Privacy policy:

Health-related data

Kheiron Medical Technologies

We are Kheiron Medical Technologies (‘Kheiron’), a group of companies with offices in London. Our services help radiologists identify potential cancers.

• This privacy notice supplements our general Privacy Policy and tells you about what health-related data Kheiron may use, how we process it, what are your rights and how you can exercise them.
• We process limited health-related data on behalf of the healthcare professionals and organisations we work with.
• People have rights which they may freely exercise where data that identifies them is processed. We explain what these are and, how and when you can exercise them.
• We use various third-party data processors to provide cloud-based technologies on which we securely process personal data.
• You can contact us for more information about how, what and when we process personal data about you and to request access.
• You can contact your national or state data protection supervisory authority if you do not think we have handled your data correctly.

Introduction

The General Data Protection Regulation (GDPR) is data privacy law that applies to organisations (and sometimes people) that are established in the European Economic Area (the ‘EEA’ are countries of the European Union plus a number of other countries). Kheiron is committed to protecting personal data in compliance with GDPR and the UK legislation based on GDPR.

For people outside of the EEA and UK, Kheiron is committed to complying with local, national and state data protection laws, supplementary to the principles and requirements of GDPR as advised by legal counsel.

The General Data Protection Regulation and relevant Member State laws require us to provide people with information about what personal data we process, what are their rights, how they can exercise those rights, and how to make complaints. This Privacy Notice provides that information in a way we have tried to make clear and transparent.

If you would like more information about what data we process, for what purpose or how long we keep it for, please use the contact options provided at the foot of our general Privacy Policy page to ask us.

How we process health-related data

Kheiron provides the healthcare provider (clinic or hospital) with a Kheiron ‘Gateway’ program to install and run on their IT systems. This program operates continuously and automatically as part of the healthcare provider’s IT systems. It detects when mammography images are taken for a patient and before the data is transferred to Mia’s cloud-based service for analysis the Gateway takes steps to ensure that the data:

• is minimised technical, image and health-related data with all non-essential data removed;
• has no components that identify the individual; all of this is removed by the Gateway and replaced with one randomly-generated, unique ‘Kheiron ID’ reference code.

Kheiron applies the Digital Imaging and Communications in Medicine (DICOM) Supplement 142 standard and complies with the UK Information Commissioner’s Anonymisation Code of Practice to ensure that personal privacy is protected and that no personally-identifiable information leaves the healthcare provider to be processed.

Mia’s cloud-based system analyses the minimised and pseudonymised mammography image and data provided by the Gateway. The outcome of that analysis is passed back to the Gateway in the healthcare provider’s IT system. The Gateway matches the ‘Kheiron ID’ in Mia’s reply to the original patient records and updates them with Mia’s analysis outcome for the healthcare provider’s radiographer to review.

The healthcare provider’s IT team only grants Kheiron very limited access to help install the Gateway program and later at agreed times to maintain that program with security updates and improvements. Kheiron has no access at any other time. Kheiron processes only the minimised and pseudonymised output provided by the Gateway to ensure that patient privacy is maintained.

Personal data processed

Kheiron process the following personal data (as per our legal contract with healthcare providers) for the purposes listed:

Data protection rights

The General Data Protection Regulation secures various rights for people whose data is being processed.

As previously stated, Kheiron does not process identifiable patient information. And we have no technically possible way of somehow reversing the pseudonymisation process ourselves. We simply don’t know who you are or if we’ve ever processed your health-related data on behalf of your healthcare provider.

If you believe that Kheiron has processed your health-related data and you ask us about how we’ve done that we can only refer you to this page that you’re reading now. You can contact us with any additional questions that you have and we’ll try to answer them as completely as possible, but in some cases we may simply be unable to provide an answer if it’s impossible or involves a disproportionate effort as described by GDPR Article 14(5)(b).

We would advise that you contact your healthcare provider first to answer any questions you have about how your information has been used.

Listed below are your rights and an indication of when they apply:

Data processors

Below is a list of companies whose services and products we have contracted and who process Pseudonymised (unidentifiable) minimised data on our behalf and under our instruction:

Contact details

If you have any queries regarding data protection matters you can find contact details at the foot of our general Privacy Policy page.