Compliant DICOM data sharing for clinical trials

These terms are often used interchangeably in imaging, but they are not equivalent, and they come from different regulatory regimes.

• De-identification is a technical process: removing or replacing the identifiers held in DICOM data. It is the term used in the DICOM standard itself (PS3.15) and in US regulation under HIPAA, which sets specific criteria for when health information counts as de-identified.
• Pseudonymisation is defined in GDPR. Direct identifiers are replaced with a code, and the information needed to reverse that is held separately. Pseudonymised data is still personal data and remains within the scope of the regulation.
• Anonymisation means re-identification is no longer possible by any party. Truly anonymous data falls outside GDPR.

In clinical trials, imaging data is normally not fully anonymised: the trial subject code has to remain traceable at the investigator site for safety reporting, monitoring and source data verification. Bioxydyn removes direct identifiers in the uploading browser before any data leaves the site, and holds no information that identifies a participant. Which characterisation applies to a particular study depends on its design, and is agreed with the sponsor during study setup.

PII stands for personally identifiable information: any data that could identify an individual, either on its own or when combined with other information. In a clinical imaging context this includes a participant's name, date of birth, address and contact details, hospital or patient number, and national identifiers such as an NHS number, along with items such as accession numbers, referring physician and institution details that can point to an individual indirectly. You may also encounter the related terms PHI (protected health information), used under HIPAA in the United States, and personal data, the broader category defined by GDPR. In DICOM, PII can appear both in the header tags attached to each image and, in some cases, burned directly into the image pixels.

Yes. All anonymisation takes place entirely within the uploading user's web browser before any data is transmitted to Bioxydyn's servers. There is no intermediate server at the site; images leave the device already de-identified. A secondary PII verification check is performed on receipt as an additional safeguard.

DICOM carries identifiers in many places, including patient name, patient ID, date of birth, accession number, referring physician and institution details, as well as study and series descriptions and private tags. VoxelFlow removes or replaces these within the uploading user's browser before any data is transmitted. On receipt, a secondary PII verification check runs before anything is committed to permanent storage, and images are only stored once they are verified as de-identified. If a problem is found, it is raised with the site through transparent issue management so the submission can be corrected.

Yes. VoxelFlow is built to meet 21 CFR Part 11 requirements for electronic records and electronic signatures, with full audit trails, access controls, and version control across all study data.

All data is securely archived and locked at study completion. Where downstream transfer to a sponsor or academic system has been completed and validated, Bioxydyn's copy is removed at the agreed time in line with the data management plan.

No. Where trial management is already in place, or where a study is investigator-led, we can cover the imaging data transfer alone. We work with academic and non-commercial sponsors alongside pharmaceutical and medical device companies, and there is no minimum study size.