PRIVACY
We separate public information, account and professional information, and clinical information so each can be handled for the right purpose, by the right people, in the right workflow.
START WITH THE DATA
Privacy becomes easier to manage when the information is classified before it is used.
Ordinary website, marketing, and business-inquiry information belongs in public or business workflows—not in clinical workflows.
Account, credentialing, professional, training, and operational information is handled according to the user's role and the purpose for which it is needed.
Patient information and DICOM imaging belong in approved clinical workflows with access limited to authorized users and purposes.
CLINICAL PRIVACY MODEL
The radiologist should receive the information needed to do the assigned work without turning that access into unrestricted possession of the underlying DICOM file.
Identify the information as clinical, account, business, or another data class before use.
Determine the purpose, role, and scope that justify access.
Give the user only the access needed for the approved task.
Apply the approved legal, clinical, contractual, and operational lifecycle.
PRIVACY PRINCIPLES
Information should be used for the clinical, operational, educational, contractual, or business purpose that authorized its collection or access.
Access should be scoped to the people, roles, systems, and tasks that require the information.
Public, educational, testing, administrative, and clinical workflows should not be casually mixed.
Contracts and security review should define permitted use, access, breach duties, return, and deletion when required.
Retention and deletion should follow the approved legal, clinical, contractual, backup, and operational rules for the deployment.
Suspected unauthorized access, use, or disclosure should be investigated, documented, and handled under the applicable incident and notification process.
YOUR PRIVACY QUESTIONS
We aim to make the data path understandable: what information is collected, why it is needed, who is allowed to use it, and how long it remains.
Access, correction, deletion, restriction, opt-out, appeal, or other rights vary by data type, jurisdiction, and the organization's legal role. Requests are handled through the applicable verified process.
The prior Privacy page is preserved as a standalone reference with the fuller data-lifecycle baseline, staging boundaries, vendor controls, tracking and secondary-use rules, retention, and incident-response detail.
This page is a plain-language privacy summary, not a certification, legal opinion, or substitute for deployment-specific analysis. The applicable privacy duties depend on the data, customer, jurisdiction, contractual role, clinical function, and technical configuration.
