1. Scope

This privacy policy describes the collection, use, sharing, and retention of personal information and personal health information by PACS-AI. PACS-AI is developed and maintained by the HeartWise AI Lab at the Montreal Heart Institute, which is affiliated with Université de Montréal. The research project receives support from CIFAR. This policy covers both the public demonstration environment maintained by the HeartWise AI Lab and deployments operated by participating healthcare institutions.

For the public demo, this policy applies to account, authentication, and platform-usage information. For institutional deployments, it also applies to patient information and information relating to healthcare professionals and other authorized users who interact with the platform.

PACS-AI is a research platform. Its public demo is separate from deployments installed within participating healthcare institutions. Each healthcare institution remains responsible for the operation, legal authority, consent, and governance of its own deployment.

Public demonstration environment

The public demo is hosted on SecureData4Health (SD4Health), a secure cloud infrastructure with a compute node in Quebec. The HeartWise AI Lab is responsible for day-to-day maintenance of the demo and administration of its user accounts.

The demo currently exposes only a curated anonymized dataset. Users cannot upload images or other data at this time and must not submit patient information or other identifiable personal information to the demo.

Demo accounts use Firebase Authentication. Limited authentication data is processed in the United States as described in this policy and the EFVP. A user may request deletion of their demo account at any time by contacting the HeartWise AI Lab through the contact form at https://pacsai.co/contact-us.

Unless a section expressly refers to the public demo, descriptions of institutional PACS integration, patient information, clinical workflows, and institutional responsibility apply only to deployments operated by healthcare institutions.

2. Definition of Personal Information and Personal Health Information

3. How Personal Information Is Collected

Depending on the deployment, the healthcare institution operating PACS-AI and its authorized healthcare professionals may collect personal information through both direct and indirect means.

4. Types of Personal Information Collected

The following personal information may be collected about users depending on their interactions with PACS-AI.

5. How Personal Information Will Be Used

Personal information may be used for the following purposes or otherwise with the individual's consent. The primary purpose of PACS-AI is to assist healthcare professionals in providing healthcare by supporting their diagnostic assessments through AI-generated analysis.

6. Use of Automated Decision Systems

PACS-AI uses artificial intelligence (AI) to assist healthcare professionals by generating interpretive suggestions based on medical imagery analysis. These AI do not constitute autonomous decisions as the final medical judgments remains exclusively with the licensed healthcare professional.

Additionally, certain system components such as local agent workflows may capture and store command inputs and inferences. These data elements include instruction prompts entered by users and the resulting AI-generated outputs. Where applicable, these data are logged using secure mechanisms and are protected by the platform's access controls and encryption protocols to prevent unauthorized use or re-identification.

PACS-AI supports an automated processing mode in which selected AI models are applied to new medical images as they are ingested into the system without requiring manual initiation by users. In this configuration, image detection and model execution are triggered automatically based on pre-configured filters and routing logic. The inference results are subsequently stored in the institution's PACS system, typically as separate DICOM objects within the originating study. This mode is used to streamline workflows and reduce clinical burden. Although the system logs all such operations for traceability and audit purposes, responsibility for proper deployment and regulatory oversight rests with the healthcare institution implementing the automated configuration.

When an inference is executed via the PACS-AI interface, the platform supports a "write to study" functionality. This feature allows AI-generated results to be stored as separate DICOM series within the same originating study in the healthcare institution's PACS. By appending the results directly to the existing study, the system preserves the integrity of the original imaging while enabling complete traceability for AI. This configuration ensures compliance with radiological data standards and facilitates seamless retrieval through standard clinical systems.

7. How Personal Information Will Be Shared and Accessed

Personal information collected by PACS-AI is shared with limited recipients as follows:

8. Consent Management

PACS-AI ensures that personal information is collected, used and disclosed with the appropriate consent in compliance with applicable privacy laws in Québec and Canada.

9. Protection of Personal Information

PACS-AI is committed to the protection of personal information under its custody through a combination of administrative, physical, and technical safeguards. These safeguards aim to preserve the confidentiality, integrity, and availability of sensitive medical data processed by the platform.

Access to personal information, including AI-generated diagnostic reports, is restricted to authorized personnel such as physicians, radiologists, and designated research staff approved under specific institutional protocols. Role Based Access Control (RBAC) is enforced to ensure only individuals with a legitimate need can access specific data types or functions. All access events are recorded and subject to periodic institutional review for compliance and audit purposes.

The PACS-AI infrastructure is deployed entirely within the secure internal environment of the healthcare institution. It relies exclusively on locally hosted components to process and display medical images, ensuring that no personal information is transmitted outside the institutional network. All systems used to manage imaging and interaction data apply strong security measures, including data encryption (in transit and at rest), strict access controls and audit logging. Only authorized personnel may access the system, and any system modifications undergo internal review to ensure compliance with institutional security policies.

Interactions with local AI agents (e.g., inference inputs, timestamps, decisions) are stored for traceability and compliance purposes in Kibana logs. These logs are retained for 25 years for research purposes and encrypted at rest using AES-256. Access to these logs is limited to designated system administrators or compliance officers.

Personal information is stored for the duration necessary to fulfill the purposes identified in this policy or as permitted or required by law. For personal health information, specific retention periods apply, such as 25 years for research-related logs. For other personal information, retention details are available upon request. Once the information is no longer required, it is securely destroyed or anonymized in accordance with institutional policies and legal obligations.

10. Retention of Personal Information

Platform interaction data, including user activities such as exams accessed, AI inference executed, and model versions applied is retained for 25 years for research and audit purposes. This information is encrypted both in transit and at rest in accordance with institutional cybersecurity standards. After the applicable retention period, data is either anonymized or securely deleted, depending on institutional policy and legal requirement. DICOM images are systematically deleted 24 hours after ingestion into the system.

11. Storage and Outsourcing of Personal Information

When PACS-AI is deployed within a secure internal network of a healthcare institution (e.g., on-premise PACS servers), all personal information and personal health information, including imaging data, AI inferences and user logs are stored exclusively in Quebec.

In some deployments where cloud-based authentication services are used (e.g., Firebase), limited personal information such as login credentials may transit or be stored outside Québec, more specifically, in the United States. However, personal health information remains stored where the PACS-AI server is located, which is typically within the healthcare institution's infrastructure.

All inference APIs and integrated models operate in containerized environments (e.g., Docker) with no external transmission of personal health information. The PACS-AI platform is designed to function entirely within the local infrastructure of the healthcare institution unless explicitly configured otherwise by the deploying organization.

All data uploaded to or processed by the PACS-AI platform is stored within the secure internal network of the healthcare institution, typically on the institution's PACS server. No personal information is transferred or stored outside of Quebec.

All inference APIs and integrated models operate within containerized local environments (e.g., Docker) to ensure no personal health information is transmitted externally. The PACS-AI platform is deployed entirely within the local network infrastructure of participating healthcare institutions, ensuring that all personal health information is processed and stored internally without external transmission or reliance on centralized servers.

12. Individual Rights

Under Canadian and Quebec privacy laws individuals have the following rights with respect to their personal information:

• Right of access, including data portability
• Right of rectification of inaccurate or incomplete personal data
• Right to withdraw consent
• Right to restrict processing in certain circumstances
• Right to refuse access to certain data uses

For patients, the healthcare institution deploying PACS-AI is the entity responsible for managing requests to exercise these rights. Patients should contact their healthcare institution privacy officer directly to make such requests. PACS-AI does not offer a direct interface for these requests and does not independently process them.

For healthcare professionals, individual rights regarding personal information processed by PACS-AI (such as access logs or credential information) may be exercised by contacting their institution's privacy office.

13. Changes to the Privacy Policy

This privacy policy may be amended from time to time to reflect updates to the PACS-AI platform or changes in legal requirements. When substantial modifications are made, it is the responsibility of the healthcare institution deploying PACS-AI to inform affected individuals in accordance with applicable privacy laws and institutional procedures.

Each healthcare institution remains responsible for determining how changes to the policy are communicated to patients, healthcare professionals or other authorized users under its care.

The “Effective Date” at the beginning of the document reflects when the latest version came into force.

14. Contact Information

For any questions, concerns, or requests regarding the handling of personal information under this Privacy Policy, individuals are encouraged to contact the Privacy Officer of their respective healthcare institution deploying PACS-AI.

As of this version, PACS-AI has been integrated by the following healthcare institutions:

Each institution is responsible for managing individual rights requests and ensuring compliance with applicable privacy laws in Quebec and Canada.