HDS-Certified Hosting for Therapists in France and Europe

The My International Therapy website, its dashboard for therapists and their data are hosted by Amazon Web Services (AWS) in the Europe (Stockholm, Sweden) region. On its public page, AWS states that it holds HDS certification (hébergeur de données de santé, or health data host, framework version 2) for all six activities of the framework, and lists Stockholm among the covered regions. The certification applies to the hosting provider, not to My International Therapy.

This page is for psychologists, psychotherapists and therapists looking for HDS-certified hosting for their patients’ data, in France or elsewhere in Europe. It explains what the certification is, who it applies to, what the hosting of My International Therapy includes and how to check a hosting provider yourself. It is general information and does not replace legal advice.

What HDS certification is

HDS stands for "hébergeur de données de santé", the French term for a health data host. Article L.1111-8 of the French Public Health Code governs the hosting of personal health data collected during prevention, diagnosis, care or social and medico-social follow-up, when it is carried out on behalf of the people who produce the data or on behalf of the patient. A host of digital data must hold a certificate of conformity issued by an accredited certification body. The current certification framework, known as "version 2", was approved by the order of 26 April 2024, published in the Official Journal of 16 May 2024. The procedure is described on the website of the French Digital Health Agency (ANS).

The six activities of the framework

The framework distinguishes six hosting activities. A host is certified for all or part of them:

providing and maintaining the physical sites;
providing and maintaining the hardware infrastructure;
providing and maintaining the virtual infrastructure;
providing and maintaining the application hosting platform;
administering and operating the information system that contains the health data;
outsourced backup.

What the certification does not cover

The certification applies to the host and its scope. It does not certify a piece of software, a practice or a therapist. A platform operator that relies on a certified host remains responsible for how it uses that infrastructure, and the therapist remains responsible for patients’ data under GDPR. AWS makes the same point: under its shared responsibility model, each customer assesses its own compliance obligations.

Does it apply to a psychologist or a psychotherapist?

Article L.1111-8 names no profession. It looks at the nature of the data: data collected during prevention, diagnosis, care or social and medico-social follow-up. Under GDPR, data concerning health include information about a person’s physical or mental health (Article 4, point 15): following a course of psychotherapy concerns mental health and falls within that definition.

The CNIL (the French data protection authority) has published a framework for the management of medical and paramedical practices, addressed to health professionals in private practice. It provides that where patient-record software is accessed remotely and hosted by a provider, that provider must be an approved or certified host under Article L.1111-8. The CNIL framework does not name psychologists or psychotherapists.

To our knowledge, no official text from the ANS, the CNIL or a professional body expressly settles the position of psychologists and psychotherapists. For your own situation, contact the ANS, the CNIL or a lawyer. Using a platform whose host is HDS-certified means that, for the host’s part, you do not depend on that question.

Article L.1111-8 targets the person who hosts such data on behalf of others. If you keep your notes only on your own equipment, you are not entrusting hosting to anyone; GDPR applies in every case.

Where your data is hosted with My International Therapy

Amazon Web Services, Europe (Stockholm) region

The My International Therapy website, the therapist dashboard and their data are hosted by Amazon Web Services in the Europe (Stockholm) region, in Sweden, therefore within the European Union. On its public page on HDS, AWS states that it holds HDS version 2 certification for the six activities and places Stockholm among the European Economic Area regions eligible for all six. It adds that activities 1, 2 and 6 (physical sites, hardware infrastructure, outsourced backup) require storage exclusively within that area. The site’s legal notice gives the contracting entity of the host.

What the hosting includes

the database and the disks are encrypted at rest, and the database is not publicly accessible;
the website and the dashboard are served over HTTPS;
automatic backups are made every night and kept for seven days;
administration actions on the hosting account are logged;
therapists sign in with a password and can optionally add a security key (WebAuthn).

What the dashboard does

The dashboard brings together the therapist’s public profile, the calendar and availability, online booking by the patient, video sessions with a signed session link and no recording, a record for each patient with private notes the patient never sees, messaging, payments and invoices. Patients have their own space to book, follow their appointments and exchange with their therapist. To see the platform, browse the terapist rehberi veya join us as a therapist.

What this page does not say

HDS certification applies to the hosting provider. My International Therapy is not presented as "HDS-certified".
Some supporting services, such as video sessions, online payment or notification e-mails, rely on other providers. They are not covered by the host’s certification and this page does not describe where they are hosted.
The hosting is located in Sweden, not in France, and AWS is part of a US group. According to AWS’s public page, version 2 of the framework strengthens transparency requirements about sub-processors and potential exposure to non-European legislation.

How to check an HDS-certified host

Whether you choose My International Therapy or another tool, the check takes a few minutes.

Ask the vendor for the exact name of the host, the entity that contracts with you and the place where the data is stored.
Look that entity up in the ANS public list of certified hosts. Check the framework version (version 2.0), the activities covered and the certification body. If the name in your contract does not appear there, ask the vendor which entity of the group holds the certification.
Check that the processing agreement required by Article 28 GDPR is signed, and ask for the list of sub-processors.
A "HDS-compliant" label on a piece of software only means something if the host or the vendor appears in the ANS list.

HDS, GDPR and professional secrecy

HDS certification and GDPR are two separate regimes. HDS governs the host. The GDPR applies on top of it to the therapist, who is the data controller.

Article 9 prohibits the processing of health data in principle. It provides an exception for health or social care where the processing is carried out by a professional subject to professional secrecy (Article 9(2)(h) and 9(3)).
Article 28 requires a written contract with any processor, for example a host or platform vendor processing data on your behalf.
Article 32 requires security measures appropriate to the risk.
The professional secrecy you are bound by remains yours, whichever provider you use.

And outside France?

HDS is a certification under French law. In the other countries of the European Union, GDPR sets the common framework, supplemented by national rules:

Germany: section 393 of Book V of the Social Code (SGB V) governs the use of cloud services by providers covered by chapter four of that code and by health insurance funds. It requires a C5 attestation (type 2 from 1 July 2025 for existing systems).
Spain: GDPR and Organic Law 3/2018 apply; a processing contract is needed with the platform provider.
Italy: GDPR and the Italian data protection code apply; in 2019 the authority (Garante) clarified that a health professional bound by professional secrecy does not have to collect the patient’s consent for processing necessary for the requested care.
Portugal: GDPR and Law 58/2019 apply; its Article 29 provides that health data be processed by a professional bound by secrecy or by a person subject to a duty of confidentiality, with appropriate security measures.

This page is also available in French, German, Spanish, Italian and Portuguese, with the framework specific to each country.

Sık sorulan sorular

What is HDS certification?

It is the certificate of conformity that anyone hosting, on digital media, personal health data collected during prevention, diagnosis, care or social and medico-social follow-up must hold (Article L.1111-8 of the French Public Health Code). It is issued by an accredited certification body, on the basis of a framework approved by an order.

Must the software I use be hosted by an HDS-certified host?

The CNIL framework for practices provides that where patient-record software is accessed remotely and hosted by a provider, that provider must be a host certified under Article L.1111-8. The certificate applies to the host, not to the software. The framework does not name psychologists or psychotherapists: for your own case, ask the ANS, the CNIL or a lawyer.

What if I keep my notes on my own computer?

Article L.1111-8 targets whoever hosts data on behalf of others. If you entrust hosting to no one, it does not come into play in that situation. GDPR and your professional secrecy apply in every case, with appropriate security measures.

Where is the data of My International Therapy hosted?

With Amazon Web Services, in the Europe (Stockholm) region, in Sweden. AWS states on its public page that it holds HDS version 2 certification for the six activities, with Stockholm among the eligible regions.

Is My International Therapy HDS-certified?

HDS certification applies to the host, Amazon Web Services, not to My International Therapy. The platform uses that hosting and does not present itself as HDS-certified.

How can I check that a host is HDS-certified?

Look it up in the ANS public list of certified hosts (esante.gouv.fr), check the framework version, the activities covered and the certification body, and ask the vendor for the exact name of the hosting entity.

Does HDS certification replace GDPR?

No. HDS governs the host. GDPR applies on top of it to the therapist as data controller: the Article 9 exception for care, the processing contract (Article 28), security measures (Article 32) and the record of processing activities (Article 30).

Is there an equivalent certification outside France?

HDS is specific to French law. In the other European Union countries, GDPR applies with national rules. In Germany, for example, section 393 SGB V requires a C5 attestation for certain uses of the cloud in healthcare.

Official sources

For therapists

Are you a therapist and want to know more about the platform? Browse the terapist rehberi veya join My International Therapy.

HDS-certified hosting for psychologists and therapists