Health Data — Sovereignty & Data Residency

Data location

All health data hosted by ANA Healthcare is stored exclusively in France (AWS eu-west-3, Paris).

International transfers

No personal health data is transferred to a country outside the European Economic Area.

No remote access to personal health data is authorized from a country outside the European Economic Area for ANA Cohort HDS operations.

Infrastructure subprocessor

ANA Healthcare uses Amazon Web Services (AWS) as its infrastructure subprocessor. AWS is HDS-certified for the applicable infrastructure activities and subject to the US CLOUD Act (18 U.S.C. § 2713).

Mitigation measures

• •Encryption at rest (AES-256) with keys managed by ANA Healthcare
• •Encryption in transit (TLS 1.2+)
• •Exclusive storage in France (eu-west-3)
• •Data processing agreement compliant with GDPR Article 28
• •AWS contractual guarantees and commitment to challenge access requests that do not comply with applicable law
• •Customers are informed within 24 hours of ANA Healthcare becoming aware of an access request, subject to applicable legal restrictions.

Residual risks

Using AWS entails a residual risk of access to data compelled by a US authority, notably under the CLOUD Act. The technical and contractual safeguards in place reduce this risk but cannot eliminate it entirely.

This page presents ANA Healthcare’s information on health data location, potential transfers and risks of unauthorised access under the HDS v2 framework.

HDS Certification

ANA Healthcare is preparing for HDS v2 certification for ANA Cohort. AWS acts as an infrastructure subcontractor within its own HDS certification scope. AWS’s certification does not replace ANA Healthcare’s certification.