Les DPO de la Santé

Outsourced DPO · Digital health compliance

Your digital health compliance experts

Turn your obligations into opportunities with our digital health compliance specialists. Healthcare DPO expertise, backed by the NELSE technology: executable, provable and replayable analyses.

Book my free intro callExplore our services
  • Certified DPO — Sciences Po Paris
  • Free initial discussion
  • Reply within one business day
  • 100% dedicated to healthcare

Our domains

01Compliance & GDPR02Outsourced DPO03Cybersecurity04Training05Artificial Intelligence06International
Our approach

Healthcare expertise, backed by a technology that computes

Our support relies on the tools developed by NELSE, a normative-engineering deeptech: the law is encoded there as deterministic rules, not entrusted to an AI that guesses. The DPO assesses, advises and documents their opinions; your organisation keeps its decisions. The technology makes these analyses executable, provable and replayable.

Executable

Your compliance is computed, not merely described.

You describe each processing activity with facts; the legal regime is derived by written, sourced rules (GDPR, CNIL frameworks, HDS, AI Act), with the grounds displayed. You understand what each analysis rests on.

Provable

Your files can be verified without taking our word for it.

The control file we hand over is designed to be examined by a third party — auditor, lawyer, supervisory body — who can check its integrity themselves. What has been modified can no longer be presented as validated.

Replayable

Same facts, same rules, same result.

Each qualification shows the rules triggered and their legal basis, and can be redone identically with the same facts and the same rules — in front of you as in front of an auditor. Successive versions of your facts are kept; a new analysis integrates what changed without erasing the previous one.

Determinism guarantees the reproducibility of the computation, not legal infallibility: the rules are sourced, opinions remain your DPO's, and decisions remain your organisation's.

Discover our software

The regulatory frameworks covered by our monitoring

  • GDPR
  • AI Act
  • EHDS
  • NIS2
  • DORA
  • HDS framework
  • CNIL recommendations
  • Medical confidentiality (French Public Health Code)
  • MDR / IVDR
  • ePrivacy
Projects brought into compliance
45
First reply, business days
< 24 h
Dedicated to the healthcare sector
100%
Areas of expertise
6
Who we serve

A response tailored to your reality, not a generic one

We speak the language of your profession and your constraints. Choose your profile — or the trigger that brings you here today.

Healthcare facilities

Hospitals, clinics and hospital groups: secure patient record processing and prepare for inspections with confidence.

Learn more

Health software vendors & SaaS

Software and EHR vendors: turn compliance into a commercial advantage with your hospital clients.

Learn more

Medtech & startups

Startups and medtechs: move fast without sacrificing compliance, from first prototype to fundraising.

Learn more

Healthcare professionals

Practitioners, group practices and health centres: uphold medical confidentiality and meet your obligations without giving up your evenings.

Learn more

A specific trigger?

“We are facing a CNIL inspection”

Immediate assistance and a proven method to approach the inspection with confidence.

“We are launching an AI in healthcare”

Ethics audit and compliance work on your algorithms (AI Act, GDPR).

“We need to be an HDS-certified host”

Scoping of the requirements and guidance towards HDS compliance.

“We have a data breach”

Emergency response: CNIL notification, informing individuals, documentation.

Our services

Six areas of expertise, compliance mastered end to end

From diagnostic to crisis management, we cover the entire life cycle of your health data.

GDPR compliance & data protection

From assessment to operational follow-up, we cover every aspect of your GDPR compliance to durably secure your health data processing.

Outsourced DPO subscription

Outsource your DPO function for continuous, serene and simplified compliance management, with tailored support and high-performing tools.

Advanced cybersecurity services

Strengthen the protection of your sensitive data: audits and technical measures delivered on a quote basis by our cybersecurity partner, under our compliance co-supervision.

Training & awareness

Prepare your teams for compliance and security challenges with our advanced training courses, including ethical AI.

Artificial Intelligence (AI) support

Align your AI systems with the AI Act, the GDPR and the applicable frameworks — without slowing down innovation.

International & data transfers

We help you navigate international regulations and secure your cross-border data transfers.

The DPO role

A DPO is much more than the GDPR

The GDPR creates the role: eight duties, defined in its Articles 38 and 39. But carrying them out in digital health draws on a far broader regulatory landscape — AI, cybersecurity, hosting, medical confidentiality. First the role, then its terrain.

The role — eight duties entrusted to the DPO

Inform & advise

Guide leadership and business teams on their obligations — GDPR, but also AI, cybersecurity and health data.

Monitor compliance

Audits, periodic reviews of processing activities, follow-up of action plans and gaps.

Steer DPIAs

Advise on data protection impact assessments, verify their execution and their updates.

CNIL point of contact

Contact point for the authority: requests, inspections, breach notifications.

Maintain documentation

Record of processing activities, breach register, demonstrable evidence of compliance.

Train the teams

Ongoing awareness of medical confidentiality, security and new regulations.

Oversee processors

Article 28 contracts (DPAs), safeguards, transfers outside the EU, the processing chain.

Handle incidents

Qualifying breaches, notifying the CNIL within 72 hours, informing individuals.

The terrain — where the DPO goes beyond the GDPR

All the digital health regulations, one single watch

Carrying out these eight duties in healthcare requires mastering far more than one regulation: our monitoring tracks every framework that applies — or will apply — to your activities, to anticipate their operational impact.

  • GDPR

    The foundation of data protection

  • AI Act

    AI systems in healthcare, often high-risk

  • EHDS

    The European Health Data Space

  • NIS2

    Cybersecurity of healthcare entities

  • DORA

    Digital resilience of the insurance sector

  • HDS

    Certification for health data hosting

  • French Public Health Code

    Medical confidentiality, care teams, telemedicine

  • French Data Protection Act

    The national framework, CNIL reference frameworks

  • CNIL reference methodologies

    Reference methodologies for research

  • MDR / IVDR

    Medical devices, including software

  • ePrivacy

    Cookies, direct marketing, communications

  • Data Act & DGA

    Data sharing and data altruism

We provide compliance and data protection consulting, within the scope of the DPO duties defined by the GDPR. Legal consultations, the drafting of legal instruments and litigation are the remit of independent lawyers, to whom we refer you whenever the situation requires.

Our conviction

Compliance is owned, not generated

Tools and artificial intelligence are transforming the profession — and we know them from the inside. Our conviction is simple: they augment the expert, they do not replace them.

Tools bring structure

Registers, workflows, dashboards: useful, but declarative. Our tools, built by NELSE, compute the legal regime from your facts, rules displayed. And software never takes on responsibility: the DPO advises, your organisation decides.

AI must itself be compliant

Applying generative AI to compliance raises questions of its own: probabilistic answers, uncertain traceability, sensitive data. A probability is not demonstrable evidence.

A human answers

The GDPR entrusts the role to a DPO: a human, independent, reachable function — a judgement accountable to the CNIL, patients and partners.

That is why our support relies on the tools built by NELSE, a normative-engineering deeptech: making the law executable, provable and replayable within systems — proof, not probability.

In the field

Three situations we encounter — and what they become

Anonymised cases, representative of our engagements: the starting situation, our intervention, the outcome for the organisation.

Coordinated-care organisation

From scattered compliance to quarterly governance

Situation. Coordination tools deployed project after project, documents produced at different times, no consolidated record — and no one to say who decides.

Intervention. Mapping of processing activities and data flows, rebuilding of the record, review of processors, screening for the DPIAs required, roadmap approved by leadership.

Outcome. A workable record, responsibilities in writing, a committee that meets every quarter — and every new project now goes through an identified consultation channel.

Digital health software vendor

A compliance file that accelerates hospital sales

Situation. Increasingly demanding buyer questionnaires — hosting, roles, processors, security — and answers scattered between sales, technical and legal teams.

Intervention. Mapping of the architecture, qualification of GDPR roles, review of processors and of the HDS scope, assembly of a reusable answer file.

Outcome. Consistent answers from one questionnaire to the next, a file that can be mobilised in days rather than weeks, and a compliance checkpoint built into the product cycle.

Healthcare facility

Patient record access rights that can finally be demonstrated

Situation. Access to the patient record that evolved with the organisation, without formal rules or regular reviews — a classic blind spot in inspections.

Intervention. Role mapping with leadership, IT and business teams, access analysis, definition of a review cycle, documentation of priority measures.

Outcome. A validated access-rights matrix, a periodic review process, tracked indicators — and evidence ready to be produced if an authority requests it.

Discuss a similar situation
Express diagnostic

Where does your compliance stand?

10 questions, 2 minutes. Assess your maturity level and leave with concrete avenues for action.

1/10

Have you appointed a Data Protection Officer (DPO)?

0 answer of 10

Turn your obligations into opportunities.

A free, no-commitment initial discussion to review your compliance and identify your priorities.

Book a meetingSee our offers and pricing

Reply within one business day · No commitment