Security & privacy
Facts, not badges.
Where your images live, who can open them, when they leave BigMind, and what we do not claim. Plainly.
15 days free · 250 GB per seat · no card
BigMind Medical is not a diagnostic device. It keeps, files and shares images for review; a clinician reads every image.
- Stored in
- US clinics: AWS US East. UK clinics: the UK, on request
- Encryption
- AES-256 at rest, TLS in transit
- Access
- Invitation only, by role, per clinic
- Audit log
- Every link opened, download, change and API read
- Patient links
- Expiry, password, de-identify, stop at once
- Recovery
- Boot-tested images and a ransomware canary
Protection
How a study is kept safe.
- Where it lives, statedUS clinics’ images are stored in the United States (Amazon Web Services, US East); UK clinics can have theirs stored in the UK.
- EncryptedAES-256 at rest and TLS in transit, from the clinic computer to storage and back to the browser.
- Invitation onlyPeople join your clinic by invitation, with roles. Patients only see what you shared with them.
- An audit logEvery patient-link open and download, every link made or stopped, every rename or merge, every API read: who and when.
- API keys with limitsShown once, stored hashed, scoped to one clinic, rate limited and revocable at any time.
- Backups that come backRecovery images are boot-tested, and a ransomware canary freezes the backup chain mid-attack.
When images leave BigMind
Only in four ways, each started by you.
A patient link
The study you shared, to whoever opens the link, until it expires or you stop it.
A download
The files a signed-in user or a link holder downloads.
Your API key
What your own software sends for or reads over the API or DICOMweb. Every read is logged.
An AI consultation
Only if someone in your clinic starts one: the image they pick is sent to our AI provider to answer their question. Nothing is sent automatically.
We never sell your data.
Patient links
Sharing with guard rails.
- Expiry7, 30 or 90 days, or no end. The patient page shows the date.
- PasswordOptional, set per link.
- De-identifyNames, IDs and dates removed, including those hidden in other tags.
- Burned-in checkIf names may be in the pixels, BigMind asks you to check first.
What we don’t claim
No badges we don’t hold.
BigMind Medical does not claim HIPAA compliance, SOC 2 or ISO certification. Our cloud infrastructure provider holds its own certifications; they are not ours to claim. BigMind Medical is not a diagnostic device and is not a PACS.
What we do sign: a Business Associate Agreement (BAA) with US practices that need one. Ask for it, or for a security questionnaire, before you store patient data.
FAQ
Questions about security
Where exactly are our images stored?
US clinics’ images are stored in the United States (Amazon Web Services, US East); UK clinics can have theirs stored in the UK. A UK clinic tells us before it starts, and we set it up in the UK. Anywhere else, talk to us first.
Is BigMind Medical HIPAA compliant? Do you have SOC 2?
We do not claim either. Our cloud infrastructure provider holds its own certifications, but they are not ours to claim, and compliance depends on how a practice uses a service and on the agreements it signs. We sign a Business Associate Agreement (BAA) with US practices that need one; ask for it before you store patient data. BigMind Medical encrypts every study, limits who can open what, and logs every patient-link open, download, share, change and API read.
Do you sell or share our data?
We never sell your data. Images leave BigMind only in the four ways listed on this page, each started by you or your software.
What happens to our images if we stop?
Download them first, as the original DICOM files. If a trial is ending without a plan, we email you 7, 3 and 1 days ahead with the date the images would be deleted.
Questions before you start? Ask us.
Or start the 15-day trial with the sample clinic, which holds no real patient data.