Why Doctolib users in France are being asked about AI research

It may have looked like just another promotional email - Doctolib s'engage dans la recherche pour améliorer la santé' (Doctolib is engaging in research to improve your health) but it was actually notifying users about a major change.

The email should have been sent to anyone who has an account with Doctolib, the widely used medical app and website.

READ ALSO: How to use: French medical website Doctolib

From August, France's biggest medical appointment platform is launching a research programme that will use the health data of millions of users to help develop artificial intelligence tools for healthcare.

The idea is to create AI that can help doctors spot health risks earlier, recommend the right tests or specialists, and improve patient care.

Not everyone is convinced, however. Privacy campaigners have raised concerns about how sensitive medical data will be used and the fact that users are automatically included unless they actively opt out.

Here's what you need to know about the change and how it will affect you.

What is changing?

Doctolib has set up a new research lab focused on what it calls "clinical AI", working with researchers from institutes like Inria, Inserm as well as the Université Paris Cité.

Its first project will run for three years and look at how artificial intelligence could help doctors make better decisions using patients' medical histories.

According to Doctolib, the technology isn't designed to replace doctors or give patients medical advice. Instead, it's meant to support healthcare professionals.

For example, it could help identify patients whose condition is getting worse, suggest additional tests, recommend a referral to a specialist, flag people who may be at higher risk of developing illnesses such as diabetes, or even help doctors diagnose rare diseases by comparing similar patient cases.

What data will be used?

The company says it may use demographic information and health data from adult users if it's relevant to the research.

That could include medical history, diagnoses, medications, treatment plans and information entered either by patients themselves or by healthcare professionals using Doctolib's software.

Medical documents such as prescriptions, blood test results and scans could also be included.

Doctolib says names and other identifying details will be removed before researchers access the data. The information will be stored for no longer than five years.

The company also says the data will stay in a secure European environment, only approved researchers will have access to it, and it won't be sold or used to train Doctolib's own commercial AI models.

Why is it controversial?

Several organisations, including the Human Rights League (Ligue des droits de l'Homme) and consumer group UFC-Que Choisir, have criticised the project.

Their biggest concern is that health information is among the most sensitive personal data people have. If it were ever leaked or stolen, they argue, it could expose people to discrimination or profiling.

Campaigners also question whether removing names from the data is enough to make it truly anonymous, pointing out that it can sometimes be possible to identify individuals using other pieces of information. They have also highlighted the growing number of cyberattacks affecting the healthcare sector in France.

Another criticism is that Doctolib uses Amazon Web Services to host some of its data. Although Doctolib says the research data will be securely hosted in Europe, campaigners argue that the involvement of a US company raises additional questions about data protection.

They have also criticised the fact that users are included in the research programme by default, rather than being asked to opt in first.

Can I say no?

Yes. Anyone with a Doctolib account can object to their data being used for the research project without affecting their ability to use the platform. 

You can opt out using the online form, which asks for your name and date of birth and for you to tick the box stating "Je souhaite, en application de l’article 56 de la Loi Informatique et Libertés, m’opposer à la réutilisation de mes données personnelles . . . " (I wish, under Article 56 of the Law on Digital Freedom, to oppose the use of my personal details).

You can also ask Doctolib to fully remove your data from the research database by contacting the company's data protection team (contact.dataprivacy@doctolib.com).  

If you object before the AI model's training phase begins in September, your data will be excluded from the research database.

Doctors who use Doctolib can also opt out. Some have complained that permission to reuse patient data for research was switched on by default when they accepted the company's updated privacy policy in 2024. Doctolib says they can change that setting at any time.

What does Doctolib say?

Doctolib says the project follows the rules set by France's data protection authority (CNIL) for medical research.

The company says the data will be encrypted, only authorised researchers will be able to access it, and it will never be shared for advertising or other commercial purposes.

It also points out that more than 10,000 health research projects in France already use the same legal framework, including many run by university hospitals using patient data.