Data Processors (Sub-Processors) 

Which process the data that is stored/uploaded into the Collective Minds® platform (acting as Processors) to provide the Services

Subprocessor

Processing Activity

Purpose

Country/Region

Main safety measures

Amazon Web Services Germany GmbH (AWS)

Hosting provider

To store the Platform and the data contained in the Platform: The Collective Minds® platform is hosted here.

Germany

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to uploading the data into AWS GmbH Servers.

Encryption and enforced safety measures provided by AWS to ensure confidentiality, integrity and availability.

Signature of a DPA that includes the signature of additional undertakings and safety measures, including the signature of the EU SCCs.

Optional Sub-processors

Depending on the premium services you decide to activate or use (only available on-demand and when explicitly agreed with each Data Controller)

General information to take into account: 

We only share data with Sub-Processors at the request of a user/Data Controller. We never provide access to our system/Platform to AI providers/partners, the datasets are only sent to them through a secure and verified channel.

In any case, the data is curated and minimized (using anonymization techniques) before being shaed with any AI providers/partners. Therefore, we never share with them directly identifiable data, only previously pseudonyimised  and minimised/anonymised datasets (each Data Controller holds the pseudonymisation key, which cannot be shared) and only the necessary information for the Sub-Processor to process the data.

Datasets sent by Collective Minds must be deleted or returned once the results have been obtained and the AI provider/artner has processed them (unless otherwise explicitly instructed by the Data Controller). 

Subprocessor

Processing Activity

Purpose

Country/Region


Main safety measures

Icometrix

AI analysis of Radiological data

AI engine(s): icobrain-dm, icobrain-ms, icobrain-tbi, icolung,

Belgium

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures.

Gleamer

AI analysis of Radiological data

AI engine(s): boneview

France

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures.

Incepto Medical

AI analysis of Radiological data

AI engine(s): Keros, Arva

France

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures.

Contextflow

AI analysis of Radiological data

AI engine(s): SEARCH lung CT

Austria

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures.

Radiobotics

AI analysis of Radiological data

AI engine(s): RBknee

Denmark

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures.

AISentia

AI analysis of Radiological data

AI engine(s): AAA

United Kingdom

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures.

Subtle Medical

AI analysis of Radiological data

AI engine(s): SubtleMR, SubtlePET

United States of America

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures. Signature of the Processor-to-Processor EU Comission Standard Contractual Clauses (SCCs).

BrainScan

AI analysis of Radiological data

AI engine(s): BrainScan

Poland

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures.

Smart Soft Healthcare

AI analysis of Radiological data

AI engine(s): CoLumbo

Bulgaria

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures.

Lunit

AI analysis of Radiological data

 

South Corea

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to transfer any dataset to the Sub-Processor.


Encryption and enforced safety measures and other measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of additional undertakings and safety measures. South Corea is under an EU adequacy decision and not required to sign SCCs. 

Data Processors (when we are acting as data Controllers)

That help us process data about users, clients, and partners who access, use, and interact with our services

Subprocessor

Categories of data and data subjects

Processing Activity

Purpose

Country/Region


Main safety measures

Amazon Web Services Germany GmbH (AWS)

Encrypted and pseudoyimised users, clients, and partners data 

Hosting provider

To store the Platform and the data contained in the Platform: The Collective Minds® platform is hosted here

Germany

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to uploading the data into AWS GmbH Servers.

Encryption and enforced safety measures provided by AWS to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of strong additional undertakings and safety measures, including the signature of the EU SCCs.

Google Cloud Platform

Encrypted and pseudoyimised users, clients, Institutions and partners data 

Office functionality

Email, document storage, chat, etc.

Ireland

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to uploading and or sharing the data.

Encryption and enforced safety measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of strong additional undertakings and safety measures, including the signature of the EU SCCs.


In accordance with our internal policies, we will process only the minimum data necessary to provide the services and will prioritise the use of pseudonymised data when referring to users, customers, etc.

Mailjet

Users’ email data

Messaging gateway

Email and SMS for marketing campaigns and general news/updates concerning the company.

France

Encryption and enforced safety measures provided by AWS to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature strong undertakings and safety measures.

Google Analytics

Encrypted and pseudonymised users’ navigation data (not directly identifiable: approximate location and navigation)

Platform usage analysis

Analyse and understand community usage of the service to improve user experience

Germany

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to uploading and or sharing the data.

Encryption and enforced safety measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of strong additional undertakings and safety measures, including the signature of the EU SCCs.

HubSpot

Encrypted users, clients, partners and providers data 

CRM Provider

Internal management of customer, contact and relationship information

United States of America

Pseudonymisation and data minimisation (anonymisation techniques) and encryption prior to uploading and or sharing the data.

Encryption and enforced safety measures to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature of strong additional undertakings and safety measures, including the signature of the EU SCCs.

Fortnox

Clients and providers data 

Invoicing and billing

Invoicing and billing customers for services and development.

Sweden

Encryption and enforced safety measures provided by AWS to ensure confidentiality, integrity and availability.


Signature of a DPA that includes the signature strong undertakings and safety measures

Last update: June 2023

Terms of Service

These terms of service (the “Terms of service”) govern your use of the Collective Minds® Radiology service (the “Service” as defined below). By accepting the Terms of service, an agreement is entered into by you (“you” or “User”) and Collective Minds Radiology AB, company registration number 559120-7187 having its registered address at Hörnåkersvägen 14, 183 65 Täby (“we” or “us”). 

The Service is provided through our mobile application (the “App”) and our webpage www.cmrad.com and any subdomains thereof (the “Webpage”). By using the Service or creating a user account with us you accept these Terms of service. If you do not agree to these Terms of service, please do not use the Service provided by us. 

The Service

Everyone using our Service is, in these Terms of Service, referred to as “Users” or “you”, a definition which also includes you as a party to this contract that you have entered into by accepting these Terms of service. We offer our Service to licensed medical professionals that have been given access to the Service through an agreement between us and the employer/university of the User or the User themselves in their capacity as an independent healthcare professional radiologist. All Users are verified prior to registration to ensure authenticity. The Service is to be used in the User’s professional capacity, working as a healthcare professional or researcher. Any use outside of the above, including use for commercial use, requires the User to enter into separate written agreement with us. The Service that constitutes the Collective Minds Platform can be described as having three core utilizations:

Consultation: The Service is used as an intelligent case solving platform for radiologists where users can get support in evaluating cases, examine shared data collectively, share their expertise and learn from each other. The Service shall be seen as a platform that may be used to further examine sample data of a patient case for further analysis, and not a substitute for a PACS and/or RIS system.

Education: The Service is used as a learning platform for hosting and sharing educational patient cases while controlling the spreading of unnecessary personal data pertaining to the Data Subject. These events may be both scheduled courses, or reference cases uploaded to the platform to share experiences with the community.

Research: Sponsors or researchers may use the Platform to communicate and structure datasets, given a specific research study design. The research group can design their process in the platform to harmonize and ease the collaboration and logistics of the datasets, and execute their own operations by downloading the data to local storage places from the platform.

In the scope of providing the Services, pseudonymized patient data contained in the medical data uploaded, such as Digital Imaging and Communications in Medicine (DICOM) images and embedded metadata is processed. Collective Minds Radiology processes this data in the capacity of a data processor, whereas the respective clinics or otherwise independent radiologists act as data controllers for the processing (see ‘Third party links’ under ‘Material uploaded to the Service’ below). 

All patient health data evident in the DICOM images are pseudonymised at its source location’s private network or through an encrypted link provided to the user. The objective of the pseudonymization is to remove any data which can be traced back to an individual Data Subject. A unique identifier is kept within each case to enable linking back to the original patient. This linking is only  possible by the source clinic by the User, which enables them to fulfil their data protection obligations towards each patient without revealing any information that may infringe on the integrity of the Data Subject. 

The process of pseudonymization removes all attributes such as name, birthdate, phone number, etc. from the DICOM images and removes any metadata tag which could indirectly enable the identification of the Data Subject. For this purpose, Collective Minds Radiology uses the de-identification method described in the DICOM standard 2017c. The specific tags which are removed or replaced can be found in Table E.1-1 from PS 3.15 of the DICOM standard 2017c. 

In order to correctly provide our Services, the following tags are retained as these play a vital role in the medical context of our users and do not directly identify the patient. 

  1. Patient’s Sex 
  2. Acquisition/Study/Content/Series Date 
  3. Study Description 
  4. Series Description 
  5. Contrast Bolus Agent 
  6. Content Sequence 

The following tags are converted into groups, such as: Patient Weight 70-80 kg, as required by policies at multiple large hospitals.

  1. Patient’s Age 
  2. Patient’s Weight 
  3. Patient’s Size 

Once a Case has been finalised and a suggested diagnosis has been established, Collective Minds Radiology continues to provide educational services based on these historic cases. The purpose is to help establish diagnosis in other Cases, train radiologists to become even more efficient and develop radiology services to become more precise than today. A Case will be deleted three (3) months after it has fulfilled this purpose. 

Confidentiality and Privacy

The User acknowledges and agrees that information that the User may get access to or upload to the Service may be subject to confidentiality obligations set out in laws and regulations, e.g. the Patient Data Act (SFS 2008:355). Furthermore, you agree to adhere to the Non-Disclosure Agreement set out in Appendix 1.

Collective Minds Radiology processes personal data when a User uploads data pertaining to a patient to the Collective Minds Platform. The personal data processing is made in accordance with our privacy policy (https://www.cmrad.com/privacy) and in accordance with applicable data protection laws. Before you are allowed to upload patient data to be processed by the Collective Minds Platform, we have a legal obligation to enter into a data processing agreement with you. 

To ensure that patients’ privacy is maintained when using the Service, all patient data relating to an uniquely identifiable person is removed from the DICOM images in a pseudonymization process when images are uploaded to the Service.  Along with the pseudonymized images, Users are asked to provide information about the patient’s condition and/or other information and descriptions that may be required in order to obtain the feedback requested for diagnostic purposes. When uploading a case to the Service, the User may not include information in the description that directly or indirectly may identify the patient. A patient verification function lets the User verify the original patient identity without ever sharing or storing any personal data about the patient on the Collective Minds Platform. Users who want to use the Service for diagnostic support are responsible to verify the patientID of the specific patient, using the patient verification function, to avoid mix-up between different cases. In the event that a patient case is considered unique, due consideration shall be made with regards to any disclosure of such case information that may easily lead to the identification of the patient, if the User does not have the patient’s consent to utilize the Service. 

License

The App

Provided that you accept and adhere to these Terms of service, you are granted a non-exclusive, non-transferable, revocable license to download, install and use the App in object code form on a mobile device which you own or have access to in order to use the Service for its intended purpose. 

Material uploaded to the Service

General

Subject to your acceptance and adherence to these Terms of service you are also granted a right to access and use the Service through the Webpage for its intended purpose.

You will not receive any other license to use the above intellectual property rights except as expressly provided in these Terms of service.

You may not copy, download extracts of any page of the Service unless there is a feature in the Service expressly permitting such copying or downloading. In case you have downloaded or made copies in accordance with these Terms of service, you are not entitled to modify the downloaded or copied material and may not separate any illustrations, photographs, video or audit sequences from text accompanying such media. The author of the material shall to the extent required under applicable law be recognized.

Displaying material in training sessions and conferences  

Displaying material during a conference, symposium or training sessions may only be made if the patient whose case is being discussed cannot be identified or if the patient has given her consent, and if the following conditions are fulfilled: 

  1. a) you select a limited number of key images (up to twelve (12)) to disclose and the images have undergone an pseudonymisation process by being extracted as JPG or PNG exports from the platform;
  2. b) you must ensure that any case information pertaining to a patient is not disclosed in a manner that would enable an identification of the patient; and      
  3. c) you shall ensure that it is clear that the material comes from Collective Minds® and to the extent applicable, which hospital originally uploaded the material to the Service. 

Third party links 

Where our Service contains links to other websites and resources provided by third parties, these links are provided for your information only. Such links should not be interpreted as approval by us of those linked websites or information you may obtain from them. You subsequently understand and accept that we cannot be held liable for such third party content supplied by third parties and presented or made available within the scope of the Service.

Restrictions 

We do not grant you or anyone else permission to copy or alter the App in whole or in part. You, or a third party, may not without our consent develop, add to, decompile or make reverse engineering on the App or its components. It is not allowed to re-create the source code or its functionality, or make copies of the App, other than as expressly permitted by mandatory law.

You may not use the Service to distribute viruses, trojans or similar programs. We do not allow automatic reading of the Service.

All intellectual property rights in the App, or in any other part of the Service, belongs to or are disposed of with license by us. Nothing in these Terms of service shall be construed as a transfer of any intellectual property right or any other right to you. You are only given the limited license as described above. 

Data we collect about You

In order to use the Service, you will have to create a user account (the “User account”) and sign in to it. Instructions on how to create a User account are set forth on https://www.cmrad.com.

The e-mail address you use to register your account will be your username and you will need to choose a password to sign in to your user account on the Webpage and the App. If you choose to create a new user account, the username and password which you choose must not be: harmful, abusive, racially or ethnically offensive, sexually explicit, defamatory, infringing any intellectual property right or invasive of personal privacy rights. We have the right to change your username if it, in our opinion, violates these Terms of service.  

When creating your user account, you will be asked to submit certain information about yourself. Please make sure to read and understand our privacy policy before you start using the Service. You can find the privacy policy here https://www.cmrad.com/privacy.

Your account is personal and you are not allowed to transfer your account to any third party or to allow a third party to use the Service through your user account. You are responsible for protecting your login information from access by unauthorized persons. If you have reason to believe that any third party has gained access to your user account, you must immediately inform us. We have the right, but not the obligation, to suspend access to your user account if we have reason to believe that any third party has gained unlawful access to your user account.

Please note that if your account is left inactive during a period of 90 consecutive days, we have the right to make your account “invisible”, meaning that all account information is saved, but the account is de-activated and needs to be activated for you to be able to use it again. Additionally, if your user account is left inactive during a period of 365 consecutive days, we have the right to cancel your user account permanently. 

Your Use of the Service

We do not want the Service to be used for anything other than its intended purpose. Your use of the Service may only be in accordance with its intended purposes, as described above. If you do not accept this, we ask you not to use the Service. 

As a User of the Collective Minds Platform, you form a part of the community that contributes with your expertise and knowledge to the Service. As such, you will have access to shared cases that other Users share with You, and you are encouraged to take part of the data shared and give your professional opinion and suggestions to aid the other Users in examining the data provided. You may also use the cases and data made available for your own educational purposes, such as using the data as reference cases in your own practice or educational courses and events. The data shared to you is for the purpose of sharing knowledge and improving healthcare of patients. While the data shared is minimized and the identity of the Data Subject is not disclosed (see description of pseudonymization in ‘The Service’ above) the cases and data made available through the Collective Minds Platform shall always be considered sensitive in nature. Any attempts by you as a User to try and identify the identity of an individual Patient where You are not the Case Owner/Data Controller, will be considered a breach of these Terms of Service.

The Service is registered in the European Union as a Medical Device, CE marked by Collective Minds Radiology (SE-MF-000004157). If you’re operating the Service from outside the European Union, it falls upon you as a user to verify if a regulatory clearance from your regional health authority is needed before the Service can be used in your clinical practice. For help in this matter, please contact info@cmrad.com.

Uploading data

When uploading data pertaining to an individual patient, the amount of data and users allowed access should always be minimal in relation to the purpose of the upload. The access to the case data can be limited by you as a User by choosing (i) “anyone” be available to anyone who has been given a link, even if such person is not a registered User of the Service*, (ii) “Collective Minds”- registered Users of the Service, (iii) “Group” only a predefined group of registered Users of the Service. The content of the data uploaded is to the extent permitted under applicable law, the sole responsibility of the User that has uploaded such material. The User must be aware that the data and material made available on the Collective Minds Platform is subject to the conditions of use described in chapter ‘Your Use of the Service’ above.

*Be advised that the option to share information to anyone with a link may result in unauthorized access or that uncontrolled spreading of information. The User is responsible for the lawful processing of the data, and Collective Minds Radiology recommends that only Anonymous data should be shared using this option. Also be advised that functionalities are limited and certain features are unavailable when using this option.

It’s the Users’ obligation, in their role as Data Controller for this data, to ensure that he or she has a legal basis for processing the data (such as the patients’ consent or for aiding in setting a medical diagnosis) and must be preceded by a signed data processing agreement with Collective Minds Radiology. All data uploaded to the 

You agree and warrant that you will not distribute or upload any User-generated Material to the Services which: 

  1. is false, misleading, untruthful or inaccurate, 
  2. promotes or encourages illegal activity, 
  3. is racially or ethnically offensive and/or constitutes agitation against a minority (such as a national or ethnic group),
  4. constitutes defamation, contains pornography or is in any other way sexually explicit,
  5. attacks sexual orientation or religion or is discriminating in any other way, 
  6. constitute insult or persecution of a person, 
  7. is in any way harmful, abusive, offensive or illegal or which infringes the rights of any third party (such as including but not limited to copyright and trademarks), or
  8. otherwise contradicts the Service’s intended purposes.

Failure to adhere to these rules may result in an elimination of the user profile, and banned from continuous use. Any illegal activities on the platform may result in legal repercussions.

Our position with regard to uploaded data

We will not tolerate any message we consider inappropriate, illegal or unethical. We have a statutory duty to monitor the data and material that is made available in the Service and, under certain conditions, remove data or cases from the Service. We reserve the right to, at our sole discretion, remove data and material that we deem inconsistent with these Terms of service or as we in any other way consider unfair, unethical or illegal and that may be harmful to us or the Users of the Service.

If you as a user encounter any material that you believe infringes these Terms of service, or encounter posts from other Users that are abusive or inappropriate in any way, or if you have any other reason to believe that our Service is used for illegal purposes or for purposes that are not in accordance with these Terms of service, please contact us at support@cmrad.com.

Intellectual Property Rights to uploaded material

Ownership of all the data uploaded by You as a User belongs to you, or the third party that owns the intellectual property rights. You hereby give us, to the extent permitted under applicable law, a worldwide, perpetual, non-exclusive, gratuitous and transferable right to possess, process, store, publish, distribute, stream, transmit, playback, transcode, copy, present, display and otherwise use the data uploaded and made available to provide and market the Service, or any of our current or future products or services.

You warrant that you have all necessary rights to show and upload the data, to use the data in all other ways and to grant us the license to the data as described above. 

Network Fees and Access

You are responsible for securing your access to the network necessary to use the Service. There may be additional costs for e.g. transfers of. These costs are not paid by us. Furthermore, you are responsible for obtaining and keeping the necessary hard- or software up to date to access and use our Service. 

Disclaimer of Warranty and Limitation of Liability

The Service, including the Webpage and the App and any information therein, is to the extent permitted under applicable law provided ‘as is’ without warranties of any kind. This entails that we are not responsible for any incorrect or incomplete information provided within or in connection with the Service, including incorrect or incomplete User-generated Material and input that is automatically generated through the Service. We strongly advise all Users to exercise caution in the interpretation and implementation of information obtained through the Service. Your use of the Service is solely your responsibility and at your own risk. We do not grant any warranties, express or implied or otherwise, as to the accessibility, quality, qualification for any particular purpose, suitability or accuracy of the Webpage, App or the Service. 

We recommend you not to rely on the Service for a purpose which is of high importance to you or which you consider intolerable if not met, since there may be situations where the Service will not be available, due to, but not limited to, maintenance and circumstances beyond our control. In addition, we reserve the right to modify or discontinue providing the Service, at our sole discretion. To the extent permitted under mandatory law we are not liable to you or any third party for any direct, indirect or other damages of any kind, including but not limited to, lost profits, loss of income, loss of revenue, business interruption or loss of goodwill arising out of, or in connection with these Terms of service or inability to use the Service. We are not responsible to you for any third party claims made against you. 

Indemnity

You are liable for any damages inflicted on us, or any third party, due to your breach of these Terms of service, including but not limited to the misuse of the Webpage, the App and/or the Service. Furthermore, you agree to indemnify us in relation to any claims, costs (including reasonable legal costs) damages, expenses, liabilities and losses incurred by us in relation to your breach of these Terms of service or other applicable law.

Should any User-generated Material infringe a third party’s intellectual property right, you agree to immediately remove all infringing parts of the User-generated Material and indemnify us from all damages, costs and expenses incurred by us as a result of such infringement.

Change of Terms and Termination of Services

We have the right to make changes and updates to these Terms of service. We will inform you of any such changes at the latest thirty (30) days before an adjustment enters into force. We will give you such information by email to the email address provided by you. 

You have the right to terminate your user account and remove your content from the Service at any time and without prior notice.

We have the right to suspend your access to the Service with immediate effect if we have reason to believe that you are violating these Terms of service. Furthermore, to the extent permitted under applicable law, we reserve the right to modify, discontinue, temporarily or permanently cease providing the Service at any time without prior notice, on our own discretion, or if required by law or by a decision by an authority. You accept that we shall not be liable to you or to any third party for such modification, suspension or discontinuance. Upon termination you shall also, at our request, destroy or return any material downloaded or copied from the Service.

Miscellaneous

The term “included” shall in these Terms be read as to mean “including but not limited to”.

You may not assign or transfer any rights, obligations or licenses as provided in these Terms of service. We may assign and transfer our rights under these Terms of service without your consent and without notice to you.

Failure to exercise or enforce any right or provision of these Terms of service shall not operate as a waiver of such right or provision.

These Terms of service operate to the fullest extent permissible by law. If any provision of these Terms of service is deemed to be unlawful, void or unenforceable, that provision is deemed severable from these Terms of service and does not affect the validity and enforceability of any remaining provisions.

Applicable Law and Disputes

These Terms of service shall be governed by and construed in accordance with Swedish laws, without regard to its conflict of law rules.

Any dispute or claim arising out of or in connection with these Terms of service, or the breach, termination or invalidity thereof, shall be finally settled by Swedish courts, with the Stockholm District Court as the first instance although we retain the right to bring proceedings against you in your country of residence, unless otherwise is provided by mandatory law.

Warranties in Relation to Apple Inc.

The parties to this agreement, we and the Users, hereby clarify the following in relation to Apple Inc. (“Apple”):

That we and the Users are the only parties to this Agreement;

  1. That we are responsible for the Service, the App and all content therein. We carry all responsibility for the maintenance, support and service of the Service or any technical equipment used to enable the provision of these. Claims that directly or indirectly depend on such grounds may only be directed against us, and not against any third party.
  2. That all demands or claims arising directly or indirectly from the use of the Service and which might be directed against us, only shall be directed against us. Apple is not in any way liable to respond to these demands or claims, if these are directed against Apple.
  3. That we, and not Apple, are solely responsible to investigate, defend, settle or secure liability in the event of any third party claims, based on the Service or infringements of any third party’s intellectual property rights caused by use of the Service.
  4. The User guarantees and ensures that you are not located in a country subject to an embargo issued by the US government, or has been designated by the US as a “terrorist supporting” country and that you are not on any of the US government’s list of prohibited or restricted parties.
  5. That these Terms of service create rights for Apple to apply these Terms of service directly against you, regardless of our participation. In addition to the third-party rights given to Apple, these Terms of service will not give any third-party rights to any other natural or legal person.

Warranties in Relation to Google Inc.

This section sets out the specific terms and conditions that apply to the use of the App in android based mobile devices and applies between you and us;

  1. Google Inc. (“Google”) provides Google Play where you download the App.
  2. You hereby undertake to use the App in accordance with Google’s at each time valid terms and conditions for Google Play;
  3. we, and not Google, is solely responsible for the App as well as the services and offerings available therein. Google does not have any obligations or liability to you regarding the App or these Terms of service.

Appendix 1 - Confidentiality Agreement

This Confidentiality Agreement (the “Agreement”) is entered into by; 

  • Collective Minds Radiology, reg. no. 559120-7187, with address Hörnåkersvägen 14, SE-183 65 Täby, Sweden; and 
  • The User (as defined in the Terms of Service). 

Collective Minds Radiology and the User are hereinafter each referred to as a “Party” and jointly as the “Parties”. When either Party discloses information to the other Party under this Agreement the disclosure is hereinafter referred to as the “Disclosing Party” and a Party receiving any Confidential Information hereunder as the “Receiving Party”.

Background

The Parties have entered into an agreement regarding the provision and the use of the Collective Minds Service (the “Service”) through which the Parties will share and be privy to information regarding medical radiology cases (the “Purpose”). In order to protect such information, the Parties have agreed on the following; 

Confidential Information

Confidential Information shall mean any and all information of a confidential nature, that is made available to or by the User through the Service, and shall, for the avoidance of doubt, include but not be limited to information regarding patients, and any information designated by the Disclosing Party as confidential or which should otherwise reasonably be regarded as being of a confidential nature (“Confidential Information”). For the avoidance of doubt, any information which is posted in the Service where the post has been labelled as being available for anyone with a link to that part of the Service, is not considered as Confidential Information.

Confidential Information does not include information which the Receiving Party can demonstrate (a) is or becomes available to the public other than as a result of a disclosure by the Receiving Party in breach of this Agreement or any confidentiality undertaking, (b) was available to the Receiving Party on a non-confidential basis prior to its disclosure to the Receiving Party or (c) becomes available to the Receiving Party on a non-confidential basis from a person, other than the Disclosing Party or another User, who is not known by the Receiving Party to be bound by an obligation of confidentiality to the Disclosing Party. 

The Receiving Party agrees to keep secret and not to disclose to any third party other than registered users of the Service, directly or indirectly, any Confidential Information and to take all reasonable measures to ensure that Confidential Information is so not disclosed and to only use the Confidential Information for the Purpose. The Receiving Party undertakes to safeguard Confidential Information in a manner no less protective than with reasonable care. The obligation of confidentiality does however not apply where the disclosure of Confidential Information is required by mandatory law, rule, regulation, applicable stock exchange rules or a court order, subject to what is set out in clause 2.6 below.

Collective Minds Radiology agrees to impose on its employees and consultants, in an appropriate manner, the obligations of confidentiality as set out herein. Collective Minds Radiology shall be liable for the actions of its employees and consultants with respect to the confidentiality obligations under this Agreement.

Collective Minds Radiology may disclose Confidential Information to its affiliates and its respective employees, directors, officers, consultants, advisors, legal advisors, financial advisers, accountants, subcontractors or sub-licensees (the “Affiliates”) who have a need to know such information for the Purpose. Collective Minds Radiology will however in such case ensure that the Affiliates to which it discloses Confidential Information undertake to only use the Confidential Information in accordance with the Purpose of this Agreement and to observe a level of confidentiality no less protective of the Confidential Information than as set out in this Agreement. Collective Minds Radiology shall be liable for any use and/or disclosure of Confidential Information by such Affiliates. 

Should the Receiving Party be under obligation to disclose Confidential Information, in accordance with what is set forth in this Agreement, the Receiving Party shall without undue delay, before any disclosure is made, inform the Disclosing Party hereof in order for the Disclosing Party to be able to take such actions in order to protect the information as it may deem necessary. Any disclosure in accordance with this clause 2.6 shall be made only to the extent so required. The Receiving Party furthermore undertakes to without delay inform the Disclosing Party in case it becomes aware of any unauthorized disclosure of Confidential Information and shall take all reasonable measures in order to prevent any further disclosure.

For the avoidance of doubt, nothing in this Agreement shall affect either Party’s confidentiality obligations set out in mandatory law, if any.

Proprietary Rights

The Receiving Party acknowledges that any Confidential Information received shall at all times remain the property of the Disclosing Party or the user that has uploaded such information to the Service and that the Confidential Information received may not be used for any other purpose than the Purpose. 

The Parties acknowledge that any Confidential Information is provided “as is” without any warranties as to its accuracy or completeness. 

Term

This Agreement shall remain valid for the same period of time as the agreement between the Parties regarding the Service of which this Agreement is a part. However, the confidentiality obligations shall bind the Receiving Party from the date of disclosure of such information without limitation in time.

Miscellaneous

The Receiving Party may not assign this Agreement without the prior written consent of the Disclosing Party.

This Agreement does not, and is not intended to confer any rights or remedies upon any person other than the Parties hereto.

This Agreement may only be amended by a written instrument duly signed by both Parties.

Governing Law and Arbitration

This Agreement, and any non-contractual obligation arising out of or in connection therewith, will be governed by the substantive laws of Sweden.

Any dispute or claim arising out of or in connection with this Agreement, or the breach, termination or invalidity thereof, shall be finally settled by Swedish courts, with the Stockholm District Court as the first instance although we retain the right to bring proceedings against you in your country of residence, unless otherwise provided by mandatory law.

OK

Privacy Policy

Collective Minds Radiology AB, company registration number 559120-7187 having its registered address at Hörnåkersvägen 14, 183 65 Täby, Sweden (“Collective Minds Radiology” “CMRAD” “we” or “us”). This document contains a policy statement regarding Collective Minds Radiology’s collection, use and processing of Personal Data (“Privacy Policy”), as updated from time to time. This privacy policy is applicable when you use our expert network platform ‘Collective Minds Platform’ (available at cmrad.com) or the Collective Minds Platform mobile application (the “Website” and “Application”) (collectively the “Services”). 

All definitions in this Privacy Policy shall be interpreted in accordance with applicable data protection laws which refers to the General Data Protection Regulation (Regulation no. 2016/679) and the Directive on Privacy and Electronic Communications (Directive 2002/58/EC), as well as the national implementations and related national legislation.

About the Service

See separate ‘Terms of Service’ (cmrad.com/terms) for descriptions of the Service that Collective Minds Radiology provides.

Data Processed

Collective Minds Radiology collects, processes and stores two distinct sets of personal data.  We will process the following personal data on the Services:

A. User profiles

  • Name; 
  • contact details (e-mail address, telephone number, address, country of residence, nationality);
  • position, title and workplace;
  • medical doctor’s license;
  • social network references.

B. Technical usage data

  • such as the URL you are accessing the Services from, your IP address, unique device ID, network and computer performance, browser type, language and identifying information and operating system; 
  • information about your use of the Services, such as what you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs), consultation length(s), recurrence of visits and other interaction information, methods used to browse away from the page.

We are unable to provide you with the Services unless you provide us with the personal data listed in point A above. The processing of the personal data above is necessary to enter into the Terms of Service with us and to maintain the contractual relationship between you and us, where Collective Minds Radiology will act as Data Controller for the collected data. Some of this collected information is subject to processing of third parties, both within and outside the European Union (third countries). A list of these third parties and what they do for us with the use of this data can be found here: https://www.cmrad.com/data-processors

The data listed in B above is solely collected and used for performance and issue handling pertaining to the platform, and will not be used for identifying you as a user, unless this is requested by official legal investigations as in ‘Responding to Legal Requests and Preventing Harm’ below.

A third set of personal data is processed using the Collective Minds Platform, which is the data that you as a User will upload to the platform. This data is referred to as ‘User generated Material’ in the Terms of Service, and Collective Minds Radiology will act as Data Processor on behalf as of you as Data Controller for this data:

C. Pseudonymous patient case information

  • pseudonymized DICOM images including embedded metadata;
  • content that you post, upload and/or contribute to the Services;

For this data listed in C above, where you as a User of the Services will act as Data Controller and Collective Minds Radiology provide Services as Data Processor, a separate Data Processing Agreement must be in effect. The reason for a seperate Data Processing Agreement is to outline what kind of processing we’re instructed to perform on your behalf regarding personal data pertaining to Data Subject’s where you are Data Controller.

Purposes of Processing

Collective Minds Radiology will process the personal data sets described above for the following purposes: 

  • To enable you to verify your account, to administer your account, to enable and provide the Services and integration with third party services, and to provide, personalize and improve your experience with the Services, and to otherwise provide the Services according to the Terms of Service; 
  • to send you alerts or messages by email or otherwise, including to provide you with marketing of our and our related parties’ products and services;
  • to inform you about updates of the Services or the terms of Service;
  • to improve and develop the Services or new services and to analyse your use of the Services;
  • to ensure the technical functioning of the Services and to prevent the use of the Services in breach of the Terms of Service;
  • to enforce the Terms of Service, including to protect our rights, property and safety and the rights, property and safety of third parties if necessary; 
  • to fulfill our obligations as Data Controller and Data Processor;
  • to respect and fulfill our obligations in regards to the Rights of the Data Subject;
  • to respond to any queries you raise with us and to provide customer support; and 
  • to fulfil requirements by law (see ‘Responding to Legal Requests and Preventing Harm’ below). 

Legal Ground

Consent. By contacting us, subscribing to our newsletter, you consent to the processing for the purposes contained in point A above which includes processing of your name, contact details and preferences as set out in this Privacy Policy.

Fulfilment of contract. By accepting Collective Minds Radiology’s Terms of Service, we process your personal data to be able to fulfil our agreement with you for the purposes listed above in ‘Purposes of Processing’.

Legal obligation. Collective Minds Radiology will process personal data if it has a legal obligation to do so to fulfil requirements by law as pointed out in ‘Responding to Legal Requests and Preventing Harm’ below’.

Legitimate interest. The processing of your personal data for the purposes listed in ‘Purposes of Processing’ above is conducted on the basis of the legitimate interest of Collective Minds Radiology. Our legitimate interest for the processing is maintaining sufficient IT security through logging data when you use our Services and to evade fraud and to protect the Services from cyber threats. We also log data for the maintenance and improvement of our Services.   

Disclosure of Personal Data

We do not commercially exploit or distribute personal data to any third party for commercial purposes. We share and disclose your personal data to companies with which we have contracts in place. These companies mainly provide data storage, data analytics, advertising, IT support and other services to be able to run and improve our Services. For a complete list of third party companies, please see https://www.cmrad.com/data-processors. 

When you use our Services, you may be directed to other websites where the personal data collected is not in our control. The privacy policy of the other website will govern the personal data obtained from you on that website. 

Responding to Legal Requests and Preventing Harm

We may access, preserve and share your personal data in response to a legal request (like a search warrant, court order or a subpoena or the like), or when necessary to detect, prevent and address fraud and other illegal activity, to protect ourselves, you and other Users, including as part of investigations described in Article 23(1) in the GDPR. 

Cookies, Pixels and other System Technologies

We collect information by using technology such as cookies, pixels and tags (on your browser or device). For information about how we use this type of technologies, please see our cookie policy (available here https://www.cmrad.com/cookies)

Retention

Personal data about registered Users will be retained for as long as the User has an active profile on the Services. Users who have not used our Services will have all personal data deleted after 2 years of inactivity on the Services. 

If you agree to be added to our mailing list, we will keep your personal information for that purpose unless and until you tell us that you want to unsubscribe or be removed from the list. If you advise that you do not want to be added to our mailing list or you ask to be removed, we will delete your personal data (aside from keeping a record that you have asked us not to send you marketing information).

Children

The Services are not directed to persons under the age of thirteen (13). If you are a parent or guardian of a person under the age of 13 and you become aware of that the child has provided personal data to us without your consent, please contact dpo@cmrad.com to exercise your access, rectification, erasure, limiting of processing and objection rights.

Security

The importance of security for personal data is of great concern to us. At Collective Minds Radiology, we have gone to great lengths to manage the security and integrity of the Services and to ensure that we use best–in-class services when providing secure transmission of information from your device. Personal Data collected via the Services is stored in secure environments that are not available or accessible to the public; only those duly authorised people, officers, employees or agents of Collective Minds Radiology who need access to your information in order to do their jobs are allowed access. 

Anyone who violates our privacy or security policies is subject to disciplinary action, including possible termination of their contract with Collective Minds Radiology and civil and/or criminal prosecution. Collective Minds Radiology uses the latest technologies to ensure utmost security, including utilising several layers of firewall security and encryption of personal data to ensure the highest level of security. 

Please see our Security White Paper for further information on our security practices. The Services are hosted in Amazon Web Services (AWS) at its data centres in the EU. You can read more about this here: https://aws.amazon.com/compliance/gdpr-center/ 

Your Rights

You have an absolute right to object to the processing of your personal data for direct marketing. You also have the right to recall your prior given consent. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal, and we may continue processing your personal data based on other legal grounds, except for direct marketing. 

You have the right to request access and further information concerning the processing of your personal data, or request that we correct, rectify, complete, erase or restrict the processing of your personal data. You have the right to obtain a copy of the personal data that we process relating to you free of charge once (1) every calendar year. For any additional copies requested by you, we may charge a reasonable fee of 10€ based on administrative costs.

If the processing is based on the legal grounds consent or fulfilment of contract you have the right to data portability. Data portability means that you can receive the personal data that you have provided to us, in a structured, commonly used and machine-readable format, and have the right to transfer such data to another data controller. 

Contact Information

To exercise your rights, or if you have any questions regarding our processing of your personal data, please contact us our Data Protection Officer (DPO) at the following address: dpo@cmrad.com or Collective Minds Radiology AB, Hörnåkersvägen 14, 183 65 Täby, Sweden. In your letter/email please state your full name, your username (if you are a user) and which institution you are linked to. Note that you should sign the request to receive information about the processing of your personal data yourself.

If you have any complaints regarding our processing of your personal data, you may file a complaint to the competent data protection authority. You can find out more about the local data protection authorities under the following link http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm. 

Notice of Changes to the Privacy Policy

If we make changes to this Privacy Policy, we will notify you by posting a copy of the updated policy on our Services prior to any change becoming effective. We will post a copy of the updated policy on our Services prior to any change becoming effective. If your consent is required due to the changes, we will provide you additional prominent notice as appropriate under the circumstances and ask for your consent in accordance with applicable law.

OK