The verdict in three sentences
Any application hosting patients' health data on behalf of a professional or facility in France must use an HDS-certified host (article L.1111-8 of the French Public Health Code). In 2026, the budget ranges from EUR 150 to 1,500 excl. VAT per month depending on architecture, a 30 to 60% premium over equivalent standard cloud. Add a mandatory GDPR data protection impact assessment (DPIA) and 1 to 3 months of compliance work before launch.
Who must comply with HDS
The founder of a patient monitoring app (chronic disease telemonitoring, post-surgery follow-up, rehabilitation, medical nutrition) often asks the question too late, when a hospital or clinic requests the HDS certificate in its security questionnaire.
| Situation | Health data? | HDS hosting mandatory? |
|---|---|---|
| Patient monitoring app used by doctors | Yes | Yes |
| Medical appointment booking (name, reason for visit) | Yes, the reason reveals health status | Yes |
| Wellness app with no link to a professional | Depends on data collected | Recommended, not always mandatory |
| SaaS patient record for a physiotherapy practice | Yes | Yes |
| Irreversibly anonymised statistics | No | No |
| Data stored by the patient alone for personal use | Yes | Not under L.1111-8, GDPR applies |
The revised HDS framework also requires data to be hosted within the European Economic Area, with transparency on any transfers outside the EU. In practice this rules out, or forces you to document, some setups on clouds subject to extraterritorial laws.
2026 HDS hosting cost
| Option | Content | 2026 price (excl. VAT/month) | Premium vs standard cloud |
|---|---|---|---|
| Shared managed HDS (PaaS) | App + managed database, backups, monitoring | EUR 150 to 400 | + 40 to 60% |
| HDS IaaS (virtual servers) | 2 to 4 VMs, PostgreSQL, off-site backup | EUR 350 to 800 | + 30 to 50% |
| Full managed HDS | 24/7 operations, disaster recovery, on-call, logging | EUR 800 to 1,500 | + 35 to 55% |
| Hyperscalers with HDS offer | Managed services, pay-as-you-go | EUR 300 to 1,500 and up | + 30 to 45% |
| Encryption and key management (KMS) | Optional depending on offer | EUR 20 to 100 |
French HDS-certified hosts frequently used by startups include OVHcloud, Scaleway, Clever Cloud, Outscale and several health-specialised managed service providers. Always check the exact scope of the certificate (physical hosting only, or also operations and backup).
Obligations beyond the host
Picking an HDS host does not make the application compliant on its own. The publisher remains responsible for its code and organisation.
| Obligation | Deliverable | Indicative 2026 cost (excl. VAT) | Timeline |
|---|---|---|---|
| GDPR impact assessment (DPIA) | PIA document, security measures | EUR 3,000 to 8,000 | 2 to 4 weeks |
| HDS hosting contract | L.1111-8 clauses, reversibility | Included by host | 1 to 2 weeks |
| Strong authentication for professionals | Pro Santé Connect or MFA | EUR 4,000 to 10,000 development | 2 to 3 weeks |
| Encryption and access logging | Timestamped logs, retention | EUR 2,000 to 6,000 | 1 to 2 weeks |
| Penetration test | Report and fixes | EUR 4,000 to 12,000 | 2 weeks |
| Processing register and DPO | Register, outsourced DPO | EUR 150 to 600 per month | Ongoing |
Total compliance budget for an existing app: EUR 15,000 to 40,000 excl. VAT over 1 to 3 months, on top of monthly hosting.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Julien, founder of a telemonitoring app for heart failure patients in Bordeaux, hosts his database on a general-purpose cloud for EUR 280 a month. A university hospital ready to sign a EUR 60,000-a-year contract requires the HDS certificate and a DPIA.
He moves to a managed HDS offer at EUR 420 excl. VAT per month (a 50% premium, or EUR 1,680 a year), commissions the DPIA for EUR 5,000, adds Pro Santé Connect and logging for EUR 9,000, and a penetration test for EUR 6,000. Compliance investment: EUR 20,000 + EUR 1,680 a year. The first hospital contract covers it in 4 months, and the certificate becomes a selling point for the next 3 facilities (2026 order of magnitude).
FAQ
How much does HDS hosting cost for a health app?
EUR 150 to 1,500 excl. VAT per month depending on the option, from shared managed hosting to 24/7 operations. That is usually 30 to 60% more than equivalent standard cloud hosting.
Can a startup skip HDS at first?
No, as soon as it hosts health data collected as part of care by professionals. Non-HDS hosting exposes the company to criminal penalties and GDPR fines of up to 4% of global turnover.
Is the DPIA really mandatory?
Yes, large-scale processing of health data is on the CNIL list of processing requiring an impact assessment. Budget EUR 3,000 to 8,000 excl. VAT if outsourced.
How long does moving to an HDS host take?
The technical switch takes 2 to 4 weeks for a standard app. With the DPIA, contracts and penetration test, full compliance takes 1 to 3 months.
Do backups also need to be HDS?
Yes, backup is one of the activities covered by the certification. Check that your host is certified for it or that your backup provider is.
Let's scope your project. Tell us about your app, your professional users and current hosting, and we will price the HDS migration and compliance work at EUR 15,000 to 40,000 excl. VAT over 1 to 3 months. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
