Doctolib set to use some patient data for AI research - how to opt out
Doctolib, France's dominant online medical appointment booking system, will begin using patient data in two artificial intelligence research projects this month without requiring individual consent from its 60 million users across France, Germany and Italy.
The platform can proceed without patient consent because the research is deemed to serve the public interest and complies with the legal framework established by the CNIL (Commission nationale de l'informatique et des libertés), France's data protection authority. Under GDPR Article 9, health data processing for scientific research purposes in the public interest does not require individual consent when proper safeguards are in place.
Legal Framework and Recent Regulatory Updates
French data protection law requires organizations processing health data to either comply with applicable CNIL standards or obtain prior authorization from the authority. The CNIL updated its reference methodologies MR-001 and MR-003 for health research on May 23, 2026, with the new rules entering into force on May 24, 2026, in response to the digitalization of clinical research practices and growing data breaches in the health sector.
French law explicitly prohibits commercial use of health personal data under articles L. 1111-8 and L. 4113-7 of the French Public Health Code. Doctolib has stated it does not sell or share personal data for commercial purposes.
Research Projects and Partnerships
The first research project aims to investigate how AI tools can help anticipate certain risks based on medical history, enabling better organization and coordination of care pathways. The second project will explore how to obtain reliable measurements of the confidence levels of generative AI models used in the medical field to enhance user safety.
Both three-year projects will be conducted in collaboration with Inria (the French National Institute for Research in Digital Science and Technology), Inserm (the French National Institute of Health and Medical Research) and Paris-Cité University. These institutions operate a joint research team called HeKA (Health data- and model-driven approaches for knowledge acquisition) that specializes in biomedical knowledge discovery using health models and data.
The research aligns with France's broader digital health strategy. The government has launched a major national digital health program (PEPR Santé Numérique) jointly led by Inserm and Inria as part of France 2030, involving over 150 laboratories, 40 universities, and at least 14 hospitals to develop breakthrough health technologies.
Timeline of Doctolib's AI Development
Doctolib launched its AI laboratory in February 2026 and announced in May 2026 that it was developing a conversational AI for parents of young children aged 0 to 3 years. The research projects beginning this month represent the next phase of the platform's AI initiatives.
What Data Will Be Used
The platform states that only data strictly necessary for the research will be used, and no patient or healthcare professional can be directly identified. Patients will be assigned pseudonyms replacing their real names, though this does not guarantee complete anonymity as identities could potentially be traced through indirect methods.
The research may use data entered by doctors into their Doctolib software, including medical history, medical records, diagnoses, treatment progress, documents and images. Information entered by users prior to consultations such as questionnaire responses, referral letters, and prescriptions may also be used, along with health data entered in the Santé section of Doctolib accounts.
The Ligue des droits de l'Homme, a French human rights organization, has expressed concern about the data use.
Doctolib wants to use the health data of its 60 million patients to set up an AI laboratory. The LDH warns that this data, which is among the most sensitive, must be protected. We are calling on patients to refuse the use of their data.
How to Opt Out
Patients who prefer that their data not be used in the research can complete a dedicated opt-out form on the Doctolib website.
You may withdraw your consent to the reuse of your data, as well as the data of your relatives, by completing this form for each person on whose behalf you are objecting,Doctolib stated.
The platform emphasized that submitting the opt-out form does not impact the services offered to users. To exercise other rights such as data rectification, restriction and deletion, users can send an email to contact.dataprivacy@doctolib.com.
Doctolib has created a transparency webpage detailing its research projects and featuring data-related frequently asked questions.
Data Sovereignty Concerns
The French government has already launched a program to reduce its reliance on Microsoft for national health data, driven by concerns over digital sovereignty. Doctolib has so far resisted calls to relocate its data from Amazon Web Services to a European provider. In March 2021, France's highest administrative court, the Conseil d'État, ruled that Doctolib's use of Amazon Web Services for hosting vaccination booking data was compliant with GDPR because sufficient legal and technical safeguards were in place against potential U.S. authority access requests.