A scheduling platform is becoming a data environment for medical AI. In France, Doctolib began research projects in August that can use users’ health and care data unless they object. The work involves public research partners and promises better care. That makes it a useful test case: with sensitive data, it is not enough to ask whether research is worthwhile. People also need to understand the purpose, the scope, and the way out.
Key takeaways
- In France, Doctolib can use health and care data from its platform for two AI research projects unless affected users object.
- The projects aim to analyze care pathways and assess the reliability of generative systems in medical settings.
- Pseudonymization is an important safeguard, but it is not anonymization: re-identification remains possible in principle when a matching key exists.
- France’s data protection authority, the CNIL, says AI data use must be explained in clear, accessible language and leave time for people to exercise their rights.
- The case is not a direct legal precedent for Germany, but it shows why an opt-out option should not be confused with an informed decision.
Research using data already in the system
Doctolib says it is working with Inria on clinical AI models intended to support health professionals and patients. The stated goals are sensible at first glance: coordinate care more effectively, identify risks earlier, and make medical AI more reliable. The consumer group UFC-Que Choisir likewise describes two research strands, one focused on improving care pathways and another on the reliability of generative models in health care. The listed partners include Inria, Inserm, and Université Paris-Cité.
The data involved are not merely abstract usage statistics. According to UFC-Que Choisir, they can include information recorded in medical practice software: medical history, medications, diagnoses, treatment progress, and documentation. They can also include material patients enter before appointments, such as questionnaires or referrals. Doctolib says the data are pseudonymized and processed within a legal framework. Both points matter, but neither answers every question about trust.
Pseudonymized does not mean anonymous
The terms are often blurred in ordinary conversation, although they describe different risks. With anonymized data, a person should no longer be identifiable. With pseudonymized data, a name is replaced by a code; whoever holds an additional matching key can reconnect the record to a person. UFC-Que Choisir highlights exactly this distinction. Pseudonymization reduces risk and is a valuable component of medical research. It does not turn the data into harmless spreadsheets for which transparency and access controls no longer matter.
The distinction matters even more when data from different parts of a care process are combined. A single appointment reveals little. A sequence of symptoms, medications, diagnoses, and outcomes can reveal a great deal about someone. The value of those connections is precisely why research wants to study them. That is also why the right to object must be as visible and understandable as the promised research benefit.
A right to object is only as good as its visibility
The CNIL states the standard plainly: an organization that reuses data to develop an AI system must inform affected people in advance. The information should be concise, transparent, understandable, and easy to access. For especially sensitive data, the authority also recommends a reasonable interval between notification and training so that rights can be exercised in practice. This is more than a formal obligation. It is a product requirement: a platform that leaves people to decide about their health data must make that decision possible without a privacy scavenger hunt.
Doctolib provides an objection form. That is better than offering no choice at all. But in an opt-out model, the work falls on the user: they must notice the message, understand the purpose, and act in time. People who use a scheduling platform because it is convenient will not necessarily study every privacy menu. This is not an argument against research. It is an argument against treating the default choice for particularly sensitive data as a footnote.
What Germany can learn from the French case
The specific Doctolib process concerns France and cannot simply be transferred to Germany. Health data are subject to stringent rules in Germany as well, but drawing quick conclusions about German services would mix established facts with speculation. The case remains useful because it sharpens the right questions: which data feed which model, who controls access, how long can the data be used, and how easy is it to object?
The debate also connects to a point we raised in our look at what ChatGPT stores about its users: privacy is not only a problem when data leave an organization. It begins with understanding what a service creates from ordinary use. In medicine, that transparency is not a convenience feature. It is part of the care relationship.
Progress needs a better default
Medical AI needs useful data, and valuable research should not fail because of a reflex against every form of data use. Systems that spot gaps in care or reduce routine work for clinicians can provide genuine value. But public interest in research does not replace the obligation to treat affected people as decision-makers. Pseudonymization, clear purpose limits, independent oversight, and an obvious route to object are not bureaucratic extras. They are the conditions under which a platform can earn the trust medical AI requires.