In accordance with Article 14 of the General Data Protection Regulation (GDPR) and Article 69 of the French Data Protection Act (loi « Informatique et Libertés »), this notice informs patients whose health data are being reused in the ONCOVAL project.
Project: ONCOVAL, Anonymised Oncology for Data Valorisation and Analysis.
Data controller: BIG DATA SANTÉ (“Octopize”), a French simplified joint-stock company (SAS) registered with the Nantes Trade and Companies Register (RCS) under number 839 370 681, 48 bd Lelasseur, 44100 Nantes, France.
Authorisation: Decision (délibération) No. 2026-112 of the CNIL (French Data Protection Authority) dated 8 October 2026, following a favourable opinion from the CESREES (Ethics and Scientific Committee for Research, Studies and Evaluations in the Field of Health) dated 7 May 2026.
Purpose
To create an anonymous synthetic dataset (fictitious patient profiles) from data on patients treated in oncology, using Octopize’s anonymisation technology, in order to facilitate research in this field. As part of the “Industrial Data Sharing” call for expressions of interest launched by the French Health Data Hub (Plateforme des données de santé, “HDH”), these data may be published as open data by the HDH, subject to terms of use, once their anonymous nature has been verified and validated.
Legal basis
Octopize’s legitimate interest (Article 6(1)(f) GDPR). The processing of health data is permitted under Article 9(2)(j) GDPR and Article 44(3°) of the French Data Protection Act.
Data concerned
- Roche’s “Personalised Reimbursement Model” (PRM) study, 2015–2020: 25,000 female patients with breast cancer and 5,000 patients with lung cancer.
- Medipath anatomical pathology and medical biology laboratories: 500 patients with lung cancer, followed between 2016 and 2023.
Octopize only accesses pseudonymised data (no surname, first name or social security number): year of birth, sex, date of death where applicable, diagnoses, laboratory test results, weight and height, dates of care and treatments. No data are transferred outside the European Union.
Recipients and retention period
The data are hosted by the HDH, acting as Octopize’s processor, in its secure project environment. Only a limited number of Octopize staff members have access to them. The data are deleted no later than 24 hours after delivery of the final reports on the anonymous nature of the synthetic data (expected project duration: 12 months). Only the anonymous synthetic data may be published.
Your rights
You have the right to object, and the rights of access, rectification, erasure and restriction of processing.
These rights can only be exercised within 30 days of the publication of this notice (Roche patients) or of receipt of the information letter from Medipath (Medipath patients). Processing does not begin before this period ends, and the data of individuals who have objected are not transmitted.
After this period, the data are transmitted without direct identifiers, and neither Roche nor Medipath keeps any correspondence table. It is then no longer possible to directly retrieve an individual’s data, unless that individual provides information enabling their re-identification (Article 11 GDPR).
To exercise your rights, please write to Octopize’s Data Protection Officer (dpo@octopize.io), to Roche (france.donneespersonnelles-pharma@roche.com) or to Medipath (dpo@medipath.fr), providing proof of your identity. You may also lodge a complaint with the CNIL (www.cnil.fr).
Date of publication: 6 November 2026
