Doctolibs opt-out in France: a blueprint for health data in Germany?

A French digital health platform, Doctolib, has announced plans to use patient data collected through its practice management software and personalized health services for research and artificial intelligence projects starting in September 2026. The initiative has sparked discussions in Germany about how similar approaches might be implemented there, raising questions about balancing medical research freedom with data privacy protections. According to Doctolib, the proposed research projects will exclusively involve France, and patients will not need explicit consent to participate, though they can opt out. The company, which initially gained prominence as a booking portal, has significantly expanded its operations in France over the years. It now offers a comprehensive suite of tools including appointment scheduling, video consultations, secure communication, practice management functions, medical documentation features, and AI-assisted tools. This expansion means that Doctolib is deeply embedded in the daily routines of healthcare providers and patients alike. As a result, the question of what data can be processed for which purposes becomes increasingly critical. In France, Doctolib’s software includes a medical dossier function, allowing practitioners to document patient information within their practices. While this differs from the French state-run “Mon espace santé” system, it highlights how Doctolib has evolved into a broader health platform. In Germany, the company is following a similar trajectory, offering its own practice management system with AI capabilities. Although this does not constitute a legally mandated electronic patient record (ePA) or a Doctolib-specific patient file for insured individuals, it brings the provider closer to core data flows and workflows in doctors' offices. This proximity necessitates careful consideration of purpose limitation, data minimization, and access controls from the outset. The company's planned research initiatives in France aim to explore how AI can help predict risks based on medical history and coordinate care pathways. Another project focuses on evaluating the reliability of generative AI models in the medical field. These efforts are being supported by partners such as Inria, Inserm, and Paris Cité, along with the HeKA team. Data to be used in these projects include health records, lifestyle information, demographic data, and data from users of specific personalized services. Sources of this data will be Doctolib’s practice management software, personalized services, and other relevant platforms. The company has not specified whether anonymized or pseudonymized data will be used, nor has it detailed the exact scope of data collection beyond stating that adult patients and service users will be included. Dr. Anna Berry, a legal researcher at the German Institute for Public Administration (FÖV), emphasized that while Doctolib’s role in integrating various aspects of healthcare delivery makes it a key player in data processing, the ethical and legal implications must be addressed carefully. She noted that the company’s presence in both France and Germany raises important questions about how data governance frameworks should evolve to accommodate technological advancements without compromising individual privacy rights. The move by Doctolib reflects a growing trend among digital health companies to leverage large datasets for AI-driven innovations. However, the lack of explicit consent requirements for data usage has raised concerns among privacy advocates and regulatory bodies. While the company maintains that patients have the right to opt out, critics argue that this approach may not fully align with strict data protection standards, particularly in jurisdictions with stringent regulations like the European Union. As the projects are set to launch in 2026, further details regarding data handling procedures, oversight mechanisms, and potential impacts on patient trust are expected to emerge. Regulatory authorities in France and Germany are likely to monitor the developments closely, ensuring compliance with existing laws and addressing any emerging issues related to data ethics and transparency.