Health Data Hosting (HDS)
HDS v2 certification in progress
HDS (Hébergement de Données de Santé) is the French certification for hosting personal health data. This page explains what it is, where Gradium stands, and how Gradium handles health data.
What HDS is
Under article L.1111-8 of the French Public Health Code, any organisation that hosts personal health data on behalf of others must be HDS certified. The certification follows the HDS v2 référentiel of the Agence du Numérique en Santé (ANS), approved on 26 April 2024: it builds on ISO 27001 and adds requirements specific to health data, such as storing it in the European Economic Area (EEA).
Where Gradium stands
Gradium is going through HDS v2 certification for what it does itself: hosting the application platform, and administering and operating the information system. Its cloud providers, which are HDS certified, cover the infrastructure. Gradium already holds ISO 27001:2022 certification.
Once granted, our HDS certificate will be published on our Trust Center, next to our ISO 27001:2022 certificate and SOC 2 Type 2 report.
Health data at Gradium
An organisation under HDS always gets:
- EU data residency, in implicit mode: the whole organisation is pinned to the EU, whichever endpoint it calls. Its sessions are processed in the EU only, and a request that reaches a cluster outside the EU is refused. See Data Residency.
- Zero Data Retention: no session content (audio, text or generated speech) is ever written to disk. See Zero Data Retention.
Neither can be switched off, by Gradium or by the client, while the organisation is under HDS.
Tableau des garanties HDS
As HDS v2 requirements 29 and 30 ask, Gradium publishes its Tableau des garanties HDS: each actor taking part in hosting health data, its role and certifications, and whether the data can be accessed from outside the EEA. The table is in French.