Terms of use

These terms apply to the Yggdrasil service that this website links to (“the service”), run by Università degli Studi di Modena e Reggio Emilia, Via Università 4, 41121 Modena (MO), Italy (“the operator”). The operator runs the service for its own research projects: each installation of Yggdrasil belongs to one institution and holds only that institution’s projects. Other institutions run their own installation of the same software, which holds none of this service’s data. Yggdrasil itself is free software under the GNU AGPL v3.0; these terms cover the service, not the software.

By signing in, sending a project request or using a project on the service, you accept these terms. Members from other institutions may take part in the operator’s projects when a project’s admins invite them; they do so under the agreements between the operator and their institution.

1. What the service is for

Research only. The service is for medical imaging research: collecting, viewing, annotating, processing and exporting images and the data that goes with them.
Not a medical device. The service and its tools are not a medical device. Do not use them, or anything they produce (annotations, measurements, processor outputs), for diagnosis, treatment or any other clinical decision about a person.
Projects. The operator’s researchers request project spaces; the operator approves each one, with its quotas and duration, case by case. The service is non-profit and has no price list.

2. Responsibility for the data

The operator is responsible for its projects’ data, and their members for what they upload. That includes approval by an ethics committee where one is required, the lawful basis for processing it, informing the people the data is about, and de-identifying it before upload.
De-identification is your responsibility. The browser de-identifies file metadata (for example DICOM headers) before upload. It does not remove identifying information burned into the pixels (text on an image, faces in a head scan, a photo of a wristband). Check what you upload.
Never upload direct identifiers. Patients are known to the service only by the pseudonym codes your site assigns. Keep the mapping between real identities and pseudonyms at your site; it is never uploaded.
The operator is the controller of its projects’ data (see the privacy notice). Data that a partner institution contributes to a project is covered by the agreement between that institution and the operator, concluded before the data is uploaded.

3. Encryption, keys and data that cannot be recovered

Files and descriptive data are encrypted in your browser with keys that only the project’s members hold. The operator cannot read them, and cannot restore access to them.
If every admin of a project loses access to their keys, the project’s data cannot be recovered by anyone, the operator included. Each project has at least two admins. Keep a second trusted device or register a passkey.
Deletion is final. Deleted patients, studies, series, files and annotations, and deleted projects, cannot be restored by the operator. Encrypted backups do not change this: they are useless without the members’ keys.
The service stores some data in readable form so that it can work: sizes, counts, times, roles and the other metadata listed in the privacy notice. Exports that a project admin asks the service to package are readable on the server until their link expires.

Exports

The service’s export worker can see what it exports. When a project uses the service’s own export worker (the default), that worker decrypts the chosen data on the operator’s machines to package it, so the operator can see the exported data while it is packaged. The admin is told so before every such export, and the project’s audit log records it. A project that does not accept this registers an export worker run on a machine of its own instead.
An export archive is unencrypted on the server until its link expires (1 to 30 days, as the admin chose) or is revoked; the operator then deletes it and keeps no backup of it.
The admin who starts an export is responsible for the exported data: that exporting it is allowed (by the ethics approval, the agreements with partner institutions and the law), and for whom they give the link and, if they protect it, its code. Anyone holding the link can download the archive until it expires; treat it as you would the data. Revoke the link if it reaches someone it should not.
Once downloaded, the exported data is outside the service: these terms and the service’s deletion no longer reach it. Whoever receives the exported data protects it as the project’s ethics approval, its agreements and the law require.

4. Service level

The service is provided as is, on a best-effort basis, with no service level: no guaranteed availability, performance or support response time.
The operator runs it on redundant, secured infrastructure, announces maintenance in advance where possible, and tells users about known risks.
Quotas (storage, members, processors) are set per project at approval. The operator may refuse uploads beyond them.
Keep your own copy of anything you cannot afford to lose. The operator is not responsible for lost keys or lost data.

5. Acceptable use

You must not:

upload data you have no right to process, or data the project was not approved for;
try to identify the people the data is about;
try to read data of projects you are not a member of, or to get around access controls, quotas or rate limits;
disrupt the service, probe it for weaknesses outside the security policy, or use it to store or distribute unrelated content or malware;
share your account, or approve a device that is not yours.

Report security problems as the security policy describes.

6. Suspension and ending a project

The operator may suspend a project or an account that breaks these terms, puts the service or other users at risk, or is subject to a legal obligation, and tells its admins why unless the law forbids it. A suspended project keeps its data.
A project ends when its agreed duration is over or its admins ask. Its admins are told beforehand, so that they can export what they need; the operator then deletes the project, which makes its data unreadable for good.
You may stop using the service at any time. To have your account closed, write to yggdrasil@unimore.it from its email address.

7. Liability

The service is free of charge and best-effort. To the extent the applicable law allows, the operator is not liable for damage arising from the use of the service or from its unavailability, including lost data or lost keys. This limitation never covers wilful misconduct or gross negligence, nor any liability the law does not allow to be limited.

8. Changes to these terms

The operator may change these terms. It announces changes at least 30 days before they apply, by email to project admins and on this page, except for changes the law requires sooner. The date below shows the current version.

9. Governing law and courts

These terms are governed by the law of the country where the operator is established, and the courts of Modena, Italy, have jurisdiction, without prejudice to the mandatory rights of consumers.

10. Contact

The operator: yggdrasil@unimore.it.
Security problems: the security policy.
Personal data: the privacy notice.

Version 1.0, draft.