Transparency in the processing of health data
Cloud Temple provides HDS-certified hosting and facilities management services specifically tailored to the challenges of the healthcare sector.
In application of requirement 31 of the ANS HDS V2 standard, this section details the procedures for the transfer of personal health data (PHCD) operated by Cloud Temple, both within and outside the European Economic Area.
Access mapping
| Company name | Role in providing accommodation | HDS certified | SecNumCloud 3.2 qualified | Accommodation activities in which the player is involved | Access to personal health data from countries outside the European Economic Area, by the Host or one of its subcontractors (requirement no. 29 of the HDS standard) | Host or subcontractor subject to a risk of access to personal health data from countries outside the European Economic Area, imposed by the legislation of a third country in breach of EU law (requirement no. 30 of the HDS standard) |
|---|---|---|---|---|---|---|
| Cloud Temple | Host | Yes (Cloud Temple certification) | Yes (Cloud Temple qualification) | HDS-certified activities: 2, 3, 4, 6 Hosting and outsourcing of backups | No, no access to data from outside the European Economic Area | No, there is no risk of unauthorised access to the data covered by requirement 30 of the HDS standard. |
| Cloud Temple | Host | Yes (Cloud Temple certification) | No | HDS-certified activities: 5 Outsourcing carried out exclusively from France | No, no access to data from outside the European Economic Area | No, there is no risk of unauthorised access to the data covered by requirement 30 of the HDS standard. |
| Freelance engineers based in Tunisia | Subcontractor | Yes (Cloud Temple certification) | No | HDS-certified activities: 5 Outsourcing carried out by mixed teams, including staff based in France and freelance engineers based in Tunisia. | Yes, access not covered by an adequacy decision within the meaning of Article 45 of the RGPD: Tunisia (further information below) | Yes, risk of unauthorised access to data covered by requirement no. 30 of the HDS standard: Tunisia (additional information below) |
Access to personal health data from countries outside the European Economic Area
Type of access
- Nature of the data : Personal data hosted on outsourced customers' information systems
- Categories of data: All categories of personal data stored by customers in their information systems.
- Persons concerned: Customers, employees, suppliers or other contacts of managed services customers
- Storage location: France
- Purpose of the transfer: Managed services
- Legal basis for the transfer: Standard Contractual Clauses (SCC)
- Access to data : Technical administration rights over infrastructures. No operational access to health data, except for duly documented critical maintenance actions.
- Scope of intervention: Access limited to the storage and technical infrastructure hosting the data, without processing the content.
Risk of access imposed by the legislation of a third country in breach of EU law (requirement no. 30 of the HDS standard)
- Tunisian law places restrictions on government access to personal data.
- Article 76 of Organic Law no. 2004-63 prohibits the transfer of data likely to undermine public security or Tunisia's vital interests.
- However, there are exceptions for reasons of national security, defence or international relations. The public body may refuse access to information in these cases.
- The Instance Nationale de Protection des Données à Caractère Personnel (INPDP) has the power to access personal data being processed in order to verify it.
- Residual risk: Potential access by the Tunisian authorities strictly limited to cases of national security or defence cited by law.
Appropriate safeguards and guaranteess
Contractual measures
- Standard contractual clauses (SCC) :
- Use of CCTs adopted by the European Commission on 4 June 2021, based on the model recommended by the CNIL
- These clauses provide a legal framework for transfers of personal data outside the EU
- They incorporate the requirements of the RGPD and the recommendations following the Schrems II ruling.
Technical measures
- Strong encryption of data during transfer and processing
- Implementation of strict access controls and strong authentication
- Network segmentation and data partitioning
- Data access logging and monitoring
- Regular updating of security systems and applications
- Encrypted backup and regular restore tests
Organisational measures
- Background checks on staff
- ISO 27001 certification covering outsourcing activities
- Ongoing training for the provider's staff on data protection and information security
- Rapid notification procedure for access requests from the Tunisian authorities
- Implementation of a documented and regularly updated information security policy
- Procedures for managing security incidents and data breaches
- Regular information security risk assessments
- Setting up a business continuity and disaster recovery plan
Data Protection Officer
Contact: dpd@cloud-temple.com
Contact our teams