Security
What we guarantee for your data
When your facility entrusts its patients’ examinations to a third party, its own responsibility is at stake. This page sets out exactly what happens to an image from the moment it leaves your console until the moment it is deleted.
In transit
Between the clinic and the platform, examinations travel over an encrypted private network; the portal is accessible only over HTTPS. Between our services, traffic stays inside the server, and everything that leaves it (database, storage) is encrypted. No examination crosses the Internet in clear text.
At rest
Images and reports are encrypted at rest in dedicated object storage, separate from the database; backups are encrypted before they leave the server. Access to one does not give access to the other.
Isolation
Each organisation sees only its own examinations. Isolation is enforced by the database itself, on every request, not by the application code alone: a bug in the application code is not enough to bypass it.
Traceability
Accepting an examination for reading, viewing its images, signing, adding an addendum, each download of the report: every action is time-stamped and attributed to a named person, in a log that nobody can modify from the application.
Hosting
Images, reports, database and backups are hosted in the European Union; the deployment process verifies where storage is located. The location is stated in the contract and does not change without a contract amendment.
Retention
How long images are kept is set in the contract, for each facility: at the end of that period, they are removed from our servers and each deletion is logged. Without a set period, nothing is deleted automatically. Signed reports are kept for twenty years in locked storage: no one can alter or delete them. Encrypted backups expire no later than twelve months after they are made.
Reversibility
At any time, on request, your facility receives an export of its examinations and reports: DICOM images, signed PDFs, and a manifest of checksums to verify their integrity. Your data belongs to you.
Incidents
In the event of a data breach, your facility is informed without undue delay, with the nature of the incident, the data concerned and the measures taken.
Your obligations and ours
Your facility remains the controller of its patients’ data; IMAFRIK acts as a processor, on your instructions and within the scope defined in the contract. This allocation of roles, the security measures and the list of sub-processors are set out in a data processing agreement attached to every proposal.
No examination is used for any purpose other than producing the requested report: no model training, no identifiable statistics, and no disclosure to any third party not provided for in the contract.