Back to the index

Data security and privacy

CBCTHub handles sensitive medical data. Security and regulatory compliance are core to the product — not an add-on.

Encryption

  • In transit: all traffic travels over HTTPS (TLS 1.2+). Neither the DICOM, the report, nor patient data cross the internet in clear.
  • At rest: files are stored encrypted on cloud storage. Only CBCTHub holds the decryption keys.
  • Local DICOM processing: your browser processes the raw file locally with WebAssembly; what gets uploaded to the server is already processed for visualization.

Regulatory compliance

CBCTHub is designed to comply with the main medical data regulations internationally:

  • HIPAA (United States) — health information protection.
  • GDPR (European Union) — personal data protection.
  • LGPD (Brazil) — Lei Geral de Proteção de Dados.
  • Local regulations in Argentina, Chile, Mexico, Colombia and other Latin American countries.
NotaIf your institution requires a signed DPA (Data Processing Agreement), we have it as a downloadable template at Help. For any custom adjustment, write to us.

Anonymization

There are several ways to show exams without exposing patient data:

  • Anonymized embed: when embedding the viewer on another site (iframe), the patient name is hidden by default.
  • Presentation mode: button on the viewer to hide name/birth date when projecting (talks, conferences, second opinion).
  • Toggle from the patient dropdown: hide/show identifying data without changing the real DICOM metadata.

Your rights over the data

As administrator of your account, you can at any time:

  • Export your data: download a ZIP with all your exams, reports, consents and metadata (portability right, GDPR Art. 20).
  • Audit log: view and download as CSV the audit log of your account (who did what and when).
  • Delete the account: from Settings › Account. Permanently deletes all your data (not recoverable).
ImportantePatients ≠ Center account. If a patient asks you to exercise their “right to be forgotten” over their exams, you as the data controller are the one who must delete those specific exams — CBCTHub does not act unilaterally on patient data.

Incident notification

In the case (we hope never happens) of a security breach affecting your data, we will notify you within 72 hours, as required by GDPR. The full policy is on Privacy policy.