Therapists and care professionals: confidentiality as the number-one requirement

On November 6, 2025, Doctolib was fined €4.6 million for abuse of a dominant position. In June 2026, health data was being used to train AI models. For a therapist, the question is no longer which software, but where their notes live.

On November 6, 2025, France's competition authority fined Doctolib €4.6 million for abuse of a dominant position. In June 2026, investigations revealed health data being shared with AI providers to train their models (fr.wikipedia.org/wiki/Doctolib). For a therapist, the question is no longer which software to choose, but where session notes live.

The year trust cracked

Doctolib had claimed end-to-end encryption since 2020; that was not the case, and its data passes through American companies exposed to the CLOUD Act (fr.wikipedia.org/wiki/Doctolib). For a platform handling medical appointments, the gap between promise and actual operation took time to emerge. It has emerged.

‘Hosted in France’ does not mean ‘on your premises’

Niche alternatives emphasise sovereignty: Crenolibre, a platform for more than 60 wellness specialities starting at €29.95 excluding VAT per month, states ‘All your data is secured, isolated and stored in France’ (crenolibre.fr). That is real progress over transatlantic hosting, but it is not the same as data never leaving your computer. The distinction matters particularly for session notes.

What the law says, without distorting it

Any entity hosting health data collected during care must hold health data hosting certification, HDS (esante.gouv.fr/produits-services/hds). An application remaining on your workstation without ever sending those data to a third party that stores them for you falls outside this third-party hosting scope, but the subject remains sensitive and warrants your own verification with a lawyer or the CNIL (cnil.fr/fr/sante) before any final decision. This is not an administrative detail to treat lightly: it is the condition that makes the local-data argument solid rather than simply reassuring on paper.

A tracking application that lives on your workstation

This is Maestro's positioning, not a marketing argument pasted onto the subject: projects are folders on your drive, versioned locally, and AI sees only what you show it during construction, never your patients' production data. A solo practitioner describing their practice, types of assessments, follow-up frequency and what they want to record, gets a tool that fits them without ever routing session contents through a third party.

What this does not replace

Public appointment booking, connections with new patients and online visibility: Doctolib and similar platforms retain a real role in these functions, and nothing in this article claims otherwise. The angle is not to replace a matchmaking platform, but the tracking tool holding the contents of therapeutic work, what those same platforms are not primarily built to protect, regardless of the quality of their security teams.

Describe your practice, keep confidentiality

Starting with a requirements document for a single workflow, the initial assessment or follow-up between sessions, is enough to judge whether the tool suits you before entrusting anything sensitive to it. Your data stays with you: this architecture is explained in detail on our dedicated page.