Terms of Use for RadScore

1. Operator and scope

RadScore is operated by the following individual:

Email: info@radscore.de

This person is referred to below as the “operator”.

RadScore is not a separate legal entity. The name “RadScore” refers to the platform and the technical system offered under that name.

These Terms of Use apply to registered users of RadScore.

Supplementary project-specific rules, study protocols, cooperation agreements, agreements on processing on behalf of a controller, joint controllership arrangements, ethics approvals and institutional requirements remain applicable.

2. Purpose of the platform

RadScore is intended for the conduct of scientific and clinical-scientific imaging projects.

In particular, the platform supports:

• the administration of research projects,
• the provision of pseudonymised medical imaging data,
• the training of readers,
• test and main assessments,
• consensus and adjudication procedures,
• the structured collection of research data,
• the export of pseudonymised results.

RadScore is not intended for primary clinical diagnosis, emergency care or the direct management of individual patient treatment.

RadScore is not a substitute for a clinical PACS, RIS, hospital information system or authorised medical device.

3. Authorisation to use the platform

RadScore may be used only by persons who:

• have been authorised by the operator or an authorised institution,
• have a personal user account,
• meet the necessary professional and organisational requirements,
• comply with the applicable data protection and project requirements.

There is no entitlement to registration, approval or participation in a particular project.

Participation may be made dependent on training, confidentiality undertakings, institutional approvals or completion of a test reading.

4. User account and access security

User accounts are personal and must not be shared or transferred.

Users are required to:

• provide correct and current contact details,
• keep access credentials secret,
• use secure passwords,
• make appropriate use of the security functions offered,
• properly end sessions on shared devices,
• report suspected misuse without delay.

Passwords, authenticator codes, recovery codes and active sessions must not be disclosed to other persons.

The operator may require two-factor authentication for particularly privileged roles.

5. Roles and permissions

The available functions depend on the respective global and project-specific role.

Possible roles include in particular:

• system administrator,
• project creator,
• project administrator,
• reader,
• viewer or person authorised to export,
• adjudicator,
• consensus moderator.

Users may access only the data and functions they need for their assigned task.

Any attempt to circumvent technical or organisational access restrictions is prohibited.

6. Permitted and prohibited use

RadScore may be used only for approved scientific, quality-assurance or institutional purposes.

The following in particular are prohibited:

• use for unauthorised purposes,
• access to projects or data not assigned to the user,
• sharing a user account,
• circumventing roles or security functions,
• automated bulk queries without approval,
• introducing malware,
• impairing availability or integrity,
• using exported data outside the approved project,
• attempting re-identification,
• disclosing confidential data to unauthorised third parties,
• transmitting data to unapproved external services,
• searching for vulnerabilities without prior authorisation.

Security vulnerabilities should be reported confidentially to the operator and must not be publicly exploited or disclosed.

7. Requirements for contributed data

The institution or person contributing data to RadScore is responsible for ensuring that:

• the data were collected lawfully,
• an appropriate legal basis exists for their use in research,
• required ethics approvals and authorisations are in place,
• information and consent obligations have been fulfilled,
• only necessary data are provided,
• medical imaging data were properly pseudonymised before import,
• directly identifying information was removed,
• required agreements between the participating bodies have been concluded.

Before import, DICOM data must be checked for identifying metadata and burned-in patient information.

RadScore's technical import check does not release the data-providing party from its responsibility.

8. Handling pseudonymised data

Pseudonymised data must be treated as confidential.

In particular, users must not:

• attempt to attribute pseudonyms to a natural person,
• combine data with external sources for identification,
• use linkage lists without explicit authorisation,
• treat pseudonymised data as freely available anonymous data.

Any unintended disclosure or possible re-identification must be reported without delay.

9. Scientific integrity

Users are required to conduct assessments independently and in accordance with the respective study protocol.

Where an independent assessment is intended, the following in particular are prohibited:

• prior coordination with other readers,
• unauthorised access to assessments by other users,
• influence outside the designated consensus procedures,
• undocumented subsequent alteration,
• deliberate entry of false or misleading data.

10. Free-text fields and annotations

Free-text fields may contain only necessary project-related information.

In particular, the following must not be entered:

• patient name,
• date of birth,
• address,
• clinical patient or case number,
• contact details,
• other directly identifying information,
• access credentials,
• offensive, discriminatory or irrelevant content.

11. Exports

Exports may be created only by authorised users and used solely for the approved project purpose.

Exported data must be stored and transmitted according to their need for protection. They must not be processed in private cloud storage, on unsecured devices or through unapproved communication services.

Responsibility for the further handling of a downloaded export rests with the exporting person and their institution.

12. AI-assisted functions

AI-assisted functions are not available in the currently intended production operation.

Separate usage rules will be provided if they are activated in the future. Directly identifying patient data or unapproved medical data must not be entered into AI functions even then.

13. Confidentiality

All non-public information about projects, data, study planning, assessments, results, security measures and participating persons must be treated as confidential.

This obligation continues after the authorisation to use the platform ends.

Further statutory, contractual and professional confidentiality obligations remain unaffected.

14. Availability and maintenance

The operator endeavours to provide secure and reliable operation.

There is no entitlement to uninterrupted or error-free availability at all times. Maintenance, security updates, technical faults or events outside the operator's control may result in restrictions.

RadScore must not be used as the sole repository for original data that must be retained for clinical or statutory reasons.

15. Suspension and termination

The operator may temporarily suspend or permanently deactivate a user account where:

• the authorisation to use the platform ends,
• these Terms of Use are breached,
• a security risk exists,
• misuse is suspected,
• institutional or project-specific approval is withdrawn,
• statutory or contractual reasons require it.

In the event of urgent security risks, suspension may take place without prior notice.

Project-related data are not automatically erased when a user account is suspended.

16. Rights in software and content

The rights in the RadScore software, design, technical documentation and platform-specific content remain with the respective rights holder.

Use of the platform does not confer any further rights in the software.

Rights in medical imaging data, project documents, scoring definitions and scientific results are governed by statutory provisions and agreements between the participating institutions.

By uploading data, the operator receives only the permissions required for the technical provision and conduct of the respective project.

17. Liability

The operator has unlimited liability:

• in cases of intent and gross negligence,
• for damage arising from injury to life, body or health,
• under mandatory statutory liability provisions,
• to the extent of any guarantee expressly assumed.

In the event of a slightly negligent breach of an essential obligation, liability is limited to the typical and foreseeable damage.

In all other respects, liability for slight negligence is excluded to the extent permitted by law.

RadScore is a research platform and is not intended for direct clinical patient care.

The operator is not liable for clinical decisions made contrary to this intended purpose solely on the basis of RadScore, an assessment collected within RadScore or automated output.

Mandatory data protection liability provisions remain unaffected.

18. Changes to the platform and the terms

The operator may further develop RadScore and change, add or discontinue functions, provided that the legitimate interests of ongoing research projects are appropriately taken into account.

The current version of the Terms of Use is publicly accessible through RadScore.

Registered users will be informed of material changes within the platform or by email.

19. Transfer to another operator

The operation of RadScore may later be transferred to a company or another suitable legal person.

Any such transfer will comply with contractual and data protection requirements.

Users and participating institutions will be informed about the new operator and material effects.

20. Applicable law

The law of the Federal Republic of Germany applies.

Mandatory statutory provisions remain unaffected.

21. Contact

Questions about use, security reports and general enquiries may be directed to: