Draft for legal review

Data protection

Last updated: 28 October 2026

How we protect clinical material

• Blocking de-identification: every image uploaded to posts, tumour boards, the Hub or the journal is scanned. Raw DICOM is refused in posts and tumour boards; DICOM supplements are blocked if identifying tags are present. Images are re-encoded to strip EXIF/XMP/IPTC metadata, and suspected burned-in text must be redacted before upload.
• Private storage: manuscripts, case packs and verification documents are stored outside the public web root and served only after a permission check, through links that expire within 10 minutes.
• Encryption: verification documents and authentication secrets are encrypted at rest.
• Access control and audit: role-based permissions, two-factor authentication for editors and moderators, and an audit log of sensitive actions.

Your responsibilities

Follow your local consent and information-governance rules. If you notice identifiable information anywhere on the platform, use "Report PHI": the content is hidden immediately.