For health data, that note is written down: the General Data Protection Regulation, the French Public Health Code, the reference methodologies of the CNIL, the French data protection authority. It is the same for a pharmaceutical company, a digital health start-up or a clinic.
Diapason by Hémistiches is the firm’s GDPR compliance offering: bringing your set-up into tune, then holding the data protection officer function. I perform it myself, as a lawyer and certified data protection officer, for organisations required to fill the role without being able to recruit: primarily in healthcare (laboratories, biotechnology companies, medical device manufacturers, clinical trial sponsors, care providers), and more broadly wherever the data processed is sensitive.
This is not an assignment delivered once, it is a function held over time: appointment and notification to the CNIL, the record of processing activities, impact assessments, requests from data subjects, and support the day the authority makes contact.
A free online test measures the gap between your set-up and what a supervisory authority asks to see.