Health Data Hosting (HDS) and Zoho Creator
Who is this for?
This document is relevant to you if your account is in the EU datacenter and you use Zoho Creator to process or host personal health data governed by French law. It applies to any person or organization that hosts personal health data collected in the course of prevention, diagnosis, care, or social/medico-social follow-up on behalf of another party (e.g., a healthcare provider, healthcare organization, or the patient themselves).
Overview
At Zoho Creator, we recognize the importance of Hébergeur de Données de Santé (HDS) certification for organizations hosting personal health data governed by French law. Issued under the French Public Health Code, the HDS certification establishes stringent security and operational requirements for hosting health data and enables healthcare organisations and service providers in France to entrust their data to certified hosting providers.
Zoho Creator is now HDS v2.0 certified for the applicable hosting activities. Our certification has been issued by an independent certification body accredited by COFRAC (Comité Français d'Accréditation), and Zoho Creator is listed on the official ANS register of HDS-certified hosting providers.
By achieving HDS certification, Zoho Creator demonstrates compliance with the security, privacy, operational, and business continuity requirements applicable to hosting personal health data under French law. The certification provides customers with confidence that the platform implements the necessary controls for securely hosting and managing regulated health data.
Note:
1. Zoho Creator's HDS certification applies only to the EU data center. While setting up your account, ensure you select a country in the European region.
2. If you are an existing customer on a non-EU data center and require HDS compliance, you can request an account migration to the EU data center by contacting Zoho Creator support.
Quick links
- Representation of Guarantees
- ANS register of HDS-certified hosting providers
- HDS Addendum request form
Scope of certification
The HDS framework defines six hosting activities for which a provider can be certified. Zoho Creator's certification covers 5 of the 6 applicable activities, namely:
- Provision and maintenance in operational condition of physical sites for hosting the hardware infrastructure of the information system used to process health data.
- Provision and maintenance in operational condition of the hardware infrastructure of the information system used to process health data.
- Provision and maintenance in operational condition of the virtual infrastructure of the information system used to process health data.
- Provision and maintenance in operational condition of the platform for hosting information system applications.
- Administration and operation of the information system containing the health data.
Note on Activity 6 (Backup of health data): Zoho Creator does not offer backup as a separate, stand-alone service. However, backup is included by default as part of the platform. On Zoho's end, incremental backups are run every day and encrypted using AES-256 and retained for three months. For their part, customers can take one-time or schedule regular backups from within Zoho Creator.
Representation of Guarantees
To provide transparency about the scope of services covered by our HDS certification, Zoho Creator has published a Representation of Guarantees document. This describes the hosting activities and services in scope, along with the applicable security and contractual commitments.
Contractual requirements
If you process or host personal health data governed by French law using Zoho Creator, an HDS Addendum must be executed in addition to the Zoho Creator Terms of Use.
You can request the HDS Addendum by completing the designated request form. Upon receiving your request, Zoho will provide the HDS Addendum for review and signature.
Frequently asked questions
What is HDS certification?
HDS (Hébergeur de Données de Santé) is France's mandatory certification for service providers that host personal health data generated during the delivery of healthcare. It was introduced under the French Public Health Code (Article L.1111-8) and is governed by the Agence du Numérique en Santé (ANS).
HDS (Hébergeur de Données de Santé) is France's mandatory certification for service providers that host personal health data generated during the delivery of healthcare. It was introduced under the French Public Health Code (Article L.1111-8) and is governed by the Agence du Numérique en Santé (ANS).
What is HDS v2.0 and how does it differ from v1.1?
HDS v2.0 is the updated framework published in May 2024. Key changes from v1.1 include mandatory data storage within the European Economic Area (EEA), enhanced transparency requirements for international data transfers, alignment with ISO 27001:2022 for information security management, and strengthened data sovereignty obligations.
HDS v2.0 is the updated framework published in May 2024. Key changes from v1.1 include mandatory data storage within the European Economic Area (EEA), enhanced transparency requirements for international data transfers, alignment with ISO 27001:2022 for information security management, and strengthened data sovereignty obligations.
Does Zoho Creator's HDS certification apply to all data centers?
No. Zoho Creator's HDS v2.0 certification is scoped to the EU data center only. To host personal health data under HDS, you must select a country in the European region when configuring your Zoho Creator environment. Data hosted outside the EU data center is not covered by this certification.
No. Zoho Creator's HDS v2.0 certification is scoped to the EU data center only. To host personal health data under HDS, you must select a country in the European region when configuring your Zoho Creator environment. Data hosted outside the EU data center is not covered by this certification.
What types of data does HDS apply to?
HDS applies to personal health data (données de santé à caractère personnel) produced in the context of healthcare delivery in France, as defined by Article L.1111-8 of the French Public Health Code. This includes data that identifies an individual and relates to their health status or care. Not all health-related data falls in scope. If you are unsure whether your data is covered, please consult your legal or compliance team.
HDS applies to personal health data (données de santé à caractère personnel) produced in the context of healthcare delivery in France, as defined by Article L.1111-8 of the French Public Health Code. This includes data that identifies an individual and relates to their health status or care. Not all health-related data falls in scope. If you are unsure whether your data is covered, please consult your legal or compliance team.
Do I need to sign the HDS Addendum?
Yes, if you process or host personal health data governed by French law using Zoho Creator, executing the HDS Addendum is a legal requirement under the French Public Health Code. You can request it via the HDS Addendum request form.
Yes, if you process or host personal health data governed by French law using Zoho Creator, executing the HDS Addendum is a legal requirement under the French Public Health Code. You can request it via the HDS Addendum request form.
We do not specifically serve French customers, but our employees occasionally access Zoho Creator from France. Do we need to comply with HDS requirements?
No. HDS compliance is not triggered by where you or your employees physically access Zoho Creator from. Simply connecting to Zoho Creator from France does not bring you within the scope of HDS regulations. HDS only applies if your organization hosts or processes personal health data of individuals within the French healthcare ecosystem in a manner covered by the French Public Health Code. If you do not handle such data, HDS requirements do not apply to you.
No. HDS compliance is not triggered by where you or your employees physically access Zoho Creator from. Simply connecting to Zoho Creator from France does not bring you within the scope of HDS regulations. HDS only applies if your organization hosts or processes personal health data of individuals within the French healthcare ecosystem in a manner covered by the French Public Health Code. If you do not handle such data, HDS requirements do not apply to you.
Where can I verify Zoho Creator's certification status?
Zoho Creator is listed on the official ANS register of HDS-certified hosting providers.
Zoho Creator is listed on the official ANS register of HDS-certified hosting providers.
Where can I find the Representation of Guarantees?
The document is available at Zoho Creator Representation of Guarantees. It sets out the hosting activities in scope and the applicable guarantees for personal health data.
The document is available at Zoho Creator Representation of Guarantees. It sets out the hosting activities in scope and the applicable guarantees for personal health data.
Is Zoho Creator GDPR compliant?
Yes. Zoho Creator is compliant with the General Data Protection Regulation (GDPR). HDS certification operates alongside GDPR, both frameworks apply independently when you host personal health data on Zoho Creator. For more information, visit Zoho's GDPR page.
Yes. Zoho Creator is compliant with the General Data Protection Regulation (GDPR). HDS certification operates alongside GDPR, both frameworks apply independently when you host personal health data on Zoho Creator. For more information, visit Zoho's GDPR page.
Is Zoho Creator ISO 27001 certified?
Yes. HDS certification requires ISO 27001 certification as a prerequisite. Zoho Creator's ISO 27001 certification underpins the HDS framework and covers the information security management controls applicable to health data hosting. To download our ISO 27001 certificate, visit the Zoho Compliance page.
Yes. HDS certification requires ISO 27001 certification as a prerequisite. Zoho Creator's ISO 27001 certification underpins the HDS framework and covers the information security management controls applicable to health data hosting. To download our ISO 27001 certificate, visit the Zoho Compliance page.
What are the shared responsibilities between Zoho Creator and the customer under HDS?
HDS compliance is a shared responsibility. Zoho Creator's responsibility covers maintaining a certified, secure infrastructure for hosting personal health data, including physical security, virtual infrastructure, application platform operations, and backups. Your responsibility as a customer is to ensure that the applications and workflows you build in Zoho Creator are properly configured to handle personal health data in accordance with your compliance obligations. This includes selecting the EU data centre region and executing the HDS Addendum before processing any health data.
For more information, visit our Shared Responsibility Model document.
What should I do if I have more questions about HDS compliance?
Contact the Zoho Creator support team and we'll gladly address any doubts that you may have.
Contact the Zoho Creator support team and we'll gladly address any doubts that you may have.