Scope & License

PurpleAI grants a non-exclusive, non-transferable, site-limited license to use Hyper Insight – ICH solely according to its Instructions for Use (IFU) and applicable law. Title remains with PurpleAI.

Clinical & Regulatory Scope

Hyper Insight – ICH is classified as a Radiological Computer-Assisted Triage and Notification Device (21 CFR 892.2080, product code QAS). It supports triage and notification of suspected intracranial hemorrhage on non-contrast head CT. The software is not diagnostic and must be used by qualified medical professionals within validated clinical workflows.

Acceptable Use & Restrictions

Users may not reverse-engineer, resell, modify, or use the software outside cleared indications. Comparative benchmarking or publication of results without written consent is prohibited.

Shared Responsibilities

• Customer: Responsible for DICOM routing, compatible PACS integration, access management (SSO/SAML, MFA), user training, retention settings, and lawful PHI handling.
• Vendor: Responsible for secure operation, vulnerability management, regulatory compliance, and notification of material updates that could impact labeling or validated workflows.

Security Baseline

PurpleAI maintains an ISO/IEC 27001-aligned security program within its ISO 13485-compliant Quality Management System. Security-by-design principles are applied through RBAC, encryption, centralized logging, and periodic third-party testing.

Data, Privacy & Roles

Customer retains ownership of PHI. PurpleAI processes PHI only to deliver services under the HIPAA BAA. De-identified data may be used for safety, reliability, and quality improvement. PHI is stored in US regions. For website and analytics data, PurpleAI acts as a data controller in accordance with CCPA/CPRA.

Updates & Material Changes

Routine updates, recalibrations, and minor improvements are provided regularly. Material changes that affect labeling or validated workflows will include prior notice, updated documentation, and, when feasible, deferral options for customers.

Support & Service Levels

PurpleAI provides 24×7 support for critical incidents and commercially reasonable uptime and response targets consistent with industry standards.

SLA > 99.9%

Software Bill of Materials (SBOM)

A current SBOM is available upon request for major releases or material changes.

Warranties & Disclaimers

PurpleAI warrants that its software conforms to published documentation and IFU. All other warranties, express or implied, are disclaimed. The device is for triage and notification only.

Indemnity & Liability

PurpleAI defends against third-party IP infringement claims (excluding misuse, combinations, or modifications). Customer indemnifies PurpleAI for off-label use or legal violations. Aggregate liability is limited to fees paid in the preceding 12 months.

Termination & Data Handling

Upon termination, customers have 30 days to export data, if any. PHI will be deleted according to BAA timelines. Obligations regarding confidentiality, IP, and liability survive termination.

Compliance & Governing Law

Governed by Delaware law with venue in New York County, NY. Order of precedence: BAA → EULA → IFU → Order Form.

Roles

PurpleAI acts as a HIPAA Business Associate for PHI and as a data controller for website interactions.

Data Types

• Operational and account data
• Device and network metadata
• DICOM images and derived artifacts
• De-identified telemetry for reliability and safety

Use & Sharing

Data is used solely for service delivery, compliance, and improvement. Subprocessors are bound by equivalent security standards. No PHI is sold or shared for marketing purposes.

Data Residency

All PHI is processed and stored within US regions.

Retention & Deletion

Image data is retained minimally. Operational logs ≤ 12 months; support records ≤ 24 months. Deletion requests are honored within 30 days unless legal retention is required.

User Rights

Website users may request access, correction, or deletion per CCPA/CPRA. PHI-related rights are exercised through the Covered Entity.

Breach Notification

HITECH-compliant breach notifications will be made without unreasonable delay and no later than 3 to 5 business days.

Permitted Uses & Disclosures

PurpleAI may use or disclose PHI only to perform contracted services, using the minimum necessary standard. De-identification is performed per 45 CFR §164.514.

Safeguards

Administrative, physical, and technical safeguards are maintained per the HIPAA Security Rule. Workforce training and risk management are ongoing.

Incident Reporting

Any incident involving unsecured PHI will be reported promptly, no later than 3 to 5 business days after discovery.

Subcontractors

All subcontractors handling PHI are bound by equivalent contractual obligations.

Access, Amendment, and Accounting

PurpleAI supports Covered Entities in meeting patient access and accounting requests.

Return or Destruction of PHI

Upon termination, PHI will be returned or destroyed if feasible; otherwise, protections continue indefinitely.

Survival

All confidentiality and PHI-related obligations survive termination. In case of conflict, the BAA prevails.