Doctolib’s help center tells patients their conversations with its AI assistant “are encrypted end to end and hosted in France according to the strictest European standards (GDPR, HDS certification)”. Its July privacy policy says the stored data sits with Amazon Web Services and S3NS, a Thales company reselling Google Cloud, and that Microsoft (Azure), Google, and Anthropic, three US companies, supply the model behind the assistant on servers the policy places in the EU.[1][2] Doctolib says its patient assistant is “already used by 400,000 French people”.[3] On October 13th, 2026, it announced a planned minority investment from Nvidia and a plan to build “sovereign” models on open-weight and open-source models.[3][4]
None of this is a scandal. It maps what a French health platform can buy, and what it must build itself once the regulator’s boxes are ticked. Every box costs engineering time that doesn't go into the product. Doctolib does most of the hard engineering right. It slips in the words: one sentence to patients, one sentence in a press release. No published sanction or ruling finds Doctolib in breach of health-data or data-protection rules, and in 2021 a Conseil d’État judge refused to suspend its Covid vaccination bookings over its use of AWS.[5] Where those rules are unclear, they are unclear for everyone.
The hoops
Beyond informing patients, French law requires a health platform to have a host certified for health data (HDS), store data within the European Economic Area (a rule since September 26th, 2026), and sign a contract that lists the foreign laws that can reach the data.[6] It does not ask a private company for SecNumCloud, France’s cloud-security qualification, or for a host immune to US law. Those duties bind the State and the Health Data Hub for their most sensitive data.[6]
The boxes also move. The 2018 standard set no location rule, only disclosure of the countries and the client’s choice among them; the EEA rule arrived in the 2024 standard, then in law, in a version that calls its new transfer rules “a first step” and promises stronger European-sovereignty requirements “by 2027 at the latest”, with nothing yet saying what they will be. The data regulator, the CNIL, already recommends SecNumCloud “for the most sensitive databases”, while calling the risk “often acceptable” for countries with an adequacy decision, which the US has for companies certified under the EU-US Data Privacy Framework.[7] A platform built for today’s rules may need rebuilding for 2027’s. Spare a thought for the French and European teams building to this: certificates, transfer maps, and contract annexes, written for a target that keeps moving. The work still has to be done, and the people doing it have earned some patience.
What Doctolib gets right
Most of the boxes, ticked properly. Doctolib is certified in its own name for all six HDS activities, including the one AWS’s first certificate left to its customers. Its encryption keys sit with Atos in France, away from the hosts: in 2020 its chief executive, Stanislas Niox-Chateau, said: “there is no way for AWS to access the data”.[2][8] And it says the uncomfortable thing in plain words: AWS’s parent being American, “in specific cases, AWS may therefore be required to comply with the law or with a valid and binding order”, in which case “personal data may be accessed from outside the EEA, in particular from the United States”.[2] Compliance by confession, and legal. Using the assistant requires prior consent to the processing of health data under GDPR Article 9.[1]
The gap underneath
Why AWS at all? Because European clouds aren't the same product.I called it the Builder Tax in April: about 60 services at Scaleway, Iliad’s cloud, against more than 200 at each hyperscaler, as counted then. The missing ones get rebuilt in engineering time.[9]
Doctolib and four other French health-tech companies put a price on it. In a letter to the office of the minister for digital affairs, reported by L’Usine Digitale in July, they asked the government to state officially that SecNumCloud is not a general obligation for health establishments and their suppliers. Per the outlet, some managed services that health applications depend on do not exist on the qualified platforms, “the current SecNumCloud-qualified offers are not ready yet”, and a move could cost “20 to 50%” more and tie engineering teams up for several years on infrastructure instead of products.[10] A lobbying letter, and a fair one. The minister’s office answered, per the outlet, that SecNumCloud will not become a general obligation for health companies.[10]
If the State can get away with six years, why would you ask a scale-up to do it in one?
The State ran the same test on itself. Its Health Data Hub has run on Microsoft Azure from the start. Under oath before the Senate in June 2025, Microsoft France’s director of public and legal affairs was asked whether French citizens’ data entrusted to Microsoft through UGAP, the public purchasing agency, could be handed to US authorities without France’s consent: “No, I cannot guarantee it, but, again, it has never happened yet.”[11] Almost six years after the first court challenge, in June 2020, the State picked Scaleway to take over the Hub, in April 2026, a cloud not yet SecNumCloud-qualified.[11] If the State can get away with six years, why would you ask a scale-up to do it in one?
The gap is wider for models
Storage has European options with fewer features. For closed models, sold only as a service, every supplier Doctolib names is American, and their EU routes run through US clouds.[2][12][13] Open-weight models are different: whoever holds the weights decides where they run.
Anthropic is not on the French list of certified health-data hosts; Microsoft and Google are.[14] It is also not on the US list of companies certified under the EU-US Data Privacy Framework, where Microsoft, Google, and Amazon Web Services are; its data-processing terms for direct customers rely on the Commission’s standard contractual clauses instead.[15] Anthropic’s own API offers two settings for where a request is processed:global, the default, where “Inference may run in any available geography”, andus.[12] For Europe, it points customers to AWS, Google, and Microsoft, and on AWS’s Bedrock a request from Paris for Claude Opus 5.5 can be routed to any of six EU regions, with no Paris-only option. Bedrock can pin some older Claude models to a single EU region, Stockholm or Ireland, but none to Paris or Frankfurt; outside the EU, Opus 5.5 pins to London.[16] In Doctolib’s practitioner contract, “Google Ireland (Gemini)” lists servers in the “EU – United States”, the only model-supplier row in either Doctolib document whose server location includes the United States.[13] A Doctolib spokesperson told Next those rows cover features “such as the transcription and summary of medical consultations”.[17] The patient policy’s Azure row may not even mean an American model: Azure also serves models from Mistral AI, a French company, and Microsoft’s 2024 account put Doctolib’s consultation assistant on Azure OpenAI and on Mistral Large.[18]
Retention is the soft spot behind the denial. In June, Le Canard enchaîné wrote, per Next, in a story about practitioners’ consultation notes, that Doctolib was handing “its users’ information to American AI giants” to train their models. Doctolib denied it: “a strict contractual framework forbids them to retain or exploit the data for their own account”. The CNIL told the Canard, per Solutions Numériques, it could not rule on the legality.[17][19] Anthropic’s commercial terms back the training half: it “may not train models on Customer Content”.[20] Retention is the half that depends on the route, and the route is not published. Anthropic’s own API stores data in the US and deletes inputs and outputs “within 30 days” by default, unless agreed otherwise, for instance under a zero-retention agreement.
On Bedrock, AWS says model providers “don’t have access to Amazon Bedrock logs or to customer prompts and completions”. It keeps prompts and responses, “up to 30 days”, only for Claude Fable 5 and 5.1, where retention is required, and an account can enforce zero retention, under which nothing is “written to durable storage by AWS or shared with the model provider”; for Claude models, Anthropic decides who is eligible. Doctolib lists Anthropic’s servers in the EU, which Anthropic’s own API does not offer, so a cloud route is likely. Which cloud is not published, and the published contract with practitioners promises only “equivalent” protection from sub-processors.[13][20] Run through Bedrock’s EU profile with zero retention, the setup is defensible; nothing Doctolib publishes says that is how it runs.
Whether health-data law reaches a model supplier’s API remains unsettled. French law requires a certificate of anyone who digitally “hosts” health data collected in care on someone else’s behalf, and defines hosting by activities, including running infrastructure “used to process health data”; an exclusion for operations of short duration “covers only” data entry, formatting, and conversion to and from paper, per the health agency (ANS). The same agency says a certified host’s subcontractors need not be certified themselves, and Doctolib is certified for all six activities.[21] I found no ruling or guidance that says whether a model that reads a prompt and answers it is hosting. Doctolib’s February transfer map lists AWS and none of the three model suppliers.[22]
The AI Act reaches the assistant, on a delay. Doctolib is its provider in the Act’s sense; the developers of the general-purpose AI models underneath have had their own duties since August 2025. Since August 2026, people must be told they are talking to an AI; a feature called “Assistant IA” tells them in its name. The open question is classification. The Act lists “emergency healthcare patient triage systems” as high-risk. Doctolib’s terms say the assistant offers general guidance on “emergencies, medical consultation”, then say it “is not a medical device” and must not be used “to manage a medical emergency”. If a regulator reads that guidance as triage anyway, the high-risk duties apply from December 2nd, 2027, after the Digital Omnibus pushed them back from August 2026. None of it decides which company’s model reads the prompt, or where.[23]
Where it slips into theater
It cannot describe the step where a model supplied by a US company, on servers the policy places in the EU, reads a parent’s question about a sick child.
The help-center sentence is the mistake, and it is not a small one. Encryption in transit and at rest protects data on the wire and on disk; to answer, a model must process the text decrypted. Clubic raised it in June.[24] “Encrypted end to end and hosted in France” can describe the trip to Doctolib and the storage there. It cannot describe the step where a model supplied by a US company, on servers the policy places in the EU, reads a parent’s question about a sick child. The help center says nothing of that step, and the consent text Doctolib publishes does not name the model suppliers; the names sit in a policy annex. They arrived late. A help page last edited in December 2025 already described the assistant as in test, using “the information entered in your child’s Health profile”, while the privacy policy in force until April 2026 named no model supplier and did not mention the assistant.[1][2] Even “in France” is generous. The first page of Doctolib’s own July patient policy says patients’ personal data, health data included, are “hosted within the European Union”; its annex lists AWS’s servers in the “European Union”, and its practitioner contract puts the “primary cluster” in AWS’s Frankfurt region, a secondary one in Paris and a third system with S3NS in the Netherlands.[2][13] That help-center page is what patients read before they type, and it describes the easy part.
The press release does the same for everyone else. “Doctolib hosts all health data in the European Union and the UK [...] under its sole control. The same applies to its AI models.”[4] Read generously, “its AI models” means the ones Doctolib builds, since the sentence follows “Doctolib is developing its own AI models”. Its health data sits with AWS and S3NS, under a US-law exposure Doctolib itself discloses, and the July policy lists three US companies as suppliers of the patient assistant’s model.[2][4] “Sole control” is a claim about today, and today’s documents do not back it.
Doctolib supplies the word, Nvidia the chip
Running open-weight models itself closes the model gap, and Doctolib’s post to users says how: “We run our copies in our secure environments in Europe and train them on medical knowledge, without transmitting health data”, while a closed model “can only be used through the service of the company that owns it”.[3] That is the right fix, and a candid description of the setup it replaces. Doctolib already has the parts to build it. It is already a certified health-data host, its consultation assistant runs on a speech-recognition model “developed by its teams” (whether built from scratch or fine-tuned from an open model, and under what license, is not published), and its lab publishes open-weight French medical text encoders and classifiers, not chat models; one, DoctoModernBERT, is under Apache-2.0 and was trained on Jean Zay, a French public supercomputer run by IDRIS.[4][8][25] Nothing stops it from running a model under its control throughout: open weights, its own fine-tuning, on a certified host with no US parent if it picks one.
The three US suppliers are a choice. It may be a sound one, but the help center should say so. The plan is also partial by design: the same post says open-weight and open-source models mean Doctolib will “not depend exclusively” on the big general-purpose models.[3] The post does give one date: the assistant will be available to everyone in 2027.[3] The announcement does not give a date for the patient assistant to leave Azure, Google, and Anthropic, or the name of the cloud its own models will run on.[3][4]
The exit has the same shape as the gap. Running open-weight models yourself means renting or buying AI chips, and European clouds rent out chips Europe does not make: Scaleway’s GPU instance page lists only Nvidia chips, though it announced an AMD supercomputer in Sweden the same day as Doctolib’s news.[26] Doctolib “has been using NVIDIA technologies for a year”, per its release, and Jensen Huang told analysts in August: “I would say nearly all open models run on NVIDIA.”[4][27]
A builder that swaps a closed model’s API for an open-weight model it runs itself trades a US company processing its prompts for a US company selling it chips.
That is why a stake of a few million euros, per Le Figaro as reported by Next, is worth Nvidia’s time; Doctolib says it comes “without governance rights or a board seat”.[3][4] In the six months to July 26th, 2026, Nvidia paid $42.4 billion for equity securities (gross), what its 10-Q calls “investing in our ecosystem”, more than the $39.0 billion it paid for share buybacks.[28] Sovereign AI, neoclouds, start-ups and enterprises, Huang said, “represents about half of our business, and that’s growing 100% a year.”[29] A builder that swaps a closed model’s API for an open-weight model it runs itself trades a US company processing its prompts for a US company selling it chips. Doctolib calls the models “sovereign”. Nvidia is paid either way.
Four things would change this verdict. Doctolib publishes EU-only processing and zero-retention terms for all three suppliers. Or it shows that text is pseudonymized before it reaches them. Or the patient assistant already runs on models Doctolib runs itself, and the policy rows are stale. Or the models it builds on open weights run on Amazon’s Trainium, Google’s TPUs, or AMD GPUs, and Nvidia invested in a customer it didn’t keep.
Until then, anyone building or buying a health AI product in Europe needs four answers: where the data is stored, who can compel the host, which company’s model reads the prompt, and how long the prompt is kept. Doctolib answers the first two publicly, the third by naming three suppliers in an annex, and the fourth through a spokesperson. Answers that hold up live in privacy policies, contract annexes, and system configurations, not in speeches, press releases, social media posts, or a spokesperson’s word.
On sovereignty, the gap between what gets announced and what gets deployed can be wide, and there is no substitute for deep engineering work to close it. Nvidia only cares about a fifth question: what does it run on? Jensen’s cash is a bet that the answer is Nvidia.
Notes
French quotations are translated in the text; the originals are in these notes.
[1] Doctolib patient help center,“Poser une question à l’Assistant IA”, section “Mes échanges avec l’Assistant IA sont-ils protégés ?”, “Dernière modification le 21 juillet 2026”, read through the Zendesk API October 14th, 2026: “Vos conversations avec l’Assistant IA, tout comme vos données de santé, restent strictement privées et sécurisées. Elles sont chiffrées de bout en bout et hébergées en France selon les normes européennes les plus strictes (RGPD, certification HDS)”; “Si vous utilisez l’Assistant IA pour la première fois, vous devez consentir au traitement de vos données de santé et de celles de vos proches pour pouvoir l’utiliser”; “nos équipes peuvent analyser certaines conversations. Ces analyses sont toujours réalisées sur des données strictement anonymisées”. Text unchanged on October 15th, 2026 (section opened by its own toggle; screenshot kept on file); archived the same day by the Wayback Machine through the help center’s API,web.archive.org/web/20261015070005, “edited_at” July 21st, 2026.“Activer l’Assistant IA”, created March 13th, 2026: “Pour fonctionner et contextualiser ses réponses, l’Assistant IA s’appuie sur vos données de santé et celles de vos proches”; consent is collected “conformément à l’article 9” of the GDPR. Nothing read shows the model supplier’s name at consent. The assistant is offered to parents of children up to four (note 23).
[2] Doctolib,patient privacy policy, “Version : July 2026”, French, accessed October 14th, 2026, re-read October 15th, page 1: “Les Données à caractère personnel (y compris de santé) des Patients et des Professionnels de santé qui utilisent les services Doctolib sont hébergées au sein de l’Union européenne par un hébergeur agréé”; Annexe 1, columns sub-processor, provider’s country of origin, server location, service, task: “Microsoft Azure | États-Unis | UE | Assistants Santé | Met à disposition le modèle d’IA pour l’Assistant Santé”, and the same row for “Google” and for “Anthropic”; messages with the assistant kept “2 ans”, and “3 ans” for research and AI training. The rows are absent from theJuly 2024andApril 2025versions and present in theApril 2026version; the February 2026 version (”Version : Février 2026”,PDF), live until April per archived redirects of doctolib.legal, mentions neither the assistant nor any AI-model provider (Microsoft Azure and Google appear in other roles). The help-center page “Comprendre ce qu’est l’Assistant Parents”, “Dernière modification le 2 décembre 2025”, as archived by theWayback Machine on February 27th, 2026: “Doctolib Parents est actuellement en phase de test, il est possible que vous n’en bénéficiez pas encore”; the assistant “utilise aussi les informations inscrites dans le profil Santé de votre enfant”; “une équipe de soignants dédiée est chargée de relire 100% des réponses obtenues”. In the practitioner contract (note 13), Anthropic and Gemini first appear in the version uploaded December 4th, 2025. On AWS: “Doctolib a recours à Amazon Web Services en tant qu’Hébergeur de Données de santé”; “La société mère d’AWS est établie aux États-Unis. Dans des cas spécifiques, AWS peut donc être tenue de se conformer à la loi ou à une injonction valide et contraignante d’une autorité gouvernementale (USA Patriot Act, FISA Section 702, Cloud Act, EO 12333), auquel cas des données à caractère personnel peuvent être consultées depuis l’extérieur de l’EEE, en particulier depuis les États-Unis”; “Atos | France | France | Hébergement de la clé de chiffrement de Doctolib”; and a second host, “S3NS | États-Unis - France | France | Hébergement des données des services Doctolib”; perL’Usine Digitale, July 2026, Doctolib uses S3NS but “utilise la plateforme Google Cloud standard et pas l’offre PREMI3NS garantie SecNumCloud”; the practitioner contract (note 13, § 11.1) describes S3NS as a company “dont les services reposent sur l’infrastructure Google Cloud Platform (GCP) certifiée HDS, dont elle est revendeur agréé”. The July policy’s AWS row: “AWS EMEA | Maison mère : États-Unis | Entité contractante : Irlande | Union européenne (UE) | Hébergement des données de Services Doctolib”. No public case of compelled access to Doctolib data is known.
[3] Doctolib community,“NVIDIA rejoint Doctolib pour accélérer l’IA en santé en Europe”, October 13th, 2026, Doctolib staff, read as raw JSON October 14th, 2026: “un assistant IA personnel pour les patients [...] Déjà utilisé par 400 000 français, il sera disponible pour tous en 2027”; “Nous faisons tourner nos copies dans nos environnements sécurisés en Europe et nous les entraînons sur des connaissances médicales, sans transmettre les données de santé. Un modèle fermé, à l’inverse, ne s’utilise qu’à travers le service de l’entreprise qui le possède.” Same post: “NVIDIA entre au capital de Doctolib avec une participation minoritaire, sans droit de gouvernance ni siège au conseil d’administration”; open models are “un choix qui garantit notre indépendance et nous permet de ne pas dépendre exclusivement des grands modèles d’IA généralistes”. The patient assistant is offered today through Doctolib Parents: help center,“Découvrir Doctolib Parents”, edited July 21st, 2026, “Un Assistant IA, sous forme d’un chat basé sur l’intelligence artificielle”.
[4] Doctolib,“Doctolib accelerates in healthcare AI with a new planned investment from NVIDIA”, Paris, October 13th, 2026, read in a browser October 14th, 2026: section heading “Strengthening Doctolib’s sovereign AI models in healthcare”; “In the coming months, Doctolib will accelerate the development of AI models based on open models (open-weight and open-source) and invest even more in its European infrastructure”; “Doctolib hosts all health data in the European Union and the UK, in line with each country’s hosting requirements and under its sole control. The same applies to its AI models”; “Doctolib is developing its own AI models to the highest standard of medical accuracy”; “Doctolib has been using NVIDIA technologies for a year”. No amount, stake size or compute commitment.Next, October 13th, 2026: “D’après le Figaro, la prise de participation de NVIDIA se ferait à hauteur de quelques millions d’euros”; Le Figaro’s article itself was not read. Nvidia’sFrance post, October 12th, 2026, lists “new planned investments in Doctolib, Entalpic, Genesis AI and Pigment”.
[5] Conseil d’État,ordonnance du 12 mars 2021, n° 450163, urgent-applications judge: “il n’apparaît pas, en l’état de l’instruction, que la décision du ministre des solidarités et de la santé de confier à la société Doctolib, parmi d’autres voies possibles de réservation de rendez-vous, la gestion de rendez-vous de vaccination contre la Covid-19 porte une atteinte grave et manifestement illégale au droit au respect de la vie privée et au droit à la protection des données personnelles”; “Article 1er : La requête de l’association InterHop et autres est rejetée.” The judge ruled “en l’état de l’instruction”, on an urgent application, not on the merits. Web searches on October 15th, 2026 for CNIL sanctions, formal notices and court decisions against Doctolib under data-protection law found none; cnil.fr was down that day. The CNIL’slist of sanctions, read in its Wayback copy of October 1st, 2026, names most sanctioned bodies by type only; no entry from 2011 to 2026 describes an online appointment-booking or teleconsultation platform. The scope is health-data and data-protection rules only.
[6] French law,Code de la santé publique, L.1111-8, as amended by loi n° 2024-449 du 21 mai 2024, art. 32: the host “est titulaire d’un certificat de conformité”.Décret n° 2026-209 du 24 mars 2026, articles R.1111-9-1 and R.1111-11, in force September 26th, 2026: storage “exclusivement sur le territoire d’un Etat membre de l’Union européenne ou partie à l’accord sur l’Espace économique européen”; the contract lists “la liste des réglementations extra-européennes” and “la description des risques résiduels”. The HDS certification standard v2.0 (arrêté du 26 avril 2024), requirements 28 to 31, makes SecNumCloud a disclosed option, not a requirement. SecNumCloud for sensitive data binds “les administrations de l’Etat, ses opérateurs [...] ainsi que les groupements d’intérêt public”, which includes the Health Data Hub, a groupement d’intérêt public:loi n° 2024-449, art. 31. All accessed October 14th, 2026.
[7] The HDS certification standard v1.1, May 2018, § 4.4.7.1: “L’hébergeur doit spécifier la liste de l’ensemble des pays au sein desquels les données du client sont ou peuvent être hébergées”; v2.0, requirement 28: storage “exclusivement au sein de l’Espace Economique Européen”, and, in its introduction, “il s’agit d’une première étape : des exigences renforcées en termes de souveraineté européenne seront ajoutées au plus tard en 2027, en cohérence avec les futurs référentiels européens (EUCS)”. Copies:v1.1, hosted by the certifier BSI, and v2.0 from the ANSpage of the certification standards, both downloaded October 14th, 2026. The Commission’sCloud and AI Development Act proposal, COM(2026) 502 final, June 3rd, 2026, says EUCS “has not yet been adopted”. CNIL,délibération n° 2025-014 du 13 février 2025: “Si ce risque est souvent acceptable, notamment s’agissant de pays adéquats, la CNIL recommande, pour les bases de données les plus sensibles, d’assurer une protection contre les possibilités de divulgation à des autorités publiques de pays tiers”. The US decision,Commission Implementing Decision (EU) 2023/1795of July 10th, 2023, Article 1, read October 15th, 2026: the United States “ensures an adequate level of protection for personal data transferred from the Union to organisations in the United States that are included in the ‘Data Privacy Framework List’”.
[8] The ANSlist of certified hosts, read October 14th, 2026: “DOCTOLIB SAS 1, 2, 3, 4, 5, 6, sur version V2.0” and “AMAZON WEB SERVICES INC 1, 2, 3, 4, 5, 6, sur version V2.0”. AWS’s first certificate, in 2019, left out “l’administration et l’exploitation du système d’information contenant les données de santé” (Le Monde Informatique, March 15th, 2019); AWS’s v2 certificate of April 21st, 2026 covers all six. AFP interview, published byFrenchWeb on June 19th, 2020, accessed October 14th, 2026: “Les données sont principalement hébergées par Amazon Web Services à Paris. Mais AWS ne peut pas avoir accès aux données parce qu’elles sont chiffrées. Et la clef de chiffrement est chez un autre hébergeur qui est un hébergeur français, donc il n’y a aucun moyen pour AWS d’accéder aux données.” Niox-Chateau is “co-founder & CEO of Doctolib” in the October 13th, 2026 release (note 4).
[9] AI Realist,“More Sovereign, Different Stack: The Builder Tax”, April 29th, 2026, re-read October 14th, 2026: “Scaleway publishes approximately 60 distinct services; StackIT publishes 42”; “The hyperscalers publish more than 200 each.” Counts from April 2026, not re-measured.
[10] Alice Vitard,L’Usine Digitale, “Publié le 3 juillet 2026”, read in a browser October 14th, 2026: “Doctolib, Alan, Implicity, Lifen et Resilience Care”, a letter to the cabinet of Anne Le Hénanff, asking it to clarify “officiellement”; “des surcoûts pouvant atteindre 20 à 50%”; replacing “certains de ces services lorsqu’ils n’existent pas sur les plateformes qualifiées”; “Les entreprises redoutent surtout que leurs équipes d’ingénierie soient mobilisées pendant plusieurs années sur des projets d’infrastructure plutôt que sur le développement de nouveaux produits”; “les offres actuelles qualifiées SecNumCloud ne sont pas encore prêtes”. That SecNumCloud “ne deviendra pas une obligation générale pour les acteurs de la santé” is the outlet’s paraphrase of the cabinet. The letter itself was not found.
[11] Sénat,commission d’enquête sur la commande publique, June 10th, 2025, Anton Carniaux, director of public and legal affairs of Microsoft France, under oath, asked about data entrusted to Microsoft through the public purchasing agency UGAP: “Non, je ne peux pas le garantir, mais, encore une fois, cela ne s’est encore jamais produit.” Conseil d’État,ordonnance du 19 juin 2020, n° 440916, the first challenge to the Hub’s hosting: Microsoft, “avec laquelle un contrat de sous-traitance a été conclu dans ce but à la fin de l’année 2019”; theordonnance du 13 octobre 2020, n° 444937, gives the contract as signed April 15th, 2020. Scaleway,“Scaleway sélectionné pour accompagner la Plateforme des données de santé vers un cloud souverain”, “Paris, 23 avril 2026”; Scaleway “a également démontré la crédibilité de sa trajectoire de qualification SecNumCloud”. DINUM,June 8th, 2026: support “jusqu’à la sélection de Scaleway”. ANSSI’scatalog, updated September 15th, 2026, lists no Scaleway service as SecNumCloud-qualified. All accessed October 14th, 2026.
[12] Anthropic,“Data residency”, read October 14th, 2026:inference_geo“global”, “Default. Inference may run in any available geography for optimal performance and availability”, or “us”. Anthropic,regional compliance: “For Europe, you can select country-specific deployment options through AWS Bedrock, GCP Vertex, and Microsoft Foundry”. Which route and which model Doctolib uses is not published.
[13] Doctolib,practitioner data processing agreement, “Date de publication : Juillet 2026”, read October 14th, 2026; theFebruary 2026 PDFhas the same rows: “Anthropic | Etats-Unis | UE | Fourniture du modèle de LLM | Analyse et création de contenu à des fins d’automatisation de tâches”; “Google Ireland (Gemini) | Etats-Unis | UE – Etats-Unis | Fourniture du modèle de LLM | Analyse et création de contenu à des fins d’automatisation de tâches”. Also: “chiffrement de bout en bout pour les communications vidéo et audio (en transit uniquement)”; “Doctolib exploite deux stockages de données : un cluster principal situé dans la région AWS de Francfort et un cluster secondaire dans la région AWS de Paris, complété par un troisième système opéré par S3NS aux Pays-Bas”; Doctolib “inclura dans le contrat entre Doctolib et chaque Sous-traitant ultérieur des clauses offrant un niveau de protection équivalent”. § 11.1 names AWS, S3NS and GCP as certified health-data hosts. The contract covers the practitioner service. Google,data residency, read October 14th, 2026: “The European Union multi-region (eu) endpoint strictly covers data residency within EU member states”, so an EU-only Gemini route exists; the “UE – Etats-Unis” row is Doctolib’s configuration.
[14] ANS list (note 8): no Anthropic entity; “MICROSOFT CORPORATION” for activities 1 to 6 and “GOOGLE LLC GCP” for activities 1 to 5. Whether the model services Doctolib uses are in their certificates’ scope was not established; Google’sHDS pagelists “Generative AI on Vertex AI” in scope and says “Activities 3, 4, and 5 cover health data processing, which may be supported by global locations as long as storage at rest remains within the EEA”.
[15] US Department of Commerce,Data Privacy Framework List, searched October 15th, 2026: “Microsoft Corporation”, “Google LLC” and “Amazon.com, Inc.”, each with status “Active” under the “EU-U.S. Data Privacy Framework”, with “Amazon Web Services, Inc.” among Amazon’s covered entities; “Anthropic”: “Query returned no results”, active and inactive participants alike. Anthropic,data processing addendum, read October 15th, 2026: “the terms of the SCCs Module Two (controller to processor) and/or Module Three (processor to processor), as completed as described in Schedule 3 of this DPA, are hereby incorporated by reference”; Anthropic will provide information “reasonably necessary for Customer to complete a transfer impact assessment”. Standard contractual clauses are a lawful transfer tool; they put the risk assessment on the exporter rather than on an adequacy finding.
[16] AWS,Bedrock model card, Claude Opus 5.5, read October 14th, 2026: in-Region inference for eu-west-3 (Paris) “not-supported”; geo inference ID “eu.anthropic.claude-opus-5-5”, source eu-west-3 (Paris), destinations “eu-central-1 (Frankfurt), eu-north-1 (Stockholm), eu-south-1 (Milan), eu-south-2 (Spain), eu-west-1 (Ireland), eu-west-3 (Paris)”. Model cards for twelve Claude models, read October 15th, 2026: “In-Region keeps requests within a single Region for strict compliance”; In-Region “supported” in an EU member state only forClaude Sonnet 5andClaude Haiku 4.5, in eu-north-1 (Stockholm) and eu-west-1 (Ireland); eu-west-3 (Paris) and eu-central-1 (Frankfurt) “not-supported” on every card. Opus 5.5 is supported In-Region in eu-west-2 (London), outside the EU.
[17] Next,“Doctolib réfute livrer les infos de ses utilisateurs aux grands acteurs de l’IA”, June 4th, 2026: “Le Canard enchaîné a révélé dans son édition du 2 juin 2026 que Doctolib livrait « les infos de ses utilisateurs à des géants américains de l’IA » et que ces données servaient l’entraînement des grands modèles de langage d’acteurs tels que Microsoft, Anthropic ou Google. Contactée par Next, l’entreprise dément fermement ces allégations”; a spokesperson: the two labels “désignent concrètement l’utilisation de leurs modèles pour faire fonctionner des fonctionnalités produit, comme la transcription et la synthèse des consultations médicales, ou l’automatisation de certaines tâches internes”. The Canard’s article itself was not read. The October 13th release says the consultation assistant “runs on a speech recognition model developed by its teams” (note 4); that covers transcription, not the summary.
[18] Microsoft,Doctolib customer story, dated December 3rd, 2024, vendor-published: “integrating both Azure OpenAI Service and Mistral Large on Azure”. No region or deployment type is given. Microsoft’s“Deployment types”, read October 14th, 2026: on Data Zone types, “European Union: The service processes data within the Azure EU Data Boundary”; on Global types, “the service can process prompts and responses in any geography where the model is deployed.”
[19] Solutions Numériques,“Doctolib, données médicales et IA américaine : la plateforme répond”, June 4th, 2026: “Interrogée, la CNIL a indiqué au journal ne pas être “en mesure de se prononcer sur la légalité” du dispositif”; Doctolib: “Un cadre contractuel strict leur interdit de conserver ou d’exploiter les données pour leur propre compte, et en particulier d’en nourrir leurs propres modèles. Les notes de consultation n’entraînent pas leurs modèles d’IA.”
[20] Anthropic Privacy Center,“How long do you store my organization’s data?”, dated July 1st, 2026, read October 14th, 2026: “For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation, except: [...] When you and we have agreed otherwise (e.g. zero data retention agreement)”; “We retain inputs and outputs for up to 2 years and trust and safety classification scores for up to 7 years if your chat is flagged by our automated trust and safety systems as violating our Usage Policy”. These terms cover Anthropic’s own API; the zero-retention exception applies to the 30-day rule. Anthropic,Commercial Terms of Service, read October 14th, 2026: “Anthropic may not train models on Customer Content from Services.” On Anthropic’s own API, “Workspace geo: Only “us” is currently available” (note 12). AWS,Bedrock data protection, read October 14th, 2026: “Because the model providers don’t have access to those accounts, they don’t have access to Amazon Bedrock logs or to customer prompts and completions.” Google’s and Microsoft’s terms for Doctolib’s deployments were not read. AWS,Bedrock abuse detection, read October 15th, 2026: “For Anthropic Claude Fable 5 and Claude Fable 5.1, all traffic will be retained for up to 30 days for automated offline abuse detection”; “Retained inputs and outputs are stored and processed by AWS and are not shared with third-party model providers”. AWS,Bedrock data retention, same day: mode none, “Zero data retention. No request or response data is written to durable storage by AWS or shared with the model provider”; “ZDR eligibility for Claude models is managed by Anthropic”; “There is no data retention change to Claude models released before Claude Fable 5.”
[21] French law,Code de la santé publique, L.1111-8, read October 14th, 2026: “Toute personne qui héberge des données de santé à caractère personnel recueillies à l’occasion d’activités de prévention, de diagnostic, de soins ou de suivi social et médico-social [...] réalise cet hébergement dans les conditions prévues au présent article”. R.1111-9, quoted in theHDS certification standard v2.0, § 3.1.4: “3° La mise à disposition et le maintien en condition opérationnelle de l’infrastructure virtuelle du système d’information utilisé pour le traitement des données de santé”. ANS,HDS FAQ, entry “Date de mise à jour : 22 Sep. 2026”: “Cette exclusion couvre uniquement les activités suivantes citées dans le décret : « le traitement de saisie, de mise en forme, de matérialisation ou de dématérialisation de ces données »”. ANS,SantExpo workshop, May 20th, 2026: “Chaque acteur identifié doit être certifié pour la(es) activité(s) qu’il réalise”. Same FAQ, “Je suis un hébergeur. Mes sous-traitants doivent-ils être certifiés ?”: “Non, ce n’est pas une obligation. Toutefois, il est recommandé de faire appel à des sous traitants certifiés sur le périmètre qui leur est confié.” The exclusion in R.1111-8-8 applies to operations carried out for a short period. No ANS, CNIL or court decision applying HDS to a model provider was found.
[22] Doctolib,HDS transfer map, “Représentation des garanties”, “Version : Février 2026”, accessed October 14th, 2026: one sub-processor, AWS (Amazon Web Services EMEA), HDS “Oui”, SecNumCloud 3.2 “Non”, “Potentiel accès imposé par la législation des Etats Unis”.
[23] Doctolib,Conditions générales d’utilisation et d’abonnement aux Services Compagnons de santé, version April 2026, § 3.1.4: the assistant gives “des orientations médicale générale (urgences, consultation médicale, etc.)”; “Il est expressément rappelé à l’Utilisateur que l’Assistant Santé n’est pas un dispositif médical.” Same section: the assistant “ne doit pas être utilisé dans les situations suivantes”, among them “Pour gérer une situation d’urgence médicale” (choking, respiratory arrest, loss of consciousness, severe dehydration). § 3.2: it “est conçu pour accompagner les parents d’enfants de 0 à 4 ans, nés à terme et sans pathologie particulière”.Regulation (EU) 2024/1689, the AI Act, read October 14th, 2026: Article 50(1), people must be “informed that they are interacting with an AI system, unless this is obvious”; Annex III, point 5(d), high-risk includes “emergency healthcare patient triage systems”; Article 113, the Regulation “shall apply from 2 August 2026”, and “Chapter III Section 4, Chapter V, Chapter VII and Chapter XII and Article 78 shall apply from 2 August 2025” (Chapter V covers general-purpose AI models).Regulation (EU) 2026/1744of July 8th, 2026, the Digital Omnibus on AI: Chapter III, Sections 1 to 3, “shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III”, replacing “their initial date of application, namely 2 August 2026”. The assistant’s name in the app is “Assistant IA” (note 1). Article 3(3): “’provider’ means a natural or legal person [...] that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark”; the Act calls the model developers providers of general-purpose AI models (Chapter V).
[24] Alexandre Boero,Clubic, “Vos données médicales chez Doctolib transmises aux géants américains ? Ce que disent les documents officiels”, “Publié le 04 juin 2026”: on the April 2026 policy, Google, Microsoft Azure and Anthropic « mettent à disposition le modèle d’IA pour l’Assistant Santé »; “les données en transit chez Google, Microsoft ou Anthropic, le temps d’être traitées par leurs IA, sont elles supposément lisibles”.
[25] Doctolib Lab,DoctoModernBERT-fr-large model card, Apache-2.0, accessed October 14th, 2026: “pretrained on public web, PDF, and encyclopedic medical text”; “This work was granted access to the HPC resources of IDRIS (Jean Zay)”. Doctolib Lab’s other published models (Hugging Face API, October 14th, 2026) are French medical encoders and classifiers (doctobert-fr-base, finemed-entity-extractor-fr and others), not generative chat models. The speech model: release, note 4, “runs on a speech recognition model developed by its teams”; the community post (note 3) says “développé en interne”. Neither gives a license, a base model or published weights, and no speech model is among Doctolib Lab’s Hugging Face models.
[26] Scaleway,GPU instances, accessed October 14th, 2026: B300-SXM, H100-SXM, H100 PCIe, L4, L40S, all Nvidia. Scaleway,“Scaleway expands AI infrastructure in Europe with new AMD Instinct GPU-based supercomputer in Sweden”, October 13th, 2026.
[27] Nvidia,Q2 FY2027 earnings call, August 26th, 2026, FactSet corrected transcript, Jensen Huang: “I would say nearly all open models run on NVIDIA. And the reason for that is because NVIDIA’s footprint around the world is the highest.”
[28] Nvidia,Form 10-Q for the quarter ended July 26th, 2026, cash flows, six months, $ millions: “Purchases of equity securities (42,404)”; “Payments related to repurchases of common stock (39,044)”; the same filing gives shares repurchased “for [...] $39.8 billion” in the half, which includes repurchases not yet paid; “Net cash provided by operating activities 74,421”. The equity figure is gross purchases, before any sales. Same filing: “We expect to continue investing in our ecosystem.”
[29] Q2 FY2027 call (note 27), Colette Kress: “Q2 data center revenue increased 18% quarter-over-quarter to $89 billion [...] Hyperscale revenue of $49 billion grew 13% sequentially”; Jensen Huang: “There’s sovereign AI, there’re regional AIs, there’re neoclouds, there’re AI start-ups, there’re enterprises, where we’re seeing – which represents about half of our business, and that’s growing 100% a year.” Amazon’s own chips are Trainium, Google’s are TPUs.