The verdict in three sentences
A remote monitoring app that stores Dutch patient data must run on NEN 7510 compliant hosting, the Dutch information security standard for healthcare, alongside GDPR and the Wabvpz rules on electronic health data exchange. Compliant infrastructure costs between 400 and 2,500 EUR per month, plus a DPIA, a processing register and a security audit of 8,000 to 20,000 EUR before your first hospital contract. The real risk is not the cost: it is discovering these requirements during the hospital's procurement process and losing six months.
What the hospital will ask in its security questionnaire
A Dutch academic medical centre (UMC) or regional hospital typically sends 80 to 200 questions before connecting patients to your solution. The blocking items are always the same.
| Requirement | 2026 reference | Indicative cost | Lead time |
|---|---|---|---|
| NEN 7510 certified hosting provider | NEN 7510:2017 (ISO 27001 based) | 400 to 2,500 EUR/month | 2 to 4 weeks of migration |
| DPIA (impact assessment) | GDPR art. 35, Dutch DPA list | 3,000 to 8,000 EUR if outsourced | 3 to 6 weeks |
| Processing register | GDPR art. 30 | 1,000 to 2,500 EUR | 1 to 2 weeks |
| Encryption at rest and in transit | AES-256, TLS 1.3 | Included if designed in | From day one |
| Security audit and penetration test | Independent auditor | 8,000 to 20,000 EUR | 3 to 5 weeks |
| Strong clinician authentication | UZI pass or MFA | 4,000 to 12,000 EUR to integrate | 4 to 8 weeks |
| Access logging | NEN 7513, logs kept 6 months minimum | 50 to 300 EUR/month of storage | From day one |
Two field notes. First, Dutch hospitals increasingly require that data stays inside the European Economic Area: a single backup bucket outside the EEA is enough to fail the audit. Second, a DPO (internal or shared, 500 to 1,500 EUR per month) becomes mandatory as soon as you process health data at scale.
Comparing compliant hosting offers in 2026
The market has matured: hyperscalers with Dutch regions, specialised European hosts and healthcare managed service providers. The right choice depends mostly on your ability to run infrastructure yourself.
| Offer type | Typical profile | Monthly price 2026 | What is included | Best for |
|---|---|---|---|---|
| Public cloud, NL region (IaaS) | Hyperscaler, Amsterdam region | 400 to 900 EUR | Infrastructure, you manage OS and app | In-house DevOps team |
| Sovereign EU cloud (IaaS/PaaS) | European host, NEN 7510 | 600 to 1,400 EUR | Infrastructure and managed databases | Startup with 1 infra engineer |
| Full healthcare managed hosting | Healthcare MSP | 1,200 to 2,500 EUR | Infra, OS, backups, 24/7 on-call | Startup without DevOps |
| Offsite compliant backup | Dedicated option | 80 to 350 EUR | Encrypted copy on a second site | Everyone |
| Monitoring and SIEM | Dedicated option | 150 to 600 EUR | Alerts, log correlation | After 1,000 patients |
For a startup in pilot phase with 2 or 3 hospitals and fewer than 5,000 monitored patients, a sovereign PaaS offer at around 800 to 1,200 EUR per month is usually the best balance. Full managed hosting pays off once an internal on-call rota costs more than 1,500 EUR per month.
The application budget: build it compliant from the start
Rewriting an application to make it compliant costs two to three times more than designing it that way. Kolonell builds custom web apps and SaaS between 2.5 and 15M+ FCFA (3,810 to 22,870+ EUR) depending on complexity, the rest on quote: patient portal, clinician dashboard, threshold alerts, export to the hospital EHR.
| Application module | Complexity | 2026 order of magnitude |
|---|---|---|
| Patient web and mobile portal (PWA) | Medium | 4,000 to 7,000 EUR |
| Clinician dashboard with alerts | Medium to high | 5,000 to 9,000 EUR |
| Consent management and GDPR rights | Medium | 2,000 to 4,000 EUR |
| Access logging and audit trail | Medium | 1,500 to 3,000 EUR |
| HL7 FHIR interoperability with the EHR | High | On quote |
| UZI or national eID integration | High | On quote |
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Sanne, CTO of a heart failure remote monitoring startup in Amsterdam, needs to sign her first UMC in March. Her app runs on a generic, non-certified cloud. Compliance budget: migration to a NEN 7510 PaaS at 1,000 EUR per month, so 12,000 EUR over a year; outsourced DPIA and register for 7,000 EUR; independent penetration test for 12,000 EUR; rework of logging and the consent module for 5,500 EUR. First-year total: 36,500 EUR. The target hospital contract covers 600 patients at 35 EUR per month, or 252,000 EUR per year. Compliance therefore equals 14.5% of the first year of revenue from a single customer, and it unlocks every following one.
FAQ
Is compliant hosting mandatory for a small pilot?
Yes, as soon as real patient health data is involved, even for 20 people. Only synthetic or fully anonymised data escapes the requirement, and anonymisation must be irreversible under GDPR.
How much does a DPIA cost for a remote monitoring app?
Done internally with a standard template, it takes about 10 to 15 working days. Outsourced to a consultancy, budget 3,000 to 8,000 EUR depending on the number of processing activities.
Can backups live with a different provider?
Yes, provided that provider also meets NEN 7510 for backup activity and the data stays inside the EEA. Budget 80 to 350 EUR per month for this option.
Is CE marking as a medical device linked to hosting?
They are separate topics. If your software computes a clinical alert, it probably falls under the MDR (class IIa in most cases), with a certification budget of 40,000 to 150,000 EUR, independent of hosting.
How quickly can we be ready for a hospital tender?
With a cleanly designed application, 8 to 12 weeks are enough: hosting migration, DPIA, penetration test. If the architecture needs rework, plan on 4 to 6 months instead.
Let's scope your project. Send us your scope (patient portal, clinician dashboard, interoperability) and your hospital deadline: we will price a compliant application with an indicative budget and a realistic schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
