DATAIZE Privacy Policy

Seoul Medical Informatics Intelligence Lab, Inc. ("DATAIZE," "we," "our," or "us") respects the privacy of visitors, account users, institutional users, researchers, and other individuals whose Personal Information is processed through the Services. This Privacy Policy explains what we collect, how we use and disclose it, how we protect and retain it, and the rights available to you.

This Policy applies to DATAIZE-operated websites and domains, including www.dataize.io and other DATAIZE domains where this Policy is linked, as well as IO, web applications, APIs, research-support services, and related online services (collectively, the "Services"). It does not override an applicable Order Form, DPA, BAA, institutional privacy notice, research consent, or other agreement that lawfully governs a specific dataset or deployment.

1. Our Role: Controller vs. Processor

DATAIZE may process different categories of information in different legal roles:

Account, website, billing, and support information. DATAIZE generally determines the purposes and means of processing this information and acts as a controller/business for its own operations.

Institutional and research data. When an Institution provides or controls Research Data, clinical data, PHI, or other Institutional Data for use in IO, the Institution generally determines the research purpose, lawful basis, access rules, and retention instructions. DATAIZE acts as a processor/service provider or Business Associate where applicable and processes the data under the Institution's instructions and contract.

Institution-Controlled Deployments. An "Institution-Controlled Deployment" is an IO deployment dedicated to a single Institution and operated within an environment controlled by that Institution, such as the Institution's own cloud account or on-premises infrastructure. In an Institution-Controlled Deployment, the Institution controls the authorized research datasets and their use within that environment. DATAIZE does not require routine transfer of raw patient-level datasets to DATAIZE-controlled systems to perform the authorized research workflows. Any access by DATAIZE personnel, support activities, or processing on the Institution's behalf depends on the deployment configuration, the Institution's authorization, applicable law, and the governing agreement, including any business associate agreement required under HIPAA.

BAA/DPA priority. If a duly executed BAA, DPA, research agreement, or procurement contract imposes more specific privacy or security requirements, that agreement controls for the relevant data and Services.

2. Information We Collect

3. Sources of Information

Directly from you. When you create an account, submit a research question, upload or connect data, select tools/models, contact support, or enter into a transaction.

From your Institution. When an authorized hospital, university, laboratory, company, public agency, or research organization provisions your account, configures your deployment, or provides Institutional Data.

Automatically from your device and use of the Services. Through logs, cookies, authentication systems, and similar technical mechanisms used for operation, security, and analytics.

From service providers and integrations. Cloud infrastructure, identity providers, communications vendors, payment or billing providers, AI/model providers enabled for the deployment, and other contracted service providers.

From public or licensed research sources. For example, bibliographic metadata and abstracts returned through authorized literature-search integrations such as PubMed, and metadata about research tools or models.

4. How We Use Information

Provide and operate the Services. Authenticate users; create and manage Notes; connect authorized sources; profile data; build and execute workflows; call permitted tools/models; generate, validate, store, display, and export Artifacts; and provide institutional administration.

Support reproducible research. Record approved research conditions, workflow state, changes, tool/model versions, and generated results where the deployment supports those functions.

Security and reliability. Detect unauthorized access, investigate errors, monitor performance, prevent abuse, patch vulnerabilities, respond to incidents, and maintain continuity.

Customer support and maintenance. Respond to questions, troubleshoot errors, provide updates, patches, training, and maintenance under the applicable contract.

Billing and contract administration. Process orders, invoices, procurement, license terms, and payment records where applicable.

Analytics and product improvement. Understand feature performance and usage, improve usability and reliability, and evaluate research workflows using aggregated or appropriately de-identified information where permitted.

Communications and marketing. Send service notices, security alerts, support communications, and — where permitted — marketing communications. You may opt out of non-essential marketing.

Legal compliance. Comply with law, enforce agreements, protect rights and safety, respond to lawful requests, and maintain records required by regulation or contract.

5. AI, Language Models, and Model Training

5.1 Patient-level Data Minimization in Language-Model Workflows

IO is designed so that, for data-profiling and study-design workflows, language-model reasoning ordinarily uses variable definitions, schema/data-structure information, code systems, units, missingness, measurement timing, and other summary information rather than patient-level values, where technically and contractually configured. Other authorized analysis steps may require more detailed data to execute statistical or computational tasks. The actual data path depends on the workflow, selected model/tool, and deployment.

5.2 Third-Party AI/Model Providers

Some deployments may allow selection or use of third-party AI/model providers. If enabled, prompts, metadata, permitted content, or other information necessary for inference may be transmitted to that provider under DATAIZE's contract and the Institution's deployment settings. The specific provider and data path may vary by environment. Sensitive Medical Data should not be sent to an external model provider unless the applicable Institution, contract, and law authorize that processing.

For an Institution-Controlled Deployment, transmission of Sensitive Medical Data or patient-level information to an AI/model endpoint operating outside that deployment's environment requires the Institution's express authorization and must comply with applicable law and contract, including any business associate or subcontractor agreement required under HIPAA and any applicable data-location requirements. The permitted model endpoints, data elements transmitted, provider data-retention settings, and related safeguards are determined by the deployment-specific configuration and documentation.

5.3 No Default Training on Submitted Data

6. Tool Hub, Third-Party Tools, and External Integrations

IO may provide a Tool Hub containing DATAIZE-developed and third-party/open-source methods, pipelines, and models. DATAIZE may validate tool execution and standardize inputs/outputs, but the tool's license and technical architecture may affect how data is processed.

Where a Tool Hub tool executes inside the authorized IO environment, data may remain within that environment subject to its configuration.

Where an external API, model, cloud service, or tool is enabled, information necessary for that integration may be disclosed to the external provider as authorized by contract and institutional settings.

We encourage Institutions to review tool/model licenses, validation scope, data-flow requirements, and subprocessors before enabling use with Sensitive Medical Data.

7. How We Disclose Information

Service providers and subprocessors. We may disclose information to vendors that provide cloud hosting, security, communications, support, analytics, payment/billing, AI/model inference, or other services on our behalf, subject to contractual confidentiality and data-protection obligations. The exact providers vary by deployment; AWS is among the cloud providers used by DATAIZE in certain environments.

Your Institution and its administrators. Institutional administrators may access account information, usage information, project metadata, and data necessary to administer the authorized deployment, subject to the Institution's policies and contract.

Integrations selected or authorized by you or your Institution. Information may be disclosed to a third-party tool, model, API, identity provider, storage environment, or institutional system when you or your Institution enables that integration.

Corporate transactions. Information may be transferred in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable privacy obligations.

Legal and safety reasons. We may disclose information when required by law or when reasonably necessary to protect rights, safety, security, investigate fraud, or enforce our agreements.

With consent or instruction. We may disclose information for additional purposes when you or your Institution provides valid consent or instructions.

DATAIZE does not sell Submitted Data or Sensitive Medical Data. DATAIZE does not use Sensitive Medical Data for advertising or cross-context behavioral advertising unless a separate legally valid authorization expressly permits that use.

8. De-identified and Aggregated Information

Where permitted by law and contract, we may de-identify or aggregate information and use it for security, statistical analysis, quality assurance, reliability, error detection, benchmarking of analytical workflows, and service optimization. We maintain and use De-identified Data only in de-identified form, do not attempt to re-identify it, and contractually require any recipient of De-identified Data not to re-identify it. De-identification does not reduce protections where applicable law continues to treat the data as regulated.

De-identification or aggregation of Institutional Data does not, by itself, authorize DATAIZE to export, retain, or use such data outside the purposes and instructions approved by the Institution. Where DATAIZE acts as a Business Associate, it will de-identify PHI only as permitted by the applicable business associate agreement and will treat information as de-identified only if it meets the HIPAA de-identification standard in 45 C.F.R. § 164.514(b). Any separate use for benchmarking, product development, or other secondary purposes remains subject to applicable law and the Institution's agreement and required authorizations.

9. Data Retention, Deletion, and Backups

Retention depends on the data category, deployment, contract, institutional policy, research requirements, legal obligations, and the purpose for which the information was collected. Institutional instructions and an applicable DPA/BAA may set different periods.

The general retention and deletion timeframes above primarily describe DATAIZE-managed information and systems. For Institutional Data held in an Institution-Controlled Deployment, retention, deletion, export, and backup schedules are determined by the Institution's authorized configuration, applicable law, and governing agreements. Where DATAIZE maintains Institutional Data on an Institution's behalf, at the end of the services DATAIZE will return or securely destroy that data at the Institution's direction and as required by the governing agreement, including any business associate agreement, unless retention is required by law. Any copies that cannot feasibly be returned or destroyed, such as data in encrypted backups awaiting scheduled expiry, will remain protected under the agreement until they are destroyed. DATAIZE will assist with requests to the extent required by the agreement and supported by its authorized access and technical controls.

Deletion from a user-facing interface may not immediately delete backup copies or legally required records. Where product UI deletion/retention controls are limited, DATAIZE and the Institution may process requests through administrative procedures or institutional SOPs.

10. Security and Breach Response

We use reasonable administrative, technical, and physical safeguards appropriate to the data and deployment. Measures may include encryption in transit and at rest, access control and role-based permissions, infrastructure/application monitoring and security logging, vulnerability management, patching, incident response, and vendor/subprocessor assessments.

No security measure is absolute. If a security breach involving Personal Information or Sensitive Medical Data triggers a legal or contractual notification duty, DATAIZE will notify affected Institutions, individuals, or authorities as required by applicable law and agreement.

For a confirmed or reasonably suspected security incident affecting Institutional Data that DATAIZE maintains or processes on an Institution's behalf, DATAIZE will notify the Institution without unreasonable delay after discovery (and within any shorter period required by applicable law or the governing agreement) and will cooperate with the Institution's investigation, mitigation, and notification efforts. The parties will determine their respective notification and remediation responsibilities, including under HIPAA and any applicable Texas requirements, based on their legal roles, the nature of the incident, and relevant statutory deadlines.

Users should not send patient identifiers, raw patient data, passwords, access tokens, or other secrets through ordinary support channels. Product screenshots or support records should be minimized to the information necessary to diagnose the issue.

11. International and Cross-Border Transfers

DATAIZE is headquartered in the Republic of Korea and may use infrastructure, vendors, or service providers in other jurisdictions, including the United States, depending on the deployment and enabled services. Cross-border transfer of Personal Information is performed only where permitted by applicable law and contract. Where required, DATAIZE uses appropriate safeguards such as contractual protections, Standard Contractual Clauses, access controls, and encryption.

For Korean Personal Information subject to PIPA, where a cross-border transfer requires a separate notice or consent, DATAIZE or the applicable Institution will provide the legally required information about the recipient, country, purpose, transfer method/timing, retention period, and available rights or refusal consequences through the applicable notice, consent, DPA, or procurement documentation.

For U.S. healthcare deployments, including Institution-Controlled Deployments, data storage location, backups, remote access, external integrations, and cross-border processing are governed by the approved deployment configuration and applicable agreements. Where Texas Health and Safety Code Chapter 183 applies, DATAIZE will (a) ensure that covered electronic health records under its control, including records stored with cloud or other third-party providers, are physically maintained in the United States or a U.S. territory; (b) limit access to those records as that Chapter requires; (c) apply reasonable administrative, physical, and technical safeguards to them; and (d) support the Institution's compliance for records under the Institution's control. Approval of a U.S. cloud region does not, by itself, authorize unrestricted remote access from, or transfer to, other jurisdictions.

12. Your Privacy Rights

Depending on where you live and the role in which DATAIZE processes your information, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent, or receive a portable copy of certain Personal Information. Institutional users may need to submit requests through their Institution when the Institution controls the data.

Access and confirmation. Request information about whether and how we process your Personal Information.

Correction. Request correction of inaccurate or incomplete Personal Information.

Deletion. Request deletion where applicable, subject to legal, contractual, research, backup, and institutional retention requirements.

Restriction or suspension. Request restriction or suspension of certain processing where applicable.

Objection and marketing opt-out. Object to certain processing based on legitimate interests and opt out of non-essential direct marketing.

Portability. Where applicable, request Personal Information in a structured, commonly used, machine-readable format.

Withdraw consent. Where processing is based on consent, withdraw it prospectively. Withdrawal does not affect processing lawfully completed before withdrawal.

To exercise applicable rights, contact privacy@dataize.io. We may need to verify your identity and authority. If the data is controlled by an Institution, we may direct the request to that Institution.

13. Additional Information for Specific Jurisdictions

13.1 Republic of Korea

For Personal Information subject to the Personal Information Protection Act (PIPA), DATAIZE processes Personal Information on a lawful basis, provides required notices/consents, applies safeguards, and supports applicable rights to access, correction, deletion, and suspension. Where processing is entrusted to service providers or transferred overseas, legally required disclosures or contractual measures will be provided through the relevant notice, consent, DPA, procurement documentation, or subprocessor information.

13.2 European Economic Area / United Kingdom

Where GDPR or UK GDPR applies, DATAIZE processes Personal Information on one or more lawful bases, including performance of a contract, legitimate interests, consent, and compliance with legal obligations. Where DATAIZE acts as a processor, the applicable Institution or customer is generally responsible for the lawful basis for Institutional Data. International transfers are protected through recognized safeguards where required. Individuals may also have the right to complain to a competent supervisory authority.

13.3 California

Where the California Consumer Privacy Act/California Privacy Rights Act applies, California residents may have rights to know/access, delete, correct, and opt out of certain sale or sharing, and to limit certain uses of sensitive personal information. DATAIZE does not sell Submitted Data or Sensitive Medical Data. To submit a request, contact privacy@dataize.io. We do not discriminate against individuals for exercising applicable privacy rights.

13.4 Washington, Nevada, and Other Consumer Health Laws

Where a U.S. state consumer-health privacy law applies to data that is not otherwise exempt or governed by HIPAA or institutional research exceptions, DATAIZE or the applicable Institution may provide a supplemental Consumer Health Privacy Notice describing the required categories, purposes, disclosures, and rights.

13.5 Texas

Where the Texas Data Privacy and Security Act (TDPSA) applies to DATAIZE as a controller, Texas consumers may request to confirm whether DATAIZE processes their personal data and to access that data; to correct inaccuracies in it; to delete personal data provided by or obtained about them; to obtain a copy of personal data they previously provided to DATAIZE, where the data is available in a digital format, in a portable and, to the extent technically feasible, readily usable format; and to opt out of the processing of their personal data for targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect. These rights are subject to the TDPSA's exemptions. For example, the TDPSA does not apply to individuals acting in a commercial or employment context, such as institutional users acting on behalf of their organizations, or to protected health information, health records, or identifiable information collected in human-subjects research conducted in accordance with applicable law.

DATAIZE does not sell personal data and does not process personal data for targeted advertising.

Texas privacy requests may be submitted (1) by email to privacy@dataize.io, or (2) by mail to DATAIZE, Attn: Privacy Requests, 2450 Holcombe Blvd, X+250, Houston, TX 77021, USA. We may need to verify your identity before acting on a request. Where the TDPSA applies, DATAIZE will respond without undue delay and no later than 45 days after receiving a request. We may extend this period once by an additional 45 days when reasonably necessary; if we do, we will tell you about the extension and the reason for it within the initial 45-day period. Responses to requests are free of charge at least twice annually per consumer. If we decline to act on a request, we will explain why and how to appeal.

Appeals may be submitted through either method above with the subject "Texas Privacy Appeal." We will inform you in writing of any action taken or not taken in response to the appeal, including the reasons for our decision, no later than 60 days after receiving it. If we deny an appeal, we will provide the online mechanism through which you may submit a complaint to the Texas Attorney General (currently available at https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint).

Requests concerning medical or research records controlled by an Institution may need to be directed to that Institution and may be governed by HIPAA, the Texas Medical Records Privacy Act, applicable research requirements, and the relevant institutional agreements rather than the TDPSA. DATAIZE will not discriminate against consumers for exercising rights protected by applicable law.

14. Children's Privacy

The Services are not intended for individuals under 18 to create or operate Accounts. We do not knowingly solicit account registration from children. Institutional Research Data may lawfully include information about minors where the Institution has the required legal basis, consent/authorization, IRB/ethics approval or waiver, and other protections. Such data is treated according to the applicable contract and law.

15. Cookies and Similar Technologies

DATAIZE websites and online Services may use cookies, local storage, and similar technologies for authentication, security, preferences, performance, and analytics. Where required by law, we provide consent choices for non-essential cookies. You can also control cookies through your browser, although disabling essential cookies may prevent certain Services from functioning.

16. Changes to This Policy

We may update this Policy as the Services, deployment models, vendors, or legal requirements change. We will post the updated date and provide additional notice of material changes where required by law or contract. We encourage you to review this Policy periodically.

Contact Information

Privacy and Data Protection inquiries: privacy@dataize.io

Seoul Medical Informatics Intelligence Lab, Inc. (DATAIZE)

U.S. correspondence address: 2450 Holcombe Blvd, X+250, Houston, TX 77021, USA

Website: www.dataize.io (and other DATAIZE-operated domains where this document is linked)

General support and administrative inquiries: admin@dataize.io