Enterprise Privacy & Healthcare Data Policy

1. Introduction & Regulatory Scope

ClinicalRIS is an enterprise medical software platform operated by Claridad Health Solutions ("Claridad", "we", "us", or "our"). We provide Radiology Information Systems (RIS), Picture Archiving and Communication Systems (PACS), diagnostic reporting tools, and AI CAD integrations to hospitals, imaging centers, teleradiologists, and referring physicians.

This Privacy Policy describes how we handle information in compliance with global health privacy regulations, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, the General Data Protection Regulation (EU GDPR / UK GDPR), and applicable national medical data laws.

2. Categories of Information We Process

Depending on your interaction with ClinicalRIS, we process three distinct categories of data:

2.1 Protected Health Information (PHI)

When healthcare providers upload DICOM images or generate diagnostic reports, we process PHI on behalf of the Covered Entity. This includes:

• Patient Identifiers: Full name, Medical Record Number (MRN), Date of Birth, gender, national health identifier, and contact details.
• Diagnostic DICOM Metadata & Pixels: X-ray, CT, MRI, Ultrasound, Mammography, and Nuclear Medicine imaging series containing embedded DICOM tags.
• Clinical Reports & Orders: Radiologist findings, impressions, critical findings alerts, dictation audio, and referring physician orders.

2.2 Professional Account Data

Information collected when healthcare staff create account credentials:

• Full legal name, professional medical license numbers, clinical sub-specialties, NPI numbers, and digital signatures.
• Institutional email address, organizational role, center assignments, and multi-factor authentication (MFA) parameters.

2.3 Telemetry & Diagnostic Logs

Automated system telemetry collected to maintain 99.99% uptime and security audit compliance:

• IP address, browser user-agent, session tokens, DICOM WADO-RS retrieval latencies, and granular user action timestamps.

3. HIPAA Business Associate Framework (45 CFR § 164.502)

Under HIPAA regulations, Claridad Health Solutions acts strictly as a Business Associate to healthcare providers ("Covered Entities").

• Business Associate Agreement (BAA): Prior to processing PHI, Claridad executes a standard BAA with Covered Entities governing permissible uses, data retention, administrative safeguards, and breach notifications.
• Minimum Necessary Standard: Systems restrict access to PHI based on role-based access control (RBAC). Technologists, radiologists, and billing personnel only view data required for their specific clinical workflows.
• De-identification Standards: Any data utilized for AI benchmarking or platform quality assurance is fully de-identified in strict accordance with HIPAA Safe Harbor principles (45 CFR § 164.514(b)(2)).

4. GDPR & International Data Subject Rights

For users and patients residing within the European Economic Area (EEA), United Kingdom, or jurisdictions with international privacy rights:

5. Cryptographic Controls & Security Standards

ClinicalRIS implements defense-in-depth cryptographic controls across all infrastructure tiers:

• Data at Rest: DICOM object stores, PostgreSQL databases, and audit logs are encrypted using AES-256 GCM with keys rotated automatically via hardware security modules (HSM).
• Data in Transit: All HTTP connections require TLS 1.3 (with fallback to TLS 1.2 using strong cipher suites). Cleartext HTTP is disabled.
• Session Security: Keycloak OAuth2 / OpenID Connect tokens with HTTP-only, secure, SameSite cookies and short token lifetimes.

6. Infrastructure Sub-processors

We partner with Tier-IV compliant cloud providers to deliver cloud hosting, container orchestration, and AI inference. All sub-processors undergo rigorous SOC 2 Type II vendor audits and execute HIPAA BAAs:

7. Incident Response & 72-Hour Breach Notification

Claridad Health Solutions maintains a dedicated Security Operations Center (SOC) monitoring platform telemetry 24/7. In the unlikely event of a confirmed security incident impacting PHI:

• 72-Hour SLA: Affected Covered Entities will be notified in writing within 72 hours of incident confirmation, detailing the scope of impacted records and immediate remediation steps taken.
• Regulatory Filings: Claridad assists Covered Entities with required filings to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) or European Data Protection Authorities.

8. Contact Our Data Protection Officer (DPO)

For privacy inquiries, BAA requests, or Data Subject Access Requests (DSAR), contact our compliance team: