Security and health data
Last updated: 18 September 2026
Your session notes are the most intimate thing your software holds. At Rezalia they are encrypted in your browser before being stored: we cannot read them. This page explains how, and what French regulations expect from you depending on your profession.
1. End-to-end encryption, in plain words
When you turn on session notes, you choose a passphrase. It never leaves your browser and we do not know it. Every note is encrypted on your computer before it is sent, and is only decrypted on your side, when you read it again.
Put simply, if someone obtained a full copy of our database, they would only get unreadable blocks. The table holds neither name nor email: the client concerned is identified only by a fingerprint computed in your browser.
For the curious
AES-GCM 256-bit encryption. The vault key is drawn at random, then wrapped by a key derived from your passphrase (PBKDF2-SHA256, 600,000 iterations), and a second time by your recovery code. We only store those wrapped keys.
2. What we cannot do
We cannot read your session notes, nor restore them if you lose both your passphrase and your recovery code. No support procedure, no reset and no court order can recover what is encrypted without your key. That is the price of this protection, and it is deliberate.
So write your recovery code down somewhere other than your computer when it is shown to you: it will never be displayed again.
3. What the rules say, depending on your profession
In France, hosting health data through a provider is governed by article L1111-8 of the public health code. The HDS certification requirement does not fall on the practitioner, but on whoever hosts the data on their behalf. Here are the three cases, without hedging.
Rezalia is made for you
Wellness practitioners
Who: Sophrologist, naturopath, reflexologist, wellness massage practitioner, non-clinical hypnotherapist, energy practitioner, coach.
The rule: Your activity does not fall under prevention, diagnosis or care as defined by the French public health code, so the health data hosting regime (HDS) does not apply. Your notes remain sensitive data under the GDPR: you must protect them, inform your clients and collect only what is useful.
At Rezalia: End-to-end encrypted session notes meet that requirement, and go beyond what most booking software offers.
Talk to us first
Psychological support and manual therapies
Who: Psychologist, psychotherapist, psychoanalyst, osteopath, chiropractor.
The rule: These titles are not listed among the health professions of the French public health code, but your notes concern the follow-up of a person. Authorities look at the nature of the activity rather than the label of the professional, so the HDS regime may be held to apply to you.
At Rezalia: End-to-end encryption means Rezalia holds no readable data, which is a strong argument, but we do not guarantee HDS-certified hosting at this stage. Write to us before storing your session notes with us: we will tell you plainly where we stand.
Rezalia is not suitable for your care records
Regulated health professions
Who: Doctor, dentist, midwife, pharmacist, nurse, physiotherapist, chiropodist, occupational therapist, psychomotor therapist, speech therapist, orthoptist, radiology technician, medical laboratory technician, hearing aid specialist, optician, prosthetist and orthotist, dietitian, nursing assistant, childcare assistant, ambulance driver, dental assistant, genetic counsellor, as well as health and medico-social institutions.
The rule: Article L1111-8 of the French public health code requires data collected during prevention, diagnosis, care or medico-social follow-up to be hosted by an HDS-certified provider. The obligation falls on the host, therefore on us.
At Rezalia: You may use Rezalia for your appointments, calendar and reminders. Do not store your care records here until we announce HDS-certified hosting.
This page describes our reading of the regulations and does not constitute legal advice. If you are unsure about your own situation, ask your professional body, your union or a lawyer.
4. The rest of your data
Appointments, your clients' contact details and your settings are not encrypted this way: we need to display them, send your emails and text messages, and compute your available slots. They are hosted in the European Union, encrypted in transit, and partitioned at database level: a practitioner can never see another one's data.
The details of our processing, providers and your rights are set out in our privacy policy.
5. A question about your situation
Write to contact@rezalia.fr. If your activity involves care, tell us straight away: we would rather point you to a certified tool than put you at risk.