Health data hosting (HDS)

Updated on 21/09/2026. This page is a translation for information: the French version prevails.

Galeon holds a certificate of conformity for hosting personal health data on digital media within the meaning of section II of article L. 1111-8 of the French Public Health Code. Certificate of conformity no. 2023/107525.3, issued by AFNOR Certification under the HDS v2 certification framework (COFRAC accreditation no. 4-0001), is valid from 26/11/2025 to 20/12/2026.

ISO/IEC 27001 certification

Galeon’s information security management system is also certified NF EN ISO/IEC 27001:2023 / ISO/IEC 27001:2022 by AFNOR Certification, under no. 2023/107529.3, for the design and SaaS hosting of the intelligent patient record. This certificate is valid from 26/11/2025 to 20/12/2026. The statement of applicability shared by both certifications is referenced PS04-SMSI-Galeon-DDA_ISO27001_HDS-v3.00, dated 14/10/2025.

Galeon’s certificates can be viewed here: HDS certificate no. 2023/107525.3 and ISO/IEC 27001 certificate no. 2023/107529.3.

Hosting activities covered

• Providing and maintaining in operational condition the virtual infrastructure of the information system used to process health data;
• Providing and maintaining in operational condition the application hosting platform of the information system;
• Administering and operating the information system containing health data;
• Backing up health data.

Sites

For virtual hosting and the technical and application management of the Galeon application, services are provided from six sites:

• Galeon : 5 avenue du Pré Félin, 74940 Annecy, France
• AZNetwork : 40 rue Ampère, 61000 Alençon, France
• AZNetwork PAR01 : 3 route de Marcoussis, 91620 Nozay, France
• AZNetwork PAR02 : 15 rue Angiboust, 91460 Marcoussis, France
• AZNetwork PAR03 : 7 route de Villejust, 91620 Nozay, France
• ITinSell : ZA Athélia III, 785 voie Antiope, 13600 La Ciotat, France

French is used for hosting activities and first-level support.

Our hosts’ HDS certificates can be viewed here: AZNetwork, no. 2019/84783.6 and ITinSell Cloud, HDS no. 779560.

Transparency on health data transfers

As part of our commitment to health data protection and in line with the HDS framework, we publish a map of transfers of personal health data outside the European Economic Area (EEA), updated regularly.

As of 13/11/2025: no personal health data is transferred to a country outside the European Economic Area for Galeon’s certified services.

Subcontracting

To deliver its hosting activities, Galeon relies on several subcontractors.

AZNetwork — 40 rue Ampère, 61000 Alençon, France

• SIRET: 423 880 061 00035.
• Acting as a certified health data hosting subcontractor, providing and maintaining in operational condition:
  • the physical sites housing the hardware infrastructure of the information system used to process health data;
  • the hardware infrastructure of the information system used to process health data;
  • the application hosting platform of the information system;
  • the virtual infrastructure of the information system used to process health data.
• With no access to health data from countries outside the European Economic Area;
• With no risk of access to personal health data from countries outside the European Economic Area imposed by the law of a third country in breach of EU law;
• HDS certificate no. 2019/84783.6, issued by AFNOR Certification, valid from 05/03/2026 to 06/04/2028: view the certificate (PDF).

ITinSell — 61 rue Sully, 69006 Lyon, France

• SIRET: 913 164 141 00016.
• Certified health data hosting subcontractor, not SecNumCloud-qualified, providing and maintaining the infrastructure in operational condition.
• HDS certificate no. 779560, issued by BSI, valid from 21/05/2025 to 20/05/2028: view the certificate (PDF).

Should an HDS-certified subcontractor lose or have its certification suspended, Galeon would transfer the activity to another of its certified subcontractors.