Health Data — Sovereignty & Data Residency

Data location

All health data hosted by ANA Healthcare is stored exclusively in France (AWS eu-west-3, Paris).

International transfers

No personal health data is transferred to a country outside the European Economic Area.

No remote access to personal health data is authorized from a country outside the European Economic Area for ANA Cohort HDS operations.

Infrastructure subprocessor

ANA Healthcare uses Amazon Web Services (AWS) as its infrastructure subprocessor. AWS is HDS-certified for the applicable infrastructure activities and subject to the US CLOUD Act (18 U.S.C. § 2713).

Mitigation measures

• •Encryption at rest (AES-256) with keys managed by ANA Healthcare
• •Encryption in transit (TLS 1.2+)
• •Exclusive storage in France (eu-west-3)
• •Data processing agreement compliant with GDPR Article 28
• •AWS contractual guarantees and commitment to challenge access requests that do not comply with applicable law
• •Client notification within 24h in case of access request

Residual risks

A theoretical risk remains that a US authority could obtain access to data via the CLOUD Act. The probability is considered very low given the technical and legal protections in place. No known case of CLOUD Act enforcement on French health data to date.

This page is ANA Healthcare’s public information page for sovereignty, potential transfers, and unauthorized access risks under the HDS v2 certification framework.

HDS Certification

ANA Healthcare is preparing for HDS v2 certification for ANA Cohort. The target scope covers the HDS activities applicable to the service, including activities 1 to 5. Backups required for service continuity are treated as an intrinsic component of the hosted service and not as a standalone outsourced backup activity.