Security & Compliance
ClinFlows’ solutions, decidemedical and dicomdrop, transfer millions of medical images and clinical data records across 100+ countries – for clinical trials, second opinions, treatment planning, and AI development. Security and compliance are built into how our platforms are designed and operated: we align with GDPR, HIPAA, 21 CFR Part 11, ISO 27001, and ISO 9001. This page explains our security architecture and what these standards mean for your projects and data
-
GDPR Compliant Architecture
-
HIPAA Compliant Architecture
-
21 CFR Part 11 Electronic Signature
-
ISO 27001 Information Security
-
ISO 9001 Quality Management
Who we serve
Healthcare Professionals
Pharma and Biotech Companies
Medical Device Manufacturer
Clinical Research Organizations (CROs)
Academic Research
CoreLabs or Central Image Reader
Compliance at a glance
GDPR
The General Data Protection Regulation (GDPR) is in place in Europe in order to protect citizens’ rights over their own data. It requires ClinFlows to ensure lawful, transparent and secure data processing, obtain proper consent, provide data subject rights (like private information access and deletion), and maintain strong security measures, essential for serving EU-based clients and patients.
HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) is the U.S. regulation for protecting health information. It requires that ClinFlows implements robust safeguards for the privacy, security, and confidentiality of patient data, including secure handling, access controls, and breach notification procedures, critical for operating in the U.S. healthcare sector.
FDA 21 CFR Part 11
FDA 21 CFR Part 11 requires electronic records and signatures to be trustworthy, auditable, and equivalent to paper records. ClinFlows ensures compliance by requiring digital signatures for all case submissions, attachments, and form records. Audit trails track data changes and ensure accountability, thereby guaranteeing the integrity and traceability of your data.
ISO 9001:2015
ISO 9001 is the international standard for Quality Management Systems (QMS). Being certified means a structured approach to quality management in its products and services, emphasizing continuous improvement. It ensures that ClinFlows consistently meets customer and regulatory requirements, improves processes, and delivers reliable, high-quality solutions, especially important in clinical and healthcare settings where precision and trust are critical. A certificate can be provided on demand.
ISO 27001:2022
ISO 27001 is the international standard for Information Security Management Systems (ISMS). Being certified means having a robust information security framework in place, a risk program, and being committed to global best practices in data security. It demonstrates that ClinFlows protects sensitive data, such as patient records and clinical information, from threats and breaches, ensuring confidentiality, integrity, and availability. This is vital for maintaining trust and compliance in the healthcare industry. A certificate can be provided on demand.
Technical and Organizational Measures
- Compliance with GDPR through a Data Protection Impact Assessment (DPIA)
- Compliance with HIPAA and 21 CFR Part 11 through a Compliance Statement
- ISO 9001:2015 and ISO 27001 certification by TÜV Süd
- Successfully audited by major medical device companies
- Two-factor authentication (2FA)
- Session time-outs
- Role-based access rules with defined user rights and unique login/passwords
- Audit trails
- End-to-End encryption through SSL, A+ rating on Qualys SSL Labs
- DICOM and attachments encryption at rest, content integrity checks
- Professional hosting environment with 24/7 monitoring and redundant services
- Storage only in Europe
- Automated de-identification of defined DICOM headers
- Integrated tool to erase burned-in annotations in DICOM images (decidemedical)
- Physical server access control by the hosting provider
- Isolated server environments (development, stage, production)
- Incident management program in place with proper communications to stakeholders defined
- Risk management program in place
- Service redundancy management through modern orchestration tools and service replication
- Security tools in place to avoid service disruptions or data theft, with IDS/IPS, firewalls, and anti-DDoS mechanisms
- Controlled software development lifecycle
- Regular pentests performed
User Education and Support
Training Resources
Role-based user guides and training sessions are provided during project setup.
Dedicated Support
Embedded support function in decidemedical and dicomdrop ensures a response within 60 minutes during European business hours (8 AM to 6 PM).
FAQ
Yes. decidemedical integrates a SmartUploader. You can preview images and erase identifiers embedded in the image pixels. Burned-in annotations might expose patient health information and must be reviewed and masked before image exchange.
All data is stored in secure, EU-based data centers.
Yes. ClinFlows offers long-term hosting of images and clinical data in Europe.
Under GDPR, data should not be retained longer than necessary for its processing purpose (Art. 5, 1.e). Longer retention may apply for scientific research and archiving (Art. 89) - for example in clinical trials and retrospective data collections.
Retention periods are defined per project. Tell us your requirements, and we set the clock accordingly.
Yes. We transfer imaging data to any central readers involved in your project, including iCROs, Core Labs or independent central readers.
ClinFlows has extensive experience managing imaging workflows, blinded or unblinded transfers, with or without prior QC, and central screening or eligibility reviews.
Images can also be routed to different Core Labs or central readers — for example, MRIs to one Core Lab and echos to another.
If desired, we can coordinate central imaging reads through our partner network.
Yes. Our decidemedical solution can connect with third-party infrastructure via routed APIs. Requirements and costs to be discussed on a project-basis.
