1. Purpose and Scope
This declaration describes how CustoMED LTD ("CustoMED") collects, processes, protects, and deletes patient data submitted through its surgical planning platform (the "Platform") in connection with the design of Patient Specific Instrumentation (PSI) for orthopedic and craniofacial surgical procedures. It is intended for use by hospitals, surgical centers, and other healthcare institutions ("Customers") as part of their vendor due diligence and data governance processes.
2. Data Processed
The Platform processes the following categories of patient data submitted by authorized clinical users:
CT imaging data in DICOM format.
3D surface mesh files in STL format, derived from CT scans and containing geometric anatomical data only. STL files contain no patient identifiers.
Limited residual patient identifiers retained post-de-identification: patient initials and the last four digits of the patient ID. These are retained solely to allow the treating clinician to verify that the correct scan has been submitted and are not used by CustoMED for any other purpose.
CustoMED does not collect, store, or process full patient names, dates of birth, national identifiers, or any other demographic data.
3. De-identification Process
CustoMED applies a two-stage de-identification process to all imaging data prior to and upon receipt through its services:
Stage 1: Client-side (in the user's browser, before any data transmission): All DICOM metadata fields are inspected using an allowlist approach. Only technical fields strictly required for surgical planning are retained. All direct patient identifiers, including full name, date of birth, and other demographic fields, are removed at this stage. Patient name is reduced to initials; patient ID is reduced to its last four digits. No identifying metadata traverses the network.
Stage 2: Server-side (upon receipt): A second, independent de-identification pass re-applies the same allowlist, regenerates DICOM study and series identifiers (UID), and permanently deletes the original pre-anonymization file from storage. The pre-anonymization source file does not persist beyond this step.
This process is designed to ensure that, to the greatest extent technically practicable, data transmitted to and stored on CustoMED's infrastructure is de-identified in accordance with the HIPAA de-identification standard (45 CFR § 164.514) and the pseudonymization principles under GDPR (Article 4(5)).
4. Security Measures
CustoMED implements the following technical and organizational security measures to protect patient data throughout the surgical planning workflow:
All data is transmitted exclusively over encrypted HTTPS/TLS connections. No patient data is transmitted over unencrypted channels.
All upload operations use short-lived, cryptographically signed pre-signed URLs, limiting exposure of upload endpoints to authorized requests only.
Access to the Platform is authenticated and restricted by user role. Only authorized clinical users may upload or view case data.
De-identification occurs client-side, before data traverses the network, minimizing the volume of identifiable data processed on CustoMED's infrastructure.
CustoMED's cloud infrastructure is hosted on Amazon Web Services (AWS), benefiting from AWS's ISO 27001, SOC 2 Type II, and HIPAA-eligible service certifications.
Access controls and audit logging are applied at the infrastructure level to prevent unauthorized access or cross-customer data exposure.
5. Data Retention and Deletion
Pre-anonymization source files are permanently deleted from CustoMED's servers immediately upon completion of the server-side de-identification pass (Stage 2 above). These files do not persist beyond that point.
De-identified imaging data and surgical planning outputs are retained for the duration of the active case and for the minimum period required to support case follow-up, regulatory traceability, and applicable medical device record-keeping obligations.
Upon completion of a case or upon Customer request, CustoMED will securely delete associated data and provide written confirmation upon request.
All deletion is performed in a manner that renders data non-recoverable.
6. Regulatory and Compliance Framework
CustoMED's data handling practices are designed and maintained in accordance with the following regulatory frameworks:
Framework | Applicability to CustoMED |
HIPAA (US) | CustoMED acts as a Business Associate with respect to PHI submitted by HIPAA Covered Entities. CustoMED's de-identification process is designed to meet the HIPAA Safe Harbor standard (45 CFR § 164.514(b)). |
GDPR (EU/EEA) | CustoMED processes data in accordance with GDPR data minimization, purpose limitation, and security principles. Israel has been recognized by the European Commission as providing an adequate level of data protection, permitting data transfers from the EU/EEA to CustoMED without additional safeguards. |
ISO 13485 / 21 CFR Part 820 | CustoMED's Quality Management System governs data handling procedures as part of its medical device quality controls, including design controls, software validation, and post-market obligations. |
7. Contact and Further Information
Healthcare institutions and procurement teams with questions regarding CustoMED's data handling practices, or seeking to execute a formal Data Processing Agreement or HIPAA Business Associate Agreement, are invited to contact CustoMED at: customed.ai.