A digital platform dedicated to health and well-being online refers to a web service that centralizes medical resources, tracking tools, or remote consultations around the care pathway. These platforms differ from simple directories by their ability to aggregate personal health data, offer teleconsultations, and store sensitive information within a regulated framework.
Health Data Hosting: What the HDS v2.0 Framework Changes
Most guides on online health platforms describe visible features (appointment scheduling, patient space, well-being tracking). They overlook the infrastructure that conditions the very legality of the service.
Since the end of 2024, the version 2.0 of the HDS framework applies to all new certifications of health data hosts. This framework strengthens the requirements for data localization within the European Economic Area, according to the Digital Health Agency.
The next deadline is concrete: starting from May 16, 2026, only HDS v2.0 certified hosts will be legally allowed to continue health data hosting activities on behalf of third parties in France. Any health platform that stores patient data with a non-compliant provider will be in violation.
In parallel, decree no. 2026-272 of April 14, 2026, enacted under the SREN law of May 21, 2024, requires administrations and several public interest groups to use a qualified SecNumCloud or equivalent European cloud for particularly sensitive data. This requirement for digital sovereignty now permeates the entire chain, from the ministry to the private operators handling health data.
To map the actors and digital services that structure the French e-health ecosystem, the tsa e-health site serves as a useful entry point to the various sectors of the industry.
Health Data and Well-being Data: A Legal Boundary to Understand
An application that records daily step counts on a phone, without a user account or remote backup, does not fall under the same regime as a teleconsultation platform. The distinction seems intuitive, but the legal boundary is tightening each year.
In 2026, the CNIL reminds us that health or well-being applications offering a remote service (follow-up by a professional, cloud backup) fall under the enhanced regime of health data. This concretely means compliance with the GDPR, the Data Protection Act, and articles L.1110-4 and L.1110-4-1 of the Public Health Code.
For the user, the direct consequence is simple: any platform that offers remote follow-up processes health data, even if it presents itself as a well-being service. Before creating an account, checking for the mention of a certified HDS host in the terms and conditions is a basic protective reflex.
Criteria for Distinguishing a Compliant Platform
- The explicit mention of a certified HDS host (v2.0 from May 2026) in the legal notices or privacy policy.
- A location of servers within the European Economic Area, verifiable in the terms of use.
- Granular consent for each type of data collected, in accordance with CNIL recommendations for mobile health applications.
Digital Health Services: The Functional Building Blocks of a Platform
Beyond regulatory compliance, a digital health platform is structured around functional building blocks that determine its real utility. Not all are equal, and the accumulation of features guarantees nothing.
The teleconsultation remains the most visible building block. It requires a secure video stream, identification of the health professional (often via the CPS card or the e-CPS application), and a compliant prescription transmission channel.
The shared patient record constitutes a second building block. My health space, deployed nationally, centralizes medical documents, test results, and prescriptions. A private platform can connect to it via the frameworks of the Digital Health Agency, provided it complies with the National Health Identity (INS) framework.
Online Well-being: Complementary Features
Well-being-oriented platforms add modules for scheduling appointments with non-medical practitioners (sophrology, naturopathy, coaching), personal goal tracking spaces, and sometimes educational content on mental health.
The structural difference with a care platform lies in the level of regulatory requirement. A directory of well-being practitioners that does not store any medical data does not need HDS hosting. As soon as a patient account records a history of consultations or follow-up notes, the legal framework shifts.
Protection of Personal Information on a Health Platform
The protection of data on these platforms relies on three distinct levels that stack.
- Data encryption in transit (TLS protocol) and at rest, which prevents unauthorized third parties from reading the information.
- Access rights management, where each professional only accesses the data necessary for their care, in accordance with the GDPR’s principle of minimization.
- Access traceability, which records each file consultation and allows for an audit in case of suspected leaks.
Choosing a health platform engages the confidentiality of some of the most sensitive data in the digital realm. The legal notices, the certification of the host, and the granularity of consent form the triptych to verify before any registration. A platform that does not make this information easily accessible warrants caution.
