The GDPR classifies health as sensitive data
Article 9 of the GDPR generally prohibits the processing of health-related data, with specific exceptions, particularly those related to labor law and social protection. Processing must also comply with data minimization, purpose limitation, and security requirements. The CNIL has published practical guides dedicated to AI that clarify these requirements for AI systems.
What is HDS hosting ?
In France, the hosting of personal health data collected during prevention, diagnostic, care, or social and medico-social monitoring activities is subject to HDS (Health Data Host) certification. This certification is overseen by the Digital Health Agency (Agence du numérique en santé).
Not all data processed by QHSE software falls under this scope. Qualification depends on the nature and origin of the data. A software provider or legal expert can help you determine what applies to your situation. Hosting on HDS-certified infrastructure remains a prudent choice for any tool that centralizes occupational health information.
Questions to ask regarding QHSE AI
- Is health data hosted on HDS-certified infrastructure ? Ask for the name of the hosting provider and their certificate.
- Does the AI process this data on the same infrastructure ? Secure hosting loses its value if the AI processing takes place elsewhere.
- Is the data used to train a model ? If so, what is the legal basis and how is the data anonymized ?
- What measures are in place to limit exposure ? Role-based access control, logging, encryption, and data retention periods.
- Is a Data Protection Impact Assessment (DPIA) available ? It is required for high-risk processing activities.
What Symalean does ?
Symalean's AI is developed by Symalean and hosted on HDS-certified servers. Data protection and GDPR compliance are built into its design. To learn more about the personal data challenges involved in using AI for prevention, download our white paper on AI, prevention, QHSE safety, and GDPR.
