See Galeon for real- Home
- Sovereignty
Sovereignty
Your patients’ data stays in France, and stays yours.
With Galeon, a French hospital’s health data is hosted in France, on six HDS-certified sites, with no transfer outside the European Economic Area. It remains the property of the hospital: Galeon hosts and processes it on the hospital’s behalf.
What is health data sovereignty?
For a hospital, data sovereignty comes down to three questions: where is the data stored, under which law, and who can access it. A server located in Europe is not enough: data stored in Europe can remain exposed to a third country’s law if the host is subject to it, as the US Cloud Act provides.
Galeon answers these three questions with verifiable facts: an HDS certificate issued by AFNOR Certification, the public list of its sites and subcontractors, and a transfer map that is kept up to date.
Four answers
What a CIO asks us, and what we can prove.
Where
In France, on six HDS-certified sites: Annecy, Alençon, Nozay, Marcoussis and La Ciotat. For a Swiss hospital, in Switzerland; for a Luxembourg hospital, in Luxembourg.
Under which law
Galeon and its HDS-certified hosting subcontractors are companies established in France. No health data is transferred outside the European Economic Area.
Who has access
The hospital’s authorised clinicians, with two-factor authentication. Galeon’s internal access controls are covered by its ISO 27001 certification.
Who owns it
The hospital. Galeon hosts and processes it on the hospital’s behalf.
Verifiable
Everything is published; nothing has to be taken on trust.
The legal detail (certified activities, addresses, subcontractors’ company numbers, PDF certificates) is on the HDS certification page.
HDS and ISO 27001 certificates
HDS certificate no. 2023/107525.3 and ISO/IEC 27001 no. 2023/107529.3, issued by AFNOR Certification, valid until 20/12/2026.
Certificates, sites, subcontractors →Transfer map
Published and kept up to date, as the HDS framework requires: as of 13/11/2025, no transfer outside the European Economic Area.
Read the map →Security
DDoS protection, web application firewall, vulnerability scanning, and an EHR that has withstood two cyberattacks.
Security and certifications →Further reading
The guide “Is your hospital sovereign over its health data?” offers a diagnosis in a few questions. On the blog: the Cloud Act versus sovereign hosting, sovereignty in the face of Big Tech, and how to choose your HDS provider. On the product side: EHR interoperability, so that data can flow without leaving this framework.
FAQ
What we are asked about sovereignty.
Where is the health data of Galeon’s client hospitals hosted?
In France, across six HDS-certified sites: Annecy (Galeon headquarters), Alençon (AZNetwork), Nozay (AZNetwork PAR01 and PAR03), Marcoussis (AZNetwork PAR02) and La Ciotat (ITinSell). For a Swiss hospital, data is hosted in Switzerland; for a Luxembourg hospital, in Luxembourg.
Does any health data leave the European Economic Area?
No. As of 13 November 2025, no personal health data is transferred to a country outside the European Economic Area for Galeon’s certified services. The transfer map is published and kept up to date on the HDS certification page.
Who owns the data in the patient record?
The hospital. Galeon hosts and processes it on the hospital’s behalf, in an HDS-certified environment.
What happens if a hosting provider loses its HDS certification?
Galeon moves the activity to another of its HDS-certified subcontractors. This is a written commitment on the certification page, not a sales promise.
Your data, under your control.
A first call with someone who knows what your CIO and DPO require.