Can I register the office of my healthcare company at a business address?

Yes. No legislation prohibits it. The business address gives the company its legal location and receives its administrative mail. The precaution concerns mail relating to patients, which is better sent directly to the practice.

Can the staff of the business address provider open my patients' mail?

It is better avoided. This staff is not bound by medical confidentiality nor authorised to process health data. Having a patient's letter opened or digitised by an unauthorised third party creates a risk of breaching confidentiality, protected by article 226-13 of the French criminal code, and an RGPD concern.

Which mail can I let arrive at the registered address?

The company's administrative correspondence, the Urssaf, the tax authorities, the commercial court registry, the bank and the social security bodies. These are letters that contain no health data and relate to the life of the company, not to the follow-up of patients.

Where should test results and correspondence between fellow practitioners be sent?

Directly to your practice, where they will be opened by you or by staff bound by confidentiality. This correspondence contains health data and should not pass through an unauthorised third party.

The address provider is licensed and has a confidential room, is that enough to entrust patients' mail to it?

No. The law requires the address provider to have a room ensuring confidentiality and a file for each business (articles L.123-11-3 and R.123-168 of the French commercial code), but these obligations do not make it a holder of medical confidentiality. Patients' mail must continue to be sent to the practice.

Medical confidentiality and your business address

In short

Nothing prevents you from registering the office of a healthcare company at a business address, but the way you use that address calls for one simple precaution. The staff of a business address provider are not bound by medical confidentiality and are not authorised to process health data, which is sensitive data within the meaning of the RGPD. Having such staff open or digitise a patient's letter, a test result or correspondence between fellow practitioners creates a risk of breaching confidentiality, which is protected under criminal law by article 226-13 of the French criminal code, as well as an RGPD concern. The sensible rule is to reserve the registered address for the company's administrative correspondence, the Urssaf, the tax authorities, the commercial court registry and the bank, and to have any correspondence relating to patients sent directly to your practice, to be opened by the practitioner or by staff bound by confidentiality.

You work in a healthcare profession and you would like to register the office of your company, for example a société d'exercice libéral (a professional practice company) or a société civile de moyens (a cost-sharing company), at a business address. A question quickly arises, that of the mail. Medical confidentiality does not stop at the door of the practice, it follows any correspondence that contains information about a patient. Registering a company raises no difficulty in principle, but the way you use the address deserves one simple precaution. The essential point fits in a single sentence, the registered address is not designed to receive your patients' mail.

Two addresses, two kinds of mail

The business address gives your company its legal location. It is the address of the registered office, the one shown on the Trade and Companies Register, the one known to the tax authorities, the Urssaf, the commercial court registry and the bank. The company's administrative mail arrives there naturally, and that is what it is for. Your place of work, the practice, follows a different logic. That is where you see your patients, where their letters arrive, along with test results and the correspondence you exchange with fellow practitioners. These two flows are not of the same nature, so they do not call for the same handling or the same address.

What professional secrecy protects

Professional secrecy is not merely a matter of professional ethics, it is protected by criminal law. Disclosing secret information by a person who holds it, by virtue of their status or profession, is punishable by one year's imprisonment and a fine of 15,000 euros (article 226-13 of the French criminal code). A practitioner who lets a third party access information covered by professional secrecy does not only create difficulties towards their patients, they expose themselves to a criminal offence. A letter that mentions a person's state of health, their treatment or their follow-up falls squarely within this scope.

The staff of a business address provider are not bound by medical confidentiality

A business address provider receives, sorts and, depending on the contract, forwards or digitises the mail of the businesses it hosts. Its staff are neither care professionals nor medical auxiliaries. They are not bound by medical confidentiality and they are not authorised to process health data. Yet health data is sensitive data within the meaning of the General Data Protection Regulation (RGPD), which gives it reinforced protection. Entrusting it to a party that has no standing to process it is not a neutral act.

Having this staff open and digitise a patient's letter, a test result or correspondence between fellow practitioners creates a real risk. A risk in terms of confidentiality first, since a person who does not hold the secret gains knowledge of protected information. A risk in terms of the RGPD next, since health data ends up being processed by a third party that has no standing to do so. This risk does not depend on the provider's good faith, it stems from the nature of the information and from the standing of whoever handles it.

The sensible rule, separate the flows

No legislation prohibits registering the office of a healthcare company, and no legislation sets out, letter by letter, a list of what must arrive where. Prudence, on the other hand, calls for a clear separation. Reserve the business address for the company's administrative correspondence, the Urssaf, the tax authorities, the commercial court registry, the bank and the social security bodies. Have any correspondence relating to a patient sent directly to your practice, where it will be opened by you or by staff bound by confidentiality, your medical secretariat for example. This arrangement costs nothing, it simply requires giving the right address to the right party.

Which mail to send where

Type of mail	Preferred address
Urssaf, tax authorities, commercial court registry, social security bodies	Business address (registered office)
The company's bank and insurers	Business address (registered office)
A patient's letter	The practice, opened by the practitioner or by staff bound by confidentiality
Test result, medical report	The practice
Correspondence between fellow practitioners	The practice

One point deserves attention, that of the scanning and forwarding services that business address providers often offer. They are convenient for administrative mail, but they specifically involve a third party opening and scanning your letters. That is why patients' mail has no place in this process. If you need paperless handling of such correspondence, it must be organised at the practice, under your responsibility and that of people bound by confidentiality.

What the law already requires of the address provider

The business address activity is regulated. The law requires the address provider to have premises with a room suitable for ensuring confidentiality, and to keep a file for each business it hosts (articles L.123-11-3 and R.123-168 of the French commercial code). These obligations are useful and serious, but they do not turn the provider into a holder of medical confidentiality. A confidential room protects the confidentiality of the company's business affairs, it grants no one the standing to gain knowledge of health data. The precaution therefore remains fully necessary, the fact that the address provider is licensed and rigorous is no reason for patients' mail to pass through it.

Your responsibility for your correspondence

This vigilance also applies within your own organisation. The practitioner must ensure that the people assisting them do not breach the secrecy attached to their professional correspondence. This concerns your secretariat, but also any outside provider that may handle your mail. Deciding which mail arrives where is precisely how you exercise that vigilance. By directing sensitive correspondence to the practice and administrative correspondence to the registered office, you keep control over what third parties see and do not see.

For the framework that applies to practitioners, you can consult our page on business addresses for healthcare professionals.

Key points to remember

Professional secrecy is protected under criminal law, one year's imprisonment and a fine of 15,000 euros (article 226-13 of the French criminal code).
The staff of a business address provider are not bound by medical confidentiality and are not authorised to process health data, sensitive data within the meaning of the RGPD.
Having a patient's letter, a test result or correspondence between fellow practitioners opened or digitised by an unauthorised third party creates a risk of breaching confidentiality and an RGPD concern.
As a precaution, reserve the registered address for administrative correspondence (Urssaf, tax authorities, commercial court registry, bank) and have mail relating to patients sent to the practice.
The address provider must have a room ensuring confidentiality and keep a file for each business (articles L.123-11-3 and R.123-168 of the French commercial code), which does not make it a holder of medical confidentiality.
The practitioner must ensure that the people assisting them do not breach the secrecy of their professional correspondence.

Frequently asked questions

Can I register the office of my healthcare company at a business address?: Yes. No legislation prohibits it. The business address gives the company its legal location and receives its administrative mail. The precaution concerns mail relating to patients, which is better sent directly to the practice.
Can the staff of the business address provider open my patients' mail?: It is better avoided. This staff is not bound by medical confidentiality nor authorised to process health data. Having a patient's letter opened or digitised by an unauthorised third party creates a risk of breaching confidentiality, protected by article 226-13 of the French criminal code, and an RGPD concern.
Which mail can I let arrive at the registered address?: The company's administrative correspondence, the Urssaf, the tax authorities, the commercial court registry, the bank and the social security bodies. These are letters that contain no health data and relate to the life of the company, not to the follow-up of patients.
Where should test results and correspondence between fellow practitioners be sent?: Directly to your practice, where they will be opened by you or by staff bound by confidentiality. This correspondence contains health data and should not pass through an unauthorised third party.
The address provider is licensed and has a confidential room, is that enough to entrust patients' mail to it?: No. The law requires the address provider to have a room ensuring confidentiality and a file for each business (articles L.123-11-3 and R.123-168 of the French commercial code), but these obligations do not make it a holder of medical confidentiality. Patients' mail must continue to be sent to the practice.

Sources as of 20 September 2026: French criminal code, article 226-13; French commercial code, articles L.123-11-3 and R.123-168; RGPD (health data). Domisiège, business address services in Tours, backed by the firm Épiphyse Conseil. This article gives general guidance and does not replace a review of your own situation.

Medical confidentiality and mail, the precautions with a business address