MAGE-X Health Data Warehouse

Last updated: 19/10/2026

MAGE-X is authorised by the CNIL, the French data protection authority, to operate a health data warehouse (EDS) named “EDS MAGE-X”. It brings together pseudonymised data from the patient records kept by healthcare professionals and outpatient care facilities, in order to carry out research, studies and evaluations in the field of health.

This page is the information notice for the patients and healthcare professionals concerned, as required by Article 14 of the GDPR. The French version is the reference version.

CNIL authorisation

Decision DT-2026-023 of 1 October 2026

Therapeutic area

Chronic spinal conditions

Data

Pseudonymised, without name, contact details or social security number

Retention

20 years maximum

1. Data controller

MAGE-X
SAS – 232 Avenue du Prado, 13008 Marseille, France
Data Protection Officer (DPO): rgpd@mage-x.fr

2. Purpose of the warehouse

The warehouse brings together health data to enable research, study and evaluation projects in the field of health that serve the public interest. These projects may be carried out by MAGE-X or by third-party public or private organisations.

Each project using the warehouse must be justified by the public interest and complete its own formalities with the CNIL. The warehouse’s scientific and ethics committee reviews every request to use the data.

Under Article L. 1461-1 of the French Public Health Code, the data may never be used for:

• promoting health products to healthcare professionals or healthcare facilities;
• excluding cover from insurance contracts, or changing insurance contributions or premiums.

3. Legal basis

• Legitimate interest of MAGE-X (Article 6(1)(f) GDPR): enabling research, studies and evaluations in the field of health.
• Health data: processing necessary for scientific research purposes (Article 9(2)(j) GDPR and Article 44, 3° of the French Data Protection Act).
• CNIL authorisation: decision DT-2026-023 of 1 October 2026 (application no. 9-948), for a period of 10 years.

4. Data subjects

• Patients, adults and minors, with a chronic spinal condition and followed by a healthcare professional or outpatient care facility using MAGE-X software.
• Healthcare professionals using MAGE-X software.

5. Data processed and source

The data comes from the patient records kept by the healthcare professionals and outpatient care facilities that use MAGE-X software. They minimise and pseudonymise the data before it enters the warehouse.

Patients

• Medical data from the patient record (for example: diagnosis, examinations, treatments, follow-up)
• Age and sex

Your name and your postal and email addresses are never stored in the warehouse: they are used only to send you this information, then deleted. Your social security number (NIR) is not collected.

Healthcare professionals

• Medical specialty
• A non-identifying code, generated from the professional’s identifier in the patient record software

6. Recipients

• Authorised MAGE-X staff, within the limits of their duties. Teams carrying out marketing or promotional activities have no access to the data.
• The teams of public or private organisations whose project has been approved and has completed its CNIL formalities, only for the data that project needs.
• MAGE-X’s processors, bound by contract (Article 28 GDPR): the HDS-certified hosting provider, and the healthcare professionals and care facilities that inform patients and receive their requests to exercise their rights.

7. Hosting and security

The data is hosted in France by OVHcloud, on infrastructure certified HDS, ISO 27001, 27017, 27018 and 27701. It is encrypted at rest and in transit, and every access is logged. It is not transferred outside the European Union.

The warehouse is subject to the security framework applicable to the French National Health Data System (SNDS) (order of 6 May 2024).

8. Retention period

• Data from medical records: 20 years maximum from its collection in the course of care.
• Name and contact details: deleted once the information notice has been sent.

9. Your rights

You have the right to access, rectify and erase your data and to restrict its processing, as well as the right to object to its use in the warehouse.

Because the warehouse data is pseudonymised, MAGE-X cannot identify you directly. To exercise your rights, please contact first the healthcare professional or care facility that follows you: they act on behalf of MAGE-X and will handle your request. You may also write to the MAGE-X DPO: rgpd@mage-x.fr.

For a minor patient, these rights are exercised by the holders of parental authority.

If you believe your rights have not been respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.

10. Projects using the warehouse

The list of research, study and evaluation projects carried out using the warehouse will be published and kept up to date on this page.