Privacy and health data: our commitment

Health data holds a special place in the law: the General Data Protection Regulation (GDPR) classifies it among “special categories of data,” alongside biometric data or sexual orientation. Processing it is, in principle, prohibited, except for strictly defined exceptions — most often the explicit consent of the person concerned. This caution isn't excessive: a piece of health data, once collected, often reveals far more about someone than a simple email address.

Why health data is so sensitive

A piece of health data can have very concrete consequences if it leaks: a denied loan or insurance application, discrimination in hiring, stigma among the people around you. And unlike a password, it can't be changed. A revealed diagnosis stays revealed.

The risk is far from theoretical. In France, the 2024 cyberattack targeting two insurance claims processors, Viamedis and Almerys, exposed the data of more than 33 million people, according to the CNIL. In the United States, the Change Healthcare hack, the same year, affected about 190 million people: the largest health data breach ever recorded in the country. In both cases, the victims had done nothing careless. Their data was simply stored somewhere.

There's another, quieter risk: resale. In the United States, the Federal Trade Commission (FTC) sanctioned several online health services in 2023, including GoodRx and BetterHelp, for sharing their users' health information with advertising platforms, without users understanding that this was happening.

Our choice: never collect your health answers

Faced with this reality, many online health services ask for consent, create an account, and store answers to “personalize the experience” or “provide follow-up.” Hygietest made a different, more radical choice: never collect your answers to the tests, which stay on your device.

In practice, every test is calculated entirely in your browser. Your answers never pass through a server, are never stored in a database, and disappear as soon as you leave or refresh the page — unless you choose to print them yourself to take to your doctor.

Why this choice goes further than a simple consent banner

An “I accept cookies” banner or a GDPR checkbox can give the impression that data protection comes down to an administrative formality. We preferred a different approach: rather than asking permission to collect sensitive data, we tried to do away with collecting it entirely. Technically, this is called “privacy by design” — a principle the GDPR encourages, but one few services apply this strictly. The consent banner you see on this site concerns only third-party advertising cookies. It never concerns your answers to the tests, which are neither requested nor collected, banner or not.

No identity, no email address, no banking details are ever requested on Hygietest. In fact, there's nothing to ask for: with no account to create, there's nothing to protect on a server, because no storage exists in the first place.

What this means for you in practice

• You can use any tool on the site anonymously, without ever identifying yourself
• Your answers to a questionnaire are visible only to you, on your own device
• If you print your result for your doctor, that's the only trace that exists — and it stays entirely in your hands
• Closing the tab is enough to erase any trace of your visit to the tool

What a website still sees, and how to check it yourself

Transparency requires one clarification. Like any website, Hygietest is hosted on servers that receive, in order to display a page, some technical information: the device's IP address, the browser type, the page requested. These technical logs are used for the site's operation and security. They contain none of your answers to the tests, which never leave your device. Hygietest also measures its audience anonymously and in aggregate (number of page views, country, device type), without cookies, via Vercel Web Analytics, our hosting provider — your test answers are never transmitted to this measurement tool. This site displays, or will display, ads provided by Google AdSense. You can allow or decline their cookies in the consent banner shown on your first visit, and change that choice at any time using the “Manage my privacy choices” link at the bottom of every page. These ads, like any third-party service used on this site, have no access to your answers to the tests, which never leave your device.

You can verify this yourself. Open a test, then disconnect from the internet, for example by switching to airplane mode: the questionnaire keeps working and the result appears. That's proof the calculation happens on your device, not on a server.

A legal framework that varies depending on where you are

This protection isn't universal in the same way everywhere in the world, which makes our technical choice all the more relevant.

In France, as in the rest of the European Union, the GDPR applies by default to any processing of personal data, including on a site like ours — it is precisely this framework that classifies health data among the categories requiring stronger protection. The CNIL, the French authority responsible for enforcing it, oversees its practical application within the country.

In the United States, the logic is different: the main health law, HIPAA, only protects data when it passes through a healthcare provider, an insurer, or one of their direct contractors. A consumer app or website used directly by an individual — exactly Hygietest's case — generally falls outside its scope. In other words, in the United States, an online screening tool like ours could legally collect and resell health data without violating HIPAA, simply because the law doesn't cover it.

It is precisely to avoid depending on geography or legal nuances from one country to another that we chose to never collect your health answers, wherever you are in the world.

Your rights, and a few useful habits

In Europe, the GDPR gives everyone the right to know what data an organization holds about them, to have it corrected or deleted, and to object to its use. If there's a problem, you can file a complaint with the CNIL free of charge. Since 2025, a regulation on the European Health Data Space also governs the sharing of medical records between EU countries. In the United States, several states have passed their own laws to fill the gaps left by HIPAA, such as Washington State's My Health My Data Act.

A few habits help you stay in control of your health information, on Hygietest as elsewhere:

• before using a health app or website, check whether it requires an account and what its privacy policy says about sharing data;
• be wary of “free” tests that ask for an email address to show the result;
• don't share medical results on social media or in group chats;
• keep your health documents in a secure space, rather than in your email inbox.

The trade-off we accept

This approach comes with a trade-off: with no history kept, Hygietest can't offer you tracking of your results over time. This is a deliberate choice, favoring privacy over convenience.