Key legal aspects of implementing digital therapeutics (DTx) in France

Any software with health-related services could be considered a “medical device”, and therefore be subject to an additional set of rules. In case of non-compliance with such rules, legal consequences will vary depending on the type of breach and on the gravity/repetition of such breaches and may give rise to civil and criminal sanctions. 

In line with Regulation (EU) 2017/745 (“MDR”), the French legal definition of “Medical Device” includes software with medical purposes under certain conditions (Art. L.5211-1 of the Public Health Code). A software would fall within this category if it is “intended by the manufacturer to be used, alone or in combination, in humans for one or more of the following medical purposes and whose primary intended action in or on the human body is not achieved by pharmacological or immunological means or by metabolism, but whose function may be assisted by such means: 

• Diagnosis, prevention, control, prediction, prognosis, treatment, or mitigation of a disease; 
• The diagnosis, control, treatment, mitigation or compensation of an injury or disability 
• Investigation, replacement or modification of an anatomical structure or function or a physiological or pathological process or condition 
• Communication of information through in vitro examination of samples from the human body, including organ, blood, and tissue donations.”  

Furthermore, in line with ECJ’s case law, the French National Agency for Medicines and Health Products Safety (“ANSM”) considers that, to be qualified as a Medical Device (or an in vitro diagnostic device (“IVD”)), the software must present the following criteria: 

• it must be intended for medical purposes, for example, a diagnosis, an aid to diagnosis, a treatment or an aid to treatment; 
• provide a specific result for the benefit of a single patient; 
• the patient-specific data should be processed in order to provide new medical information. 

For instance, the ANSM’s guidelines specify that constitutes a medical device (i) a prescription assistance software or (ii) a software calculating doses as part of a treatment prescribed by a doctor (e.g. dose of insulin to be injected based on the patient's blood sugar data at different times of the day). On the contrary, applications (i) that solely prescribe physical training or (ii) which are designed to communicate information to physicians (without any analysis or alert) will not be medical devices because there is no medical purpose. 

For app and IoT which have a potential effect on health, without having declared medical purpose ("grey zone"), the High Health Authority (“HAS”) published its "Good Practice Guidelines on Health Apps and Smart Devices (Mobile Health or mHealth)” (2016). 

The qualification of the medical software/DTx requires a case-by-case analysis. Our lawyers specialized in Technology & Life sciences can assist you on this specific matter. 

Falling within the Medical Device category entails significant consequences for the manufacturer of the concerned device or applications, including (i) the necessity to obtain a CE-Marking to be allowed to market the product (ii) certain restrictions as to the promotion of such product, (iii) the necessity to implement the highest standards of protections in terms of data protection, etc. 

Under French law, a software including telemedicine services may not be legally operated unless the concerned services are provided by health professionals who are authorized to practice and duly registered in France.  

In particular, if the software allows a physician to interpret the condition of the user and eventually makes decision on this basis, it may therefore constitute ‘telemonitoring’ services which are regulated as part of telemedicine services (e.g. a software for telemonitoring heart failure, where an alert is issued in the event of cardiac decompensation to warn the doctor, who may adjust the treatment). 

If the service offered is an act of telemedicine, certain compulsory requirements are applicable: 

• The “free and informed consent” of the patient shall be documented (Art. L. 1111-2 & L. 1111-4 of the French Public Health Code)  
• A specific authentication process of the health professional shall be implemented (Art. R6316-3 of the French Public Health Code); 
• declaration of telemedicine activity is required by health professionals and by providers of technical solutions. For providers of technical solutions for telemonitoring, a declaration of activity must also be sent to the Regional Health Agency (Agence Régionale de Santé, “ARS”) of their place of practice, as well as a commitment to comply with the applicable provisions.   
• The medical professional, pharmacist or paramedic must include in the patient's record certain specific information to document the medical consultation.  

Since DTx will generally process health-related data, they should comply with GDPR, French Data Protection Act as well as with certain specific requirements arising from the French Public Health Code and Authorities’ guidelines: 

(i) General data protection rules, i.e. Law n° 78-17 dated 6 January 1978 (“The French Data Protection Act” and the General Data Protection Regulation (“GDPR”). 

• If it is a “B2C” service (business to end consumer): there is no specific restriction as to the localisation of the user when using the app to the extent that the user cannot be qualified as a data controller or data processor under the GDPR. Should it be the case, there might be a risk that the using of the app in a territory outside of the EEA would imply a transfer of data within the meaning of the GDPR, and therefore would require adequate protection (Art. 44 and seq.). 
• If it is a “B2B” service (business to business): the use of a health app in a B2B context may raise specific issues where the users are not the data subjects. In such a case, it must be ensured that there is a data processing agreement (Art. 28 GDPR) and adequate protection for any transfer of data outside the EU as specified above. 
• Finally, depending on the category of the data, there are further rules to comply with: 
• Any processing of health data must imperatively be based on one of the exceptions of Art. 9 of the GDPR or Art. 44 of the French Data Protection Act, and express consents of data subjects must be duly collected where required; 
• If there is any processing of health data implemented in the context of a research in the health sector, it might require a prior regulatory approval from the French Data protection authority (“CNIL”); 
• Processing of social security numbers may be allowed in the context of telemedicine for invoicing purposes and to the extent necessary to the coverage of telemedicine acts related expenses, subject to certain conditions (Art. 30 of the French Data Protection Act, Decree No. 2019-341 of 19 April 2019 & CNIL guideline of 2019). 

(ii) The Public Health Code:  

• Pursuant to Art. L.1111-8, any person hosting personal health data collected in the course of prevention, diagnosis, care or social and medico-social aftercare on behalf of the patient or the healthcare professionals must be a certified health data hosting service provider (Hébergeur de Données de Santé or “HDS”).  
• According to the same article, any act of transferring identifying health data for consideration, directly or indirectly, including with the consent of the person concerned, is prohibited under penalty (Art. 226-21 of the Criminal Code). 

(iii) Guidelines from French authorities relating to the processing of health data, notably: 

• As regards “Mobile Health” (apps or IoT), the HAS recommends obtaining the data subject’s explicit consent prior to using location tracking functionalities via his/her device or any other specific functionality or content of his/her device; 
• As regards telemedicine, the CNIL underlines the high security levels which must be applied by apps. In particular, the following measures must be implemented: 
• a solution of strong authentication combining at least 2 factors (including the use of the health professional chip card for health professionals); 

• each user must be granted a unique login; 
• organisational measures and in particular authorisation management with distinct levels of access authorisation; 
• logging measures with periodic review; and 
• secured emails with encrypted attachments where medical reports are communicated. 

The CNIL also reminds that when the processing resulting from telemedicine is likely to imply a high risk for rights and freedoms of the persons, the data controller shall carry out an impact assessment of the contemplated processing operations. 

If we assume that the DTx is a medical device (MD), two main conditions must be fulfilled before being placed on the French market:  

• CE marking: A CE declaration of conformity must be completed, in order to demonstrate its compliance to with the safety and performance requirements, according to the characteristics and intended use of the device. In principle, it is a notified body appointed by the manufacturer who must carry out the assessment of the compliance; however, for DM class I (lowest risk class such as compresses, glasses…), the manufacturer may assess compliance itself.  

For certain DM of class III, a clinical investigation will be required to obtain CE marking. 

• The manufacturer must also conduct a post-marketing surveillance plan in order to ensure regular updates throughout its life cycle. This plan must include post-market clinical follow-up (PMCS), which is a continuous process of updating clinical evaluation through which the manufacturer proactively collects and evaluates clinical data.  
• The manufacturer of a MD has to make several declarations, including (i) registration on EUDAMED database: MD placed on the market are subject to prior registration on the EUDAMED database, as provided for in Regulation (EU) 2017/45. 

There are further requirements for DTx intended to be covered by the health insurance scheme. Please refer to Section 3.d) for further details. 

The qualification of medical device gives rise to the application of specific advertising/promoting rules.  

The main rules applicable to advertising of software medical devices are twofold: 

• Specific rules from the French Public Health Code (Art. L.5213-1 to L.5213-7), created by (i) Law No. 2011-2012 of December 29, 2011 strengthening the health safety of medicines and health products and (ii) Decree No. 2012-743 of May 9, 2012 on medical devices advertising. The ANSM enacts recommendations and ensures compliance with these rules. 
• General rules of the French consumer Code are also applicable, especially (i) Article L.121-1 to L.121-5 on unfair and misleading practices and (ii) Article L.122-1 to L.122-7 on comparative advertising. 

Any operator who advertises a medical device are concerned by these rules: manufacturer, agent, any person engaged in the manufacture, distribution or importation, including pharmacists, service providers and distributors of devices, etc. 

(i) Advertising procedure: In practice, the advertising procedure will depend on the person to whom it is addressed (e.g. pre-approval or license required). In any event, only medical devices that have a CE marking may be advertised. 

If the advertising is addressed to the general public, two possibilities: 

• Reimbursed medical devices (Art. L5213-3 of the Public Health Code): In principle, advertisement of medical devices reimbursed, even partially, by compulsory health insurance schemes is prohibited. However, by way of exception, reimbursed medical devices posing a low risk to human health (classes I and II,a) may be authorised. 
• Non-reimbursed medical devices (CSP, Art. R5213-5): The advertising is generally authorised and subject to ex-post control. However, advertising of certain medical devices posing a significant risk to human health is subject to prior authorisation by the ANSM. 

If the advertising is addressed to HCPs: 

• Advertising to HCPs of medical devices and in vitro diagnostic medical devices – reimbursed or not - is authorised and subject to ex-post control. Nonetheless, advertising of medical devices and in vitro diagnostic medical devices whose failure is likely to cause a serious health risk is subject to prior authorisation by the ANSM. 

(ii) Mandatory information: Furthermore, there are mandatory information that should be contained in any advertising of software medical device. 

(iii) No misleading advertising: Finally, advertising must not include content that is likely to mislead the user or the patient. (Art. L5213-2 of the Public Health Code & Art. L121-2 and seq. of the Consumer Code). In particular, advertisement for a medical device to the general public must not contain any element that: 

• Would make medical consultation or surgery appear superfluous; 
• Suggests that the effect of the device is insured, that it is free of adverse effects, or that it is greater than or equal to that of another treatment or device;  

• Suggests that a normal state of health can be improved by the use or affected by the non-use of the device  
• Would be addressed exclusively or mainly to children;  
• Refers to a recommendation from scientists, health professionals or persons who may, by their reputation, encourage the consumption of the health product;  
• Assimilates the health product to food, a cosmetic product or consumer product;  
• Suggests that the safety/efficacy is due to the fact that it is a natural substance;  

• Could lead, by a detailed description of symptoms, to a false self-diagnosis;  
• Abusively, frighteningly or misleadingly use visual representations of alterations in the human body; 
• Excessively or misleadingly presents the action in the human body;  
• Refers to certificates of healing; 
• Insists on the fact that the device has been registered;  

• Includes offers of bonuses, objects or products or direct/indirect material benefits (Art. R5213-1 of the Public Health Code). 

(iv) Risks in case of non-compliance:  

• Prohibition of the advertising (Art. R5213-4 of the Public Health Code): in case of non compliance, the ANSM may give formal notice to regularize the situation and withdraw the advertising until it is compliant. The formal notice may be accompanied by a daily penalty payment. If the formal notice has not been executed in due time, the ANSM may prohibit the advertising. 
• Financial sanctions (Art. L.5461-9 & L.5471-1 of the Public Health Code) may be given in various situations (e.g. advertisement to general public for reimbursed medical device, advertisement without prior authorisation if appropriate…), up to 30% of the turnover, and € 1,000,000 for a legal entity.  
• Criminal penalties (Art L.5461-6 of the Public Health Code): The diffusion or creation of an advertisement of a medical device (i) that is misleading or likely to present a risk to public health or (ii) subject to prior authorisation when the ANSM did not deliver, refused to deliver, suspended or withdraw such authorisation is punishable by 2 years of imprisonment and a fine of € 750,000. Please note that both criminal and financial sanctions can be combined but the total amount of the fine and financial sanction cannot exceed the higher maximum legal applicable amount. 
• Risk of an action for unfair competition initiated by a competitor (Art. 1240/1241 of the Civil Code) in case of disparagement, parasitism, disorganization or confusion. The competitor must prove a damage, a prejudice and a causal link between the fault and the resulting damage. This action may lead to the cessation of disloyal conduct, i.e. the prohibition of the advertisement and the payment of a deposit. 
• Reputational risk: Decisions are generally published (on the Internet and/or in newspapers). 

As regards the general public, advertising for a medical device to the public may not include any element involving offers of objects or products of any kind or direct or indirect material benefits, unless the advertising concerns a Class I or II medical device (Art. R5213-1 of the Public Health Code). 

As regards HCPs, the French Quality Charter on the professional practices for the presentation, information or promotion of medical devices of 8 March 2022 regulates (i) the quality of the information provided to the professionals (established and validated data, adverse effects, precautions for use, etc.) and (ii) the visits from sales representatives (limitation of frequency, obligation of declaration code of ethics for medical sales representatives). 

However, please note that the use of incentives and benefits for the promotion of medical software / DTx (e.g. free access, benefits for prescription, package solutions, rebates…) may interfere in the relationship between the patient and the HCP and violate French rules, notably: 

(i) The “Anti-Gift” Law (Ordinance No. 2017-49 ratified by Law No. 2019-774 on the organization & transformation of the healthcare system), which prohibits advantages by donators (medical product firms) to beneficiaries (HCPs, students/associations, government officials). By way of exception, legal advantages are subject to declaration or authorization, such as: 

• Remuneration of research activities, scientific evaluation, commercial promotion 
• Funding of professional training 
• Donations intended exclusively to finance research activities 
• Hospitality (e.g. HCPs: maximum €150/night) 

In case of non-compliance, the donator may receive a fine of €150,000 (which can be multiplied by 5) or 50% of the expenses incurred for the breach and be condemned to 2 years’ imprisonment. 

(ii) The “Transparency” Law (Law No. 2019-774 on the organization & transformation of the healthcare system, CSP, Art. L1453-1), which impose donators (firms producing sanitary and cosmetic products) to disclose the links of interests with beneficiaries (HCPs, students, patient associations, influencers…) on a public database, such as agreements (e.g. speaker agreements), remunerations or any other advantages. Otherwise, the law provides for penalties, such as a fine of €45,000, a prohibition to practice or an exclusion of the public tenders. 

According to ANSM Recommendations, rules applicable to health professionals can be extended to patient associations in view of their role in supporting patients (e.g. they can have access to congresses reserved for health professionals). 

There are two options of partnering and cooperating in the distribution and promotion of medical software/DTx that could raise legal challenges: 

• The manufacturer provides for free a license/sample of the medical software/DTx to a health professional, who can provide it to its patients. This may be a breach of the Anti-Gift law (please refer to Section 2.b). 
• The manufacturer compensates a health professional for promoting the medical software/DTx, e.g. in a medical congress (speaker agreement). This kind of partnership has to be carefully reviewed to avoid breaching the Anti-Gift law as well as the Transparency law (please refer to Section 2.b). 

More generally, in France, using a cooperation partner for promoting medical software/DTx is strictly regulated. In this regard, the Public Health Code prohibits the reference to recommendation from a person who may, by their reputation, encourage its use (except if the advertising concerns a class I or IIa medical device) (Art. R5213-1).  

Furthermore, the new Law No. 2023-451 regulating commercial influence and fighting the abuses of influencers on social networks of 9 June 2023 further restricts the possibility of partnerships with influencers, whether they are health professionals or not: 

• It is now confirmed that the rules governing advertising of health products (including DTx/medical software) are applicable to the activity of commercial influence; 
• The law imposes to influencers, their agents or advertisers to sign written contracts above a certain threshold of remuneration or benefits in kind (to be further defined by decree). These contracts will have to include certain mandatory clauses: missions entrusted, remuneration conditions, submission to French law when subscribers in France are concerned. Please note that, in case of breach, both the advertiser and the influencer can be jointly liable. 
• It imposes influencers to better inform their subscribers by clearly indicating "advertising" or "commercial collaboration" on their promotional content. 

Besides, the Charter for Communication and Promotion of Health Products on the Internet and e-Media (2014) regulates the online promotion and distribution of medical software/DTx. It targets any website or service that an operator would voluntarily bring to the attention of the French public or HCPs. In particular, it prohibits the promotion of any health products on social networks, unless such networks allow to moderate the users’ comments and to deactivate certain modalities (e.g. “like”, “comment” or “share”). Besides, advertisements reserved to HCPs shall be displayed on sites that can only be accessed by HCPs. Even if this Charter does not specify sanction by itself, it is based on the Public Health Code (e.g. objectivity of the advertising), and may therefore lead to the same penalties. 

There are 3 main ways of distribution which are open to the manufacturer in France: 

• Business to Customer (B2C), e.g. when the patients directly download the app. In this event, the sale will be subject to the rules of the French Consumer Code will apply (pre-contractual mandatory information, legal guarantee, right of withdrawal, prohibition of misleading practices…); 
• Business to Business (B2B), e.g. when the manufacturer sells the DTx to a private insurance or an employer, who will provide it to its members or employees. In this case, the rules of the French Commercial Code regulating sales between professionals will apply (obligations to communicate T&Cs of sale to buyers who request them, legal warranty against hidden defects...); 
• Service to government (B2G), e.g. when the manufacturer sells its DTx to hospitals or any other public entity. In this event, the rules of the Public Procurement Code will apply (advertising and competitive tendering, specific procedures for payment such as deadlines, invoicing procedures…).

Possible customers and payors financing the software can either be (i) the actual patients (for B2C service), (ii) healthcare organisations or companies wishing to offer the DTx to their employees as employer benefits (for B2B service). It can also be insurance companies, especially the public health insurance scheme for DTx and tele-surveillance since the Law of Social Security Financing Act for 2022, December 23, 2021 for 2022. Please refer to Section 3.d) for further information. 

The monetization by sales to private parties/payors will depend on the qualification of the DTx. If it is intended to the customers, it may be reimbursed and must therefore comply with the applicable conditions in terms of pricing as described below. For instance, in the event of early coverage, the manufacturer's remuneration (i.e. packages) and the billing frequency are determined by the Ministry of Health, as well as the amount of financial compensation. Otherwise, if it is provided to health professionals, it will not be reimbursed, but it will be more flexible in terms of pricing. 

Generally, any contract entered into by a service provider to offer a medical software to a public or private entity responsible for managing the public healthcare system in exchange for a price would be a public contract subject to public procurement law, which implies that this contract be preceded by a tender procedure. 

This being specified, there is no generic assumption regarding the monetisation by sales to public entities/the public healthcare system of the medical software/DTx as different kinds of entities, whether public or private, may be involved in the French healthcare system. For example, while the French national health insurance authority is a public body, local health insurance bodies are private entities. 

If a public contract is concluded with a public entity (e.g. public hospital or the national health insurance authority), then not only will the rules of public procurement apply but also will payment have to be made according to specific procedures (payment deadlines, invoicing procedures, supporting documents to be provided by the public entity to its public accountant, etc.).   

This being noted, for further details, a case-by-case analysis is required, depending on the public or private entity involved in the social security system. Our lawyers specialized in Public Law can assist you on this specific matter. 

Several paths are open to obtain reimbursement by social security of DTx, as specified below. In most cases, reimbursement is subject to the prior grant of a certificate of compliance with the interoperability and security reference system provided for in Article L. 1470-5 of the Public Health Code ("Référentiel d’interopérabilité et de sécurité des Dispositifs Médicaux Numériques”). This certificate is granted by the Digital Health Agency (“l’Agence du Numérique en Santé »). 

1. Early coverage regime:  

In France, DTx can be reimbursed by the health insurance scheme for a non-renewable period of 1 year (Art. L. 162-1-23 of the Social Security Code), if it satisfies to the following conditions: 

• The digital medical device is presumed to be innovative (particularly in terms of clinical benefit or progress in the organization of care, based on the first available data and taking into account any relevant comparators); 

• The device is CE marked. In this respect, please note that the GMED has been designated as a Notified Body in France by the ANSM; 
• The operator guarantees compliance with the rules on personal data protection, as well as applicable interoperability and security standards; 
• The system enables processed data to be exported in appropriate, interoperable formats and nomenclature, guaranteeing direct access to the data. 

Both digital medical devices for therapeutic purposes (or digital therapies) and digital medical devices used in the context of a telemonitoring activity fall within the scope of the early coverage.  

The Decree No. 2023-232 of 30 March 2023 implements these new rules regarding (i) the procedures for assessing the conditions for reimbursement, (ii) the rules for setting the amount of financial compensation and (iii) the procedures for paying it. 

1. General reimbursement regime:  

Two ways are possible: a “brand name” entry on the list of reimbursable products (for products without equivalent) or a “generic” entry. 

• Entry under a “brand name” 

Entry under a “Brand name” is destinated to DTx manufacturers who believe that their product does not fit any generics (diabetes, heart failure, renal failure, respiratory failure, and therapeutic implantable heart prostheses) and that it provides an improvement of the service provided by a conventional medical service. 

A DTx manufacturer can apply to register under a brand name: 

• after having obtained the DTx's certification of compliance with the DMN interoperability and security reference system; 
• after consulting the National Commission for the Assessment of Medical Devices and Health Technologies (CNEDiMTS). 

To obtain the registration on the list, manufacturers must submit a common file; with the Department of Social Security (DSS) and the High Authority for Health (HAS) on the dedicated Evatech platform. 

• Entry under a generic description (for telemonitoring devices only) 

A DTx generic description corresponds to telemonitoring DTx which have the same indication, fulfill the same function, with common characteristics called “technical specifications” and for which the operators meet the same minimum requirements. 

A DTx manufacturer can apply to register under a generic description after having obtained the DMN's certification of compliance with the DTx interoperability and security reference system; 

Such reimbursement is subject to certain conditions, such as prior registration (Art. L162-52 of the Social Security Code), the quality of medical professional of the tele-surveillance operator (Art. L. 162-50 of the Social Security Code), a prior declaration to the regional health agency (“ARS”) (Art. L. 162-51 of the Social Security Code.  The Decree No. 2022-1767 of December 30, 2022 specifically concerns the coverage and reimbursement of tele-surveillance activities, while Decree No. 2022-1769 of December 30, 2022, defines the content of the declaration of tele-surveillance activities to the ARS. 

While these provisions entered into force on 1 July 2023, an agreement on the tariffs has been signed with the Ministry of Health. The order will be published shortly. 

1. Transitional reimbursement (PEC-T)  

This path is destinated for presumably innovative healthcare products with a therapeutic or disability-compensating purpose and falling within the scope of the list of reimbursable products and services provided for in Art. L.165-1 of the Social Security Code.