Skip to content
Ostheo

Security

What protects your records.

What is in place in Ostheo, what is still to be published, and what depends on you. No vague wording, and no certification claimed before we can show it.

What protects your records

  1. Health data hosting

    Hosting health data on behalf of a practitioner requires a certified host under French law (Public Health Code, art. L1111-8), with storage in the EU/EEA.

    To be published before launch: host name, certificate scope and number, validity date.

    To be published

  2. Encryption

    Traffic between your browser and Ostheo is encrypted (HTTPS, HSTS). Data is encrypted at rest, backups included.

    In the product

  3. Access control

    Each member has a role (owner, practitioner, assistant, secretary); the secretary role sees no clinical content. A file can be restricted to named people.

    In the product

  4. Access log

    Every read, creation, change, print or export of a patient file is logged (who, what, when, from where).

    In the product

  5. Retention

    Ostheo follows the French data protection authority’s benchmark for paramedical practices (20 years after the last visit) and keeps invoices for 10 years.

    In the product

  6. GDPR and subprocessors

    Ostheo processes data only to provide the service, on your instructions.

    To be published: data processing agreement, subprocessor list, DPO contact.

    To be published

Sources

Textes et pages officielles consultés pour rédiger cette page.

  1. [1]French Public Health Code, article L1111-8 (health data hosting)Légifrance · legifrance.gouv.fr · consulté le 19 octobre 2026
  2. [2]HDS certification framework v2 (French Digital Health Agency)ANS · esante.gouv.fr · consulté le 19 octobre 2026
  3. [3]Regulation (EU) 2016/679 (GDPR), article 28EUR-Lex · eur-lex.europa.eu · consulté le 19 octobre 2026

Frequently asked questions

Is Ostheo hosted by a certified health data host?

Ostheo is designed to run only with an HDS-certified host, with storage in the EU. The host’s name and certificate reference will be published on this page before launch.

Ostheo, software for osteopaths

Your practice, finally aligned.

Patient records, consultations, body chart, agenda and compliant French invoices, with Theo for drafts.

Try OstheoSee pricing