Consultation rooms, staff meetings, shared equipment (mobile ultrasound scanner, trolleys, liaison vehicles): in a healthcare facility, the schedule touches on care. A meeting title, a practitioner's name, a consultation room at a given time — this metadata can reveal health information and deserves the same minimisation reflex as the patient record.
The sector demands controlled hosting and strict traceability; a scheduling tool that does not collect your data simplifies the analysis instead of weighing it down.
In France, hosting health data on behalf of a third party is a regulated activity: HDS certification is required (Article L.1111-8 of the French Public Health Code). Room Flow does not claim that certification — and does not need it for your schedules: it does not host them. They stay in your calendars, on your infrastructure, under your own compliance framework.
Confidentiality covers all information that comes to the professional's knowledge (Article L.1110-4 of the French Public Health Code). A consultation schedule is metadata that can touch on it: entrusting it to a SaaS creates one more recipient to govern. Not outsourcing it removes the question at the source.
On the Swiss side, the Swiss FADP (in force since 1 September 2023) and medical professional secrecy (Article 321 of the Criminal Code) impose the same discipline: reducing the third parties with access to patient data — scheduling metadata included.
Each room is a calendar in your facility's mail system: booked by the secretariats, approved by the unit managers (administrator role) — without exposing the schedule to any third party.
Mobile ultrasound scanner, emergency trolley, liaison vehicle: anything that is a calendar can be booked, with no per-resource billing — the entire inventory can be covered.
A network outage does not block booking a room across the corridor: the application works offline, and the licence is verified locally with a signed certificate.
For your DPO: the portal holds only the organisation's account (name, e-mail addresses, seats, hashed device fingerprints) — never your bookings, attendees or purposes. The compliance sheet generated from the customer area lists exactly this data, its purposes and its retention periods, ready to feed into your analysis.
The question to ask any scheduling vendor is simple: do you hold our bookings? If the answer is yes, you must qualify the host, contract the processor, audit access. Room Flow answers no by construction: the application writes to your Zimbra/CalDAV calendars, and the vendor sees neither the rooms, nor the purposes, nor the attendees. Your impact assessment stays short because the outsourced processing does not exist.
Schedules, attendees and bookings live in your Zimbra/CalDAV calendars and on your workstations — not with the vendor, not in a foreign cloud subject to extraterritorial laws.
The licence is a signed certificate verified locally: the app keeps working without a connection, network outage included.
No trackers, no embedded analytics, no CDN: what the app does can be verified — nothing has to be taken on faith.
These points describe the product's architecture, not a sector certification. They are not legal advice: have your compliance reviewed by a specialist. Content to be reviewed by a lawyer before publication.