Polnor.
How it works

Raw FHIR to a deployed model, without the data ever leaving your cloud.

Polnor runs the entire health-data lifecycle, ingestion, de-identification, OMOP structuring, analytics and AI, inside your own infrastructure. Our platform issues the instructions; your patient data never crosses the boundary. Here is exactly how that works.

The architecture

Two planes, one boundary the data never crosses.

Polnor is split in two. The control plane, the orchestrator, the SQL compiler, the scheduler, is operated by us. The data plane, your patient records, your compute, your models, lives entirely in your cloud, on an HDS-certified host. Only instructions travel from left to right. Data never travels back.

Our side · control plane
orchestration · DAGs · scheduling
SQL text · table metadata
access log · task state
no patient data, ever
Your side · data plane
patients · observations (PHI)
lab results · clinical reports
OMOP tables · cohorts · features
trained models · endpoints

Concretely: a lightweight agent runs in your namespace, connects out to the control plane, and executes the work locally against your object storage and compute. The control plane persists no derived data; logs, query outputs and model artifacts are written back to your bucket, not ours.

The pipeline

Five stages, from source system to production model.

Each stage is pre-built and runs in your cloud. You connect a source once; the platform carries the data from raw FHIR to AI-ready cohorts and deployed endpoints, without you rebuilding the health-data plumbing.

Step 1 · Ingestion

Connect your source at the FHIR standard

Patient records, lab results and clinical reports are pulled from your FHIR server via a $export job and normalized to FHIR R4. Every resource type lands as its own typed “bronze” table, instead of dozens of incompatible extracts.

FHIR connectors + automated $export pull
One typed table per resource, written to your bucket
ingestion · fhirbronze
resourcerowsstatus
Patient12,480✓ ready
Observation1,204,933✓ ready
Condition88,210✓ ready
MedicationRequest301,774✓ ready
Step 2 · De-identification

Remove what identifies a patient, keep what serves the science

Column-level presets mask direct identifiers, generate stable pseudonyms (so records still link across tables), shift dates consistently and bucket ages. The transformation runs in your cloud, the raw values never reach us. Toggle it on the sample:

GDPR-compliant clinical presets, executed in your cloud
Stable, collision-safe pseudonyms, linkage preserved
table · patients
nameinsbirthdx
Marie Durand2 85 03…12/03/1985E11
Jean Bernard1 78 11…30/07/1978I10
Amina Cherif2 90 06…05/06/1990J45
Step 3 · Structuring

Convert to OMOP, with clinical quality control

The de-identified data is flattened to a “silver” layer, then converted to the OMOP Common Data Model, the reference schema of the global research community (OHDSI). Source codes are mapped to standard concepts, and automated checks catch out-of-range values before they reach analysis.

Standardized concept mapping (LOINC, ICD-10, ATC → OMOP)
Unit-aware, physiologically-bounded quality checks
omop · mappingsilver → gold
source→ OMOP conceptstd
loinc:2339-0Glucose [Mass/Vol]S
icd10:E11Type 2 diabetesS
atc:A10BA02metforminS
Step 4 · Analytics

Build cohorts and features, in SQL or notebooks

Query your OMOP tables directly: assemble cohorts, join lab and clinical data, and materialize features, in SQL or in a notebook, on compute that sits next to the data. Nothing is exported to run an analysis.

Cohort builder, SQL warehouse, notebooks and feature store
cohort.sqlomop
SELECT person_id, avg(value) glycemia
FROM measurement
WHERE concept = 'glucose'
  AND age > 50
GROUP BY person_id;
Step 5 · AI

Train and serve models, next to the data

Track experiments with MLflow, version your models in the registry, and deploy inference endpoints, all co-located with the data they were trained on. From cohort to production model, nothing is exported. The MLflow tracking API is drop-in compatible, so your existing training code runs unchanged.

MLflow tracking, model registry and serving in your cloud
mlflow · runserved
modelAUCendpoint
readmission-30d0.87/v1/predict
sepsis-early0.91/v1/sepsis
The boundary, precisely

What crosses, and what never does.

“Health-blind” is not a slogan; it is an architectural guarantee. Here is what the control plane can and cannot touch.

Crosses: instructions

SQL text, job definitions, DAG orchestration and table metadata. Enough to schedule and compile work, never the rows themselves.

Never crosses: PHI

Patient records, lab results, cohorts, features and trained models stay in your bucket. Query outputs and logs are written back to your storage, not ours.

Yours throughout

Your cloud credentials are encrypted, data residency is configurable, and every access is logged. We never train our models on your data.

End to end

A diabetes cohort, from question to result, nothing exported.

The same workspace your team uses day to day. A query runs against your OMOP tables in your cloud; the result is counted, not extracted.

app.polnor.net / health-prod● health-blind
health_prod › omop › diabetes_cohort.sql
▶ Run-- T2 diabetes cohort · mean glycemia SELECT person_id, avg(value) AS glycemia FROM measurement WHERE concept = 'glucose' AND age > 50 GROUP BY person_id;
results · 12,480 rows0 rows exported ✓
person_idglycemian
p_8f3a…1.42 g/L36
p_2b71…1.28 g/L28
p_c04e…1.67 g/L41
Governance & compliance

The traceability healthcare demands, built in.

HDS hosting

Deployed with HDS-certified hosts (OVHcloud, Scaleway). Your cloud, your country.

PHI access log

PHI classification, an access log over health data, and retention rules. Audit-ready.

EHDS export

Export manifests aligned with the European Health Data Space (EHDS).

Getting started

Onboarding is measured in weeks, not years.

The health-data complexity is already solved. You bring your cloud and your source; the pipeline is pre-built.

1

Connect your cloud

Bring your own OVHcloud or Scaleway account. Encrypted credentials, your VPC, your bucket. The agent deploys into your namespace.

2

Plug in your FHIR source

Point Polnor at your FHIR server or a bucket of bundles. The $export pull and bronze tables are configured for you.

3

Run the pipeline

De-identification, OMOP and quality control run end to end. Your team is querying AI-ready cohorts in weeks.

Technical questions

How it works, in detail.

Where does the compute actually run?+
In your cloud. An agent runs in your namespace and executes jobs, SQL and model training against your own object storage and compute (OVHcloud or Scaleway). The control plane schedules and compiles the work but never runs it on our infrastructure.
What can Polnor see?+
SQL text, job and DAG definitions, table metadata, task state and an access log, the instructions needed to orchestrate work. Never the rows: patient data, cohorts, features and models stay in your bucket, and query outputs and logs are written back there, not to us.
Which standards do you support?+
FHIR R4 for ingestion, the OMOP Common Data Model (OHDSI) for structuring, standard terminologies (LOINC, ICD-10, ATC), Apache Iceberg tables, and an MLflow-compatible tracking and registry API for the AI layer. Governance is aligned with GDPR and EHDS.
Do we have to move or copy our data to you?+
No. There is nothing to migrate to Polnor. Your data is created, transformed and stored entirely within your own cloud; the platform operates on it in place.
Can we use our own models and tools?+
Yes. The MLflow tracking API is drop-in compatible, so existing training code, autologging and the model registry work unchanged. You can bring your own frameworks and deploy the resulting models to endpoints next to the data.
How long until we see results?+
Because the FHIR → de-identification → OMOP pipeline is pre-built, teams typically go from a connected source to AI-ready cohorts in weeks. The alternative, rebuilding ingestion, anonymization, OMOP and HDS governance in-house, is a multi-year program.
See it on your data

Watch the full pipeline run in your cloud.

In a 30-minute demo we start from your data and walk the complete flow, FHIR → de-identified → OMOP → analytics → AI, without a single row leaving your infrastructure.