Data processing agreement

1. Scope and roles

This agreement is between you, the participating radiologist, and Nurrad Health Limited. It covers the images, study details, reports, AI results and consultation content handled through your pilot account, referred to here as study data.

Only synthetic study data is permitted. Synthetic content that does not relate to an identifiable person is not personal data. Your name and professional attribution can nevertheless identify you; Nurrad handles account and participation information as described in the Privacy policy.

Where Nurrad processes personal data on your behalf within study data, you are the controller for the processing you determine and Nurrad acts as processor under your documented instructions. Roles follow the actual processing and applicable law. This clause does not permit you to submit real patient data or decide the role of an institution that has not entered an agreement with Nurrad.

2. Documented instructions and permitted purposes

Your instructions consist of this agreement and the permitted actions you choose within the pilot. They authorise storing, displaying, organising and processing study data to provide reporting, AI analysis and second opinions, and to preserve required accountability records.

The processing includes receipt, validation, storage, retrieval, analysis, authorised disclosure to colleagues and service providers, and deletion subject to the restrictions below. It continues while the data is needed for these purposes and any applicable lawful retention ground.

We may calculate aggregate, non-identifying measures of usage, reliability and pilot performance. These instructions do not authorise selling study data, publishing identifiable study content, training AI models on your study content or using it for unrelated research.

We will tell you if an instruction appears to breach applicable data-protection law and may pause the affected processing while the concern is resolved. If law requires processing outside your instructions, we will inform you unless the law prohibits that notice.

3. Permitted data and your responsibilities

Permitted content consists of synthetic images, synthetic study history and attributes, evaluation findings and impressions, AI outputs, and pilot consultation questions, annotations and responses. Participant names and professional attribution may accompany this content.

Do not submit identifiable patient information, images derived from real patients, or confidential information about another person. Do not treat technical de-identification checks as permission to use real-world studies.

You are responsible for having the rights and authority needed to submit material and share it through the features you use. Restrict consultation sharing to appropriate eligible colleagues.

If prohibited information is submitted accidentally, tell support@nurrad.com promptly and identify the affected study or feature without copying the sensitive content into the message. We will assess containment and removal; this does not make the original submission authorised.

4. AI processing and filtering limits

Modal performs AI processing on images and study text supplied through Nurrad's AI features. The application filters image metadata and validates the result. Study text sent to AI passes through removal of common identifier patterns.

Automatic filtering can miss identifiers. Metadata filtering does not remove identifying content burned into image pixels. It is not a certification of anonymity, and the synthetic-only restriction applies throughout the workflow.

AI outputs remain part of the study workflow and must be reviewed by the participating radiologist.

5. Confidentiality and security

We will restrict access to people and service providers who need it for an authorised purpose and require appropriate confidentiality obligations. We will maintain measures appropriate to the nature and risk of the processing.

The pilot uses encrypted connections, private file storage, short-lived file links, application authorisation checks and audit records of clinical actions. These measures reduce risk but do not guarantee complete security or authorise real patient data.

6. Service providers and transfers

The pilot uses Microsoft Azure for application infrastructure, database and storage, Vercel for web delivery, and Modal for AI analysis. Microsoft Entra External ID supports sign-in. Resend delivers second-opinion notification emails containing a recipient address, request priority and a Nurrad link that requires sign-in rather than study content.

Azure infrastructure is configured in South Africa North. Other provider processing can occur outside Nigeria, including in the United States. This region setting does not establish the location of every provider activity.

By accepting this agreement, you authorise these providers to perform the described functions within its scope. That authorisation does not replace the lawful basis or safeguards required for an international transfer.

Processors must be bound by written data-protection obligations appropriate to their functions. Nurrad remains responsible for its obligations when using them. We will notify you before adding or replacing a processor handling study data. You may raise a reasoned data-protection objection with support@nurrad.com. If it cannot be resolved, we will discuss suspension of the affected feature or ending participation.

7. Rights requests and compliance assistance

Taking account of the processing and information available to us, we will assist with relevant personal-data requests, security assessments, impact assessments and regulatory enquiries. We will provide information reasonably needed to demonstrate compliance with this agreement and support a proportionate review.

Reviews must protect other participants' data, service credentials and confidential security information. The form and timing of any inspection will be agreed, subject to applicable law and regulator powers.

8. Personal data breaches

On becoming aware of a personal data breach affecting information processed on your behalf, we will notify you without undue delay. We will provide available information about its nature, the categories and approximate numbers of people and records affected, its likely effects, containment measures and a contact for further information. We will respond to reasonable information requests and provide additional information as it becomes available.

Where you are the controller, your regulatory notification duties depend on the circumstances and applicable law. The NDPA's 72-hour deadline for notifying the Commission applies to a controller becoming aware of a breach likely to risk individuals' rights and freedoms; it is not a grace period for Nurrad to delay notifying you.

9. Returning and deleting data

An unsigned study moved to Trash can normally be restored for seven days unless you purge it sooner. The retention process then removes its clinical content and requests deletion of associated files. Failed cleanup is retried.

Signed studies cannot be deleted through the pilot's Trash process. After an unsigned study is purged, limited identifiers, status history and audit records remain. Storage recovery copies and provider records can have separate retention periods. Purge does not establish that every copy and associated record has disappeared.

When participation ends, contact support@nurrad.com to request return or deletion of study data. We will review your request and explain the data that can be returned or removed, any verification needed, and any records retained for a lawful purpose. Account closure is not automatic deletion of signed or accountability records.

Retained records must be limited to what is needed for attribution, agreement evidence, incident investigation, dispute resolution or a specific legal obligation. These grounds do not authorise unrelated use of the retained content.

10. Related terms and contact

This agreement supplements the Terms of service. For processing on your behalf, its specific data-handling provisions take precedence over a conflicting general provision in those terms. It does not limit rights or duties that applicable law preserves.

Contact support@nurrad.com about processing instructions, incidents, requests or this agreement. Nurrad Health Limited is based in Abuja, Nigeria.