Privacy Policy

Intrinsic Imaging, LLC (“Intrinsic Imaging,” “we,” “us,” or “our”) protects the personal information you entrust to us. We keep it private, confidential, intact, and available.

This Policy explains how we collect, use, store, protect, share, keep, and dispose of personal information. It covers our websites, applications, cloud-based services, clinical and medical imaging services, business operations, and other services. Together, these are the “Services.”

Our privacy and information security practices follow widely accepted standards. Where applicable, these include ISO/IEC 27001:2022 and ISO/IEC 27018:2025.

Please read this Policy with any privacy terms that apply to you. These may include Data Processing Agreements (“DPAs”), Business Associate Agreements (“BAAs”), Notices of Privacy Practices, informed-consent documents, and other notices for particular Services.

This Policy covers personal information that we process in any legal role. Depending on the law, we may act as a data controller, business, covered entity, service provider, processor, business associate, cloud service provider, or in another role.

Depending on the Services, we may process personal information for our own purposes or for others. These others may include customers, healthcare organizations, pharmaceutical companies, biotechnology companies, medical-device companies, clinical research organizations, research sponsors, investigators, and other organizations.

When we process personal information only for a customer, the customer usually decides how and why it is used. In those cases, we process the information only on the customer's written instructions. Law and contract also apply.

Depending on your relationship with us and the Services involved, we may process these categories of personal information:

• Identification and contact information. Name, business or home address, email address, phone number, username, account identifiers, job title, employer, and similar details.
• Healthcare and clinical information. Medical images, imaging metadata, clinical information, medical history, treatment information, clinical-trial information, study identifiers, and other information tied to medical or clinical services.
• Protected health information. Information that counts as Protected Health Information (“PHI”) under the U.S. Health Insurance Portability and Accountability Act (“HIPAA”), when applicable.
• Research and clinical-trial information. Subject or participant identifiers, pseudonymized identifiers, study information, imaging data, clinical measurements, trial records, and related metadata.
• Technical and device information. IP addresses, device identifiers, browser and operating-system information, authentication records, system and security logs, and records of how our systems and Services are used.
• Business information. Information about customers, vendors, contractors, investigators, healthcare professionals, and other business contacts.
• Employment and contractor information. Information about employees, applicants, contractors, and consultants, where applicable and covered by separate notices or policies.

We collect only the personal information that is reasonably needed for authorized purposes.

We may obtain personal information in several ways:

• Directly from individuals.
• From our customers and their authorized representatives.
• From healthcare providers and healthcare organizations.
• From clinical-trial sponsors, contract research organizations, investigators, and research sites.
• From pharmaceutical, biotechnology, and medical-device companies.
• Through authorized integrations, applications, systems, and cloud services.
• Automatically, through use of our websites, networks, systems, and Services.
• From other sources allowed by law, contract, or the individual.

When we process information only for a customer, that customer must have the right and legal basis to share it with us.

We may process personal information for these purposes:

• Providing, running, maintaining, and improving our Services.
• Performing medical imaging, imaging analysis, clinical-trial support, and related services.
• Managing clinical and research studies.
• Checking users' identities and managing accounts.
• Giving technical and customer support.
• Meeting our contract obligations.
• Communicating with customers, users, vendors, and business partners.
• Protecting the security and availability of our systems and information.
• Finding, investigating, preventing, and responding to security incidents, fraud, misuse, or unlawful activity.
• Keeping business and operational records.
• Meeting legal, regulatory, contractual, quality-management, and compliance duties.
• Carrying out authorized audits and assessments.
• Establishing, exercising, or defending legal claims.
• Other purposes we disclose to individuals or the law allows.

We do not use customer personal information for purposes that are materially incompatible with the purposes it was given for. The customer, the individual, or the law must authorize any such use.

When we act as a processor or service provider for a customer, we process personal information only on that customer's written instructions. Applicable agreements and law also apply.

We do not use customer-provided personal information for advertising or unrelated commercial purposes. Any such use must be expressly authorized and allowed by law and contract.

Sometimes we cannot follow a customer's instruction. If we reasonably believe it would break the law or weaken information security, we may notify the customer as the law permits or requires.

We apply data-minimization principles when we collect and process personal information.

We limit personal information to what is adequate, relevant, and reasonably needed. This covers authorized business, clinical, research, contractual, security, and legal purposes.

Where feasible and appropriate, we lower privacy risks. We may de-identify, anonymize, aggregate, mask, or pseudonymize information.

Intrinsic Imaging keeps administrative, organizational, physical, and technical safeguards in place. These protect information from unauthorized access, acquisition, disclosure, alteration, loss, destruction, or misuse.

Our security program is built on risk-based principles. Depending on need, it may include:

• Access controls and role-based authorization.
• Identity and authentication controls, including multi-factor authentication.
• Encryption of sensitive information in transit and at rest.
• Network and infrastructure security.
• Security monitoring and logging.
• Vulnerability management, patching, and configuration management.
• Endpoint security.
• Secure development and change management.
• Backup, recovery, business continuity, and disaster-recovery planning.
• Supplier and third-party security management.
• Security and privacy training.
• Incident detection and response.
• Risk assessments and periodic security reviews, testing, and audits.
• Ongoing improvement of our security practices.

We choose security controls based on how sensitive the information is, the risks of processing it, contract terms, applicable laws, available technology, and the nature of the Services.

No information system or method of electronic transmission can be made completely secure. We therefore keep reviewing and managing security risks.

Where we provide or use public-cloud services involving personal information, we maintain privacy and security measures for the risks of cloud processing. As applicable, these measures include:

• Processing personal information only for authorized purposes.
• Documenting who is responsible for handling it.
• Limiting access to those with a business need.
• Keeping suitable security controls for cloud environments.
• Keeping records of the processing.
• Managing subprocessors and cloud-service providers.
• Supporting secure return, transfer, deletion, or disposal of personal information.
• Running incident-management processes.
• Being transparent about our processing.
• Helping customers meet their own privacy and security duties.

We may share personal information with:

• Customers and authorized users, when needed to provide Services or meet contracts.
• Service providers and subprocessors that supply hosting, infrastructure, security, communications, support, analytics, professional, or other services for us.
• Healthcare, clinical, and research organizations, where necessary and authorized.
• Professional advisers such as attorneys, accountants, auditors, and insurers.
• Government or regulatory authorities, where the law requires or allows it.
• Participants in an actual or proposed merger, acquisition, financing, reorganization, sale of assets, or similar transaction, with suitable safeguards.

We require third parties that process personal information for us to protect it. Contracts set confidentiality, privacy, and security measures suited to the risk.

We check and evaluate third parties that may process personal information for us. This review is based on risk.

Where appropriate, subprocessor contracts cover confidentiality, information security, permitted processing, incident notification, data return or deletion, regulatory duties, and audit or assurance requirements.

Intrinsic Imaging stays responsible for managing its subprocessor contracts. We manage them in line with applicable law and customer agreements.

Where required, customers will be told about, or given a way to learn about, material changes to subprocessors.

Personal information may be processed in countries other than where it was collected.

Where the law restricts international transfers, we use approved transfer mechanisms and safeguards. These may include contractual protections, approved transfer frameworks, adequacy decisions, risk assessments, or other legally accepted safeguards.

Customer data is processed in line with the data-location and transfer terms in the applicable contract.

We keep personal information only as long as reasonably needed. This covers the purposes it was collected for, plus legal, regulatory, clinical, contractual, security, quality, and recordkeeping duties.

How long we keep information may depend on:

• How sensitive it is.
• Customer instructions and contracts.
• Clinical-study or research needs.
• Legal and regulatory requirements.
• Limitation periods.
• Security and fraud-prevention needs.
• Normal business needs.

When the retention period ends, we securely delete, destroy, anonymize, or return the information as required.

When we process information only for a customer, retention and deletion follow that customer's instructions, the applicable contract, and the law.

When Services end, we return or securely delete customer personal information. We follow the agreement, the customer's written instructions, and the law.

Our deletion methods make information inaccessible or irrecoverable. The method depends on the technology and the sensitivity of the information.

Information may remain in secure backups for a short time. It stays there until it is overwritten or deleted under our backup procedures, unless other requirements apply.

We have processes to identify, investigate, contain, document, fix, and recover from security and privacy incidents.

Some incidents involving personal information trigger notification duties. When they do, we notify affected customers, individuals, regulators, or other parties as the law and our contracts require.

When we process information for a customer, we share what is reasonably needed. This helps that customer assess and respond to an incident, subject to contract and law.

We do not share customer personal information with government or law-enforcement authorities unless the law allows or requires it.

Where the law permits and it is appropriate, we may tell the affected customer before responding. We may challenge requests we reasonably believe are invalid, excessive, or unlawful.

We limit disclosures to the information a valid request legally requires.

Depending on where you live, your relationship with us, and applicable law, you may have rights over your personal information. These may include the right to:

• Request access, correction, deletion, restriction, or portability.
• Object to certain processing.
• Withdraw consent where processing relies on consent.
• Complain to a supervisory or regulatory authority.

These rights are subject to legal limits and exceptions.

When we process personal information only for a customer, you should normally send requests to that customer. We will reasonably help customers answer valid requests where law or contract requires.

We will not treat anyone differently for exercising a privacy right protected by law.

Where we receive or process Protected Health Information as a business associate under HIPAA, we handle it under HIPAA rules and the Business Associate Agreement.

A separate HIPAA notice or Notice of Privacy Practices may also apply. It may contain more detail on the use and disclosure of Protected Health Information and your rights.

If this Policy conflicts with a legally required HIPAA notice or a Business Associate Agreement, the legally controlling requirement governs.

We may process personal information for clinical trials, research studies, medical imaging, and related activities.

Depending on the engagement, the sponsor, healthcare institution, investigator, or another organization may decide how and why the information is used. Intrinsic Imaging may act as a processor, service provider, business associate, or other contracted party.

Where practical and appropriate, clinical-trial and research information may be coded, pseudonymized, de-identified, or otherwise separated from direct identifiers.

Study protocols, informed-consent documents, contracts, regulatory requirements, and customer instructions may add further requirements for such information.

Our websites and online Services may use cookies, log files, and similar technologies. These are needed for functionality, authentication, security, performance, preferences, and authorized analytics.

Where the law requires, we give notice and obtain consent before using non-essential cookies or similar technologies.

More detail may be given in a separate Cookie Notice or consent-management interface.

Our Services are not generally aimed at children for independent consumer use.

Personal information about minors may still be processed for authorized healthcare, clinical-trial, research, or customer services. In those cases, the processing follows applicable legal, contractual, consent, authorization, and research requirements.

Personnel who can access personal information are bound by confidentiality and security duties suited to their roles.

We give privacy and security training suited to each person's responsibilities. We reinforce it periodically.

Access to sensitive information is limited by business need and proper authorization.

We build privacy and security requirements into our systems, services, and processes from the start. We carry them through their whole lifecycle.

Depending on the nature and risk of the processing, this may include:

• Data-minimization measures.
• Access-control design.
• Encryption and pseudonymization.
• Secure development practices.
• Risk and privacy assessments.
• Logging and monitoring.
• Retention and deletion requirements.
• Vendor and subprocessor reviews.
• Testing of security controls.

We keep governance processes in place to support compliance with privacy, security, contractual, and regulatory requirements.

These may include:

• Documented policies and procedures.
• Defined security and privacy responsibilities.
• Risk assessments and internal reviews.
• Management oversight.
• Incident management.
• Vendor oversight.
• Employee training.
• Corrective actions and continual improvement.

We review our privacy and security practices periodically. We update them as technology, risk, business operations, contracts, and law change.

We may carry out or obtain security assessments, internal audits, independent assessments, vulnerability testing, penetration testing, risk assessments, and other assurance activities. These are suited to the Services and their risks.

Where contractually required, we may share assurance information with eligible customers. Suitable confidentiality, security, and nondisclosure terms apply.

Nothing in this Privacy Policy should be read as a claim that we hold a particular certification. A certification counts only when an accredited certification body has formally issued it and it remains valid.

We may update this Privacy Policy from time to time. Updates may reflect changes in our Services, processing practices, legal or regulatory requirements, security practices, or other operations.

Where law or contract requires, we will give appropriate notice of material changes to this Privacy Policy.

Questions, concerns, privacy requests, or complaints about this Privacy Policy, or about how Intrinsic Imaging handles personal information, may be sent to:

Individuals may also contact the appropriate data-protection, healthcare, or regulatory authority where applicable.