Security & Regulation

An infrastructure designed for healthcare environments.

Patient data protection, interaction traceability, and human supervision are not options in Doctinum, they are constitutive of the architecture.

HDS hosting · FranceNative GDPROutside MD classificationComplete traceability

What we guarantee today

Verifiable foundations, not statements of intent.

Here is what is in place, operational, and verifiable, without overselling certifications we don't yet have.

HDS-certified hosting
Health data is hosted in France with a certified Health Data Host (HDS) provider, in accordance with French regulatory requirements.
France · Health data
Data encryption
Data is encrypted in transit and at rest. No patient data circulates in clear text at any processing stage.
In-transit encryption · At rest
Logged & auditable consent
Patient consent is collected online before any collection, timestamped and retained. Each interaction is logged with complete exportable traceability.
GDPR · Auditable log
Access control
Data access is strictly limited to authorized users. Access is recorded and traceable. No unauthenticated access to patient data is possible.
Authentication · Logging
Data location · EU
All data is hosted on infrastructures located in France and the European Union. Any transfers outside the EU are contractually framed and documented.
France · European Union
Patient identity verification
Patient identity is verified before any data collection. The system integrates anti-impersonation mechanisms to ensure collected data corresponds to the right person.
Anti-impersonation · Verified identity

Why it is different

One conversation, two surfaces. And an engine that keeps the AI in check.

Voice + screen

Voice and screen form a single conversation: patients answer aloud or with a tap, and precise data (dates, contact details, photos) flows through the screen. Each patient chooses their own mode.

Multimodal

AI kept in check

The AI model decides nothing on its own: an orchestration engine frames every exchange. Every conversation is traceable and replayable: compliance lives in the architecture, not in a promise.

Traceable & replayable

Built for French aesthetic medicine

Journeys, vocabulary, and regulatory framework tailored to the French aesthetic medicine sector. HDS-certified health hosting, data hosted in France.

HDS hosting · France

Regulatory posture

What we are. What we are not yet.

Transparency about our current regulatory status is a principle, not a constraint. Here is an exact statement of our situation.

En place aujourd'hui

  • ✓Outside Medical Device classification, organizational and declarative collection tool, without diagnosis or autonomous clinical decision
  • ✓Native GDPR compliance, documented legal basis, exercised individual rights
  • ✓HDS-certified hosting in France
  • ✓Pilot agreements framing each deployment
  • ✓Up-to-date privacy policy and legal notices

Trajectoire engagée

  • ○CE MDR trajectory analysis in progress, scope to be defined according to retained uses
  • ○Engagement with specialized digital health regulatory firm in structuring process
  • ○Security review clause available for institutional partners upon request
  • ○ISO 27001 certification considered for large-scale institutional deployments
Notre posture : we do not claim certifications we don't have. If your context requires a specific certification level, we will clearly indicate it, and if the trajectory is compatible, we will build it together.

Human supervision & governance

The clinician remains the decision-maker. Always.

Doctinum collects and structures declarative data. It does not diagnose, does not prescribe, and does not replace any medical decision. Here is how governance is architected.

01
No autonomous decision
The system makes no medical decision autonomously. It collects, structures, and alerts, the healthcare professional remains the sole decision-maker on clinical interpretation and action.
02
Integrated human escalation
Protocols provide systematic human escalation for situations exceeding the defined collection scope. The practitioner is notified in real-time on alerts defined by themselves.
03
Real-time practitioner access
The healthcare professional has access to all collected data, transcriptions, and call logs at any time. Nothing is opaque between the system and the supervising clinician.
04
Protocol configured by clinician
The knowledge base and follow-up questions are defined and validated by the healthcare professional responsible for the protocol. Doctinum executes, the clinician designs and supervises.

Trajectory

A regulatory framework that evolves with our uses.

We build the regulatory trajectory based on real deployments, not from an abstract list of certifications. Here is the current state.

active
HDS hosting & GDPR compliance
Operational infrastructure, HDS-certified hosting in France, documented GDPR compliance. Applicable today for all deployments.
active
Pilot agreement & contractual framework
Each deployment is framed by a pilot agreement defining usage scope, responsibilities, and data processing conditions. This contractual framework is available for review before any commitment.
engaged
CE MDR analysis & regulatory engagement
Medical Device trajectory analysis is in progress. Certification scope will depend on retained uses. A specialized digital health regulatory firm will be engaged soon to define the precise trajectory.
Horizon
CE MDR certification & complementary certifications
CE MDR certification will be engaged according to retained usage scope. Complementary certifications (ISO 27001, etc.) will be considered based on institutional partner requirements. These certifications do not condition current deployments.