Legal and regulatory compliance
"Padoa has built in a proactive, rigorous approach to ensure full compliance with the GDPR. Drawing on the CNIL’s recommendations and thanks to its HDS, ISO 27001 and ISO 27701 certifications, padoa guarantees OH services that their data is processed with the highest level of security and confidentiality. padoa provides integrated tools for managing information, consents and objections. A Compliance Pack is also continuously updated and made available to OH services. padoa thus gives its customers the peace of mind they need to focus on their core business, while remaining fully compliant with the applicable legal and regulatory obligations." Margaux Jaumot, Legal Manager and Data Protection Officer at padoa
Legal and regulatory compliance at every level for Occupational Health and Prevention Services
Padoa’s stability is guaranteed by an in-house SRE (Site Reliability Engineering) team of 18 people, dedicated to developing and maintaining a reliable, scalable architecture. This organisation not only makes it possible to handle a growing number of requests, but also ensures an excellent availability rate, in the service of occupational health. This synergy between human expertise and advanced technology allows padoa to ensure efficient processing and security of the data handled by OH services.
+38* compliance documents made available to customers in 2024
*Data from the “Compliance Pack”, made available to our customers and created in June 2023
A legal framework for data processing governed by the General Data Protection Regulation
Drawing on the CNIL’s guide for Occupational Health and Prevention Services, an OH service must put in place a procedure ensuring GDPR compliance concerning:
Full information for employers and employees whose personal data is processed
The formal collection of individual objections or consents
The handling of any complaints relating to the use of personal data
The aspects of the GDPR covered by the procedure
padoa is fully GDPR compliant and, in effect, enables its customers to ensure their own GDPR compliance, thanks to the comprehensive resources it makes available:
Elements built directly into the application: Collection and traceability of consents/objections, information for employers and employees
Maintenance of a record of processing activities as a processor: Purpose and sub-purpose of processing, personal data concerned, data subjects, data recipients, sub-processor(s) used, data transfers, retention periods, technical and organisational security measures, legal basis for processing, data collection process
Meticulous verification of the GDPR compliance guarantees of our subcontractors (sub-processors)
A procedure for managing incidents involving personal data, and a procedure for notifying the customer
This comprehensive approach ensures that we meet the requirements of the GDPR, giving our customers complete confidence in the security and confidentiality of their data.
A legal and regulatory framework specific to the occupational health sector
The padoa software is fully compliant with French regulations on occupational health, in particular the Labour Code and the Public Health Code. We are contractually bound to maintain this compliance for our customers.
More specifically, medical files strictly comply with the Labour Code and the CNIL’s recommendations, thereby ensuring data protection and the legal compliance of the DMST (occupational health medical files).
The CNIL has also published a guide dedicated to OH services to help ensure the GDPR compliance of their occupational health software. In this respect, padoa meets it in full.
Our own Health Data Host certification
Providing, on behalf of the data controller, the following is considered a health data hosting activity for personal data held on digital media within the meaning of II of Article L. 1111-8 […]:
1-4° [...]
5° The administration and operation of the information system containing the health data.
6° [...]
Software publishers processing health data must be HDS-certified (Health Data Host), as soon as they themselves carry out a certain number of activities, even if they rely on another physical host that is itself HDS-certified.
By holding its own HDS certification, padoa has the technical capabilities and knowledge to host OH services’ data. However, we have strategically chosen not to manage hosting directly. This approach allows us to focus our expertise on providing a quality occupational health and safety platform, while entrusting hosting to a dedicated, specialised provider. This does not mean we give up responsibility for security. We carefully select and supervise our hosting partner to ensure compliance with the highest security standards.
With its own HDS certification, padoa is also independent of the data host in carrying out the design and operation of the software without intermediaries, for the benefit of users (managing all information systems, monitoring performance levels and intervening immediately to guarantee the platform’s availability in all circumstances, and creating new systems with full autonomy and without delay).
This autonomy in our activities gives us proven agility.
Find out more
Because padoa holds its own HDS certification, it is autonomous in its activities, particularly when a new customer signs and many arrangements must be put in place in record time.
Additional certifications
The platform holds its own ISO 27001 and ISO 27701 certifications.
ISO 27001 is the world reference for information security management systems, while ISO 27701 relates to the governance and implementation of privacy protection measures for personal data processing.
ISO 27001 is aimed at all companies that handle sensitive data, even on behalf of a third party, and establishes a set of rules and best practices to follow in order to maximise the security of information systems.
ISO 27701 attests to the care taken in protecting the privacy and confidentiality of personal data, a commitment padoa has held since the software was designed, based on the “Privacy by Design” principle. It is strong evidence of our GDPR compliance.
padoa’s “Compliance Pack”, continuously updated, gives our customers direct access to documentation on data processing, consent procedures and incident reports, ensuring full regulatory compliance. It includes:
GDPR elements
PIA (privacy impact assessment) template
Information / consent notices: teleconsultation, employee information on DMST access, job retention consent
How consents / objections work in padoa
Terms of Use
Sub-processor compliance documents
DMST compliance against the CNIL guide
Security elements
Results of periodic penetration tests
Security Assurance Plan
Compliance elements
padoa’s ISO 27001 and HDS certifications
The host’s HDS certification
padoa’s ISO 27701 certification
Electronic signature documentation
Evidential value framework
PGSSI-S action plan, with comments where padoa is concerned
💡F.A.Q
Confidentiality
How does padoa guarantee data confidentiality?
padoa uses robust data encryption, secure hosting in France on HDS-certified Azure servers, and strict access controls. Our ISO 27001 and ISO 27701 certifications demonstrate our commitment.
Support
How does padoa support its customers with GDPR compliance?
padoa is fully GDPR compliant (maintaining a record of processing activities, GDPR assessment of subcontractors, a procedure for requests to exercise rights, etc.). Our “Compliance Pack”, freely accessible to our customers, easily provides all the necessary documents.
Legal requirements
How does padoa meet legal requirements for data security and protection?
Padoa is HDS, ISO 27001 and ISO 27701 certified, and complies with the applicable regulations (notably the GDPR, the Labour Code and the Public Health Code) and the CNIL’s recommendations. We apply strict security and privacy protection measures at several levels (organisational, physical, technical and technological).
