hosting (you manage servers and application) is cheap; fully managed hosting with 24/7 monitoring costs significantly more.
| Package | What is included | Monthly cost 2026 (excl. VAT) | Best for |
|---|---|---|---|
| HDS IaaS | Certified virtual machines, storage, network | 200 - 450 EUR | Strong in-house tech team |
| HDS PaaS or managed database | Database, backups, system updates | 400 - 800 EUR | Startup with 1 to 2 developers |
| Partial managed services | + monitoring, patches, business-hours on-call | 700 - 1,100 EUR | Commercial launch |
| Full managed services | + 24/7 on-call, disaster recovery, 99.9% SLA | 1,100 - 1,500 EUR | Hospital clients, high volumes |
| HDS off-site backup | Encrypted copies on a second site | 50 - 200 EUR | All packages |
| Application compliance | Encryption, logging, access control, DPIA | 5,000 - 15,000 EUR (one-off) | All packages |
These amounts are 2026 orders of magnitude for an app serving 1,000 to 50,000 patients (roughly 215 to 1,620 USD a month for hosting). Compliance work covers encryption at rest and in transit, access logging, strong authentication for professionals, the DPIA and the documentation hospitals require.
A realistic timeline before launch
- Weeks 1 and 2: map health data, choose a package, request quotes from 2 or 3 certified providers.
- Weeks 2 to 4: sign the HDS contract, open environments, migrate staging.
- Weeks 3 to 6: encryption, access logs, strong authentication, DPIA drafting.
- Weeks 6 to 8: light penetration testing, acceptance testing, go-live.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Thomas, founder of an e-health startup in Nantes, launches a post-surgery follow-up app for 3 partner clinics, covering 4,000 patients in year one. His prototype runs on a standard cloud provider.
- Chosen package: HDS PaaS at 650 EUR a month, or 7,800 EUR a year, plus 120 EUR a month for off-site backup, or 1,440 EUR.
- Application compliance: 9,500 EUR (encryption, logging, strong authentication, DPIA).
- First-year cost: 7,800 + 1,440 + 9,500 = 18,740 EUR, about 4.70 EUR per patient.
- The 3 clinics sign for a combined 2,400 EUR a month, or 28,800 EUR a year. In year one, compliance and hosting absorb 65% of that revenue; from year two only hosting remains (9,240 EUR), or 32%, a ratio that falls as new clinics join the same infrastructure.
FAQ
Does my wellness app need HDS hosting?
Not necessarily: sleep or step tracking with no medical purpose is generally out of scope. Once a healthcare professional is involved or a diagnosis is at stake, certification becomes mandatory.
Can we use AWS, Azure or Google Cloud?
Yes, their European regions hold HDS certification for certain services. Check that every service you use is within the certified scope and that storage stays in the European Economic Area.
How long does it take to migrate an existing app to an HDS provider?
Allow 4 to 8 weeks depending on complexity. A simple app with a single database can switch over in 3 weeks.
Do we also need a DPIA?
Yes, large-scale processing of health data requires a data protection impact assessment. It usually costs 2,000 to 5,000 EUR when outsourced.
Does the HDS provider guarantee my whole app is compliant?
No, it certifies the infrastructure. Your code security, access management and DPIA remain your responsibility, hence the 5,000 to 15,000 EUR budget.
Let's scope your project. Tell us about your app and patient volumes, and we will price the compliance work, between 5,000 and 15,000 EUR, and the right HDS hosting with a 4 to 8 week schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
