1. Processing for the service
Natoe’s radiology service uses clinical information to support study intake, case routing, interpretation, report preparation, quality review, communications and delivery. This may include medical images, clinical indications, prior reports, dictation, drafts and final reports.
AI-assisted processing forms part of relevant workflows. Authorised personnel and service providers may process information to perform the service, investigate errors, address support requests and validate corrections, within the applicable agreements and law. Radiologists retain their clinical judgment and responsibility for the final interpretation.
2. Development and improvement
Natoe plans to use de-identified clinical information for future AI training and fine-tuning. Planned uses also include analysis, benchmarking, quality evaluation, research, development and validation of products and services. These uses require the applicable contractual permissions and compliance with the legal standards for the data and proposed use.
De-identification is not the same as removing a patient’s name from a screen. Where HIPAA applies, de-identification must satisfy its Safe Harbor or Expert Determination method, as appropriate to the data and intended use. Data that remains identifiable, including coded or masked data that does not meet that standard, continues to be handled under the applicable privacy and contractual restrictions.
Further processing of identifiable patient information requires a permitted purpose and legal basis under the applicable arrangements. This notice does not itself provide consent, a licence or permission to use PHI for unrestricted AI training.
3. Providers and safeguards
Natoe may use affiliated entities and specialist providers to operate and improve its services. Their access and use must be consistent with the restrictions applying to the data. Business Associate Agreements are required where the provider’s role and handling of protected health information require one.
AI service providers may process patient information only for the authorised service. They are not permitted to retain patient inputs or outputs after processing, or use that information for their own unrelated purposes. These restrictions are separate from Natoe’s permitted use of de-identified data for future development.
4. Your agreement governs
Customer data rights, permitted uses, retention, return or destruction, security and incident responsibilities are governed by the applicable signed agreements and law. This public explanation does not enlarge those rights or reduce the protections in a BAA.
The extent to which de-identified data and non-identifying improvements may be retained after a service ends depends on the applicable agreement and law. Records that still contain PHI do not become exempt simply because they are used for analytics or included in a model.
5. Hosting and international access
Patient data is hosted in the United States. Authorised support and technical personnel, including personnel supporting Natoe through its Indian subsidiary, may access data internationally where permitted by applicable law and the relevant agreements. Overseas personnel access the U.S.-hosted systems and are not permitted to download or store patient information locally.
This notice does not authorise unrestricted access from every country or the creation of copies outside approved environments. Customer-specific restrictions and the requirements applying to particular data continue to govern.
6. Questions about data use
Facilities can contact [email protected] about their data-handling arrangements. Patients seeking access to or correction of a clinical record should first contact the healthcare facility responsible for their care. You may also contact [email protected] about information held by Natoe; we will handle or help route the request according to our role and applicable obligations.
Questions? [email protected]