Our Compliance Standards

Quality is not a department at Image Analysis Group, it's how we work. Our quality management system underpins every read, every dataset, and every submission, ensuring your imaging data stands up to regulatory scrutiny anywhere in the world. We believe rigorous science and audit-ready compliance are inseparable.

FDA

FDA 21 CFR Part 11

Electronic records and electronic signatures for FDA-regulated trials

What it is: 21 CFR Part 11 is the US Food and Drug Administration regulation governing the use of electronic records and electronic signatures in FDA-regulated clinical research. It sets requirements for system validation, audit trails, access controls, and signature integrity so that electronic data carries the same weight as a signed paper record.

How we comply: IAG’s imaging platform, DYNAMIKA, is validated to Part 11 requirements. Every read, measurement, and query is captured in a time-stamped, attributable audit trail that cannot be altered or overwritten. Access is role-based and individually authenticated, electronic signatures are bound to the signing user, and all validation, change-control, and periodic-review documentation is maintained and available for inspection.

Compliance status: IAG maintains a formal Declaration of Compliance with 21 CFR Part 11 for DYNAMIKA (Image Analysis Ltd, 2025), authorised by the Senior Product Manager and Chief Product Officer, supported by a full clause-by-clause compliance matrix. Note: Part 11 is a regulation, not an award — there is no FDA certificate to cite; this is a documented self-declaration backed by validation evidence.

FDA — 21 CFR Part 11

ISC

ISO 13485

Quality management systems for medical devices

What it is: ISO 13485 is the international standard for quality management systems in the medical device sector. It specifies requirements for design controls, risk management, document control, supplier oversight, and post-market surveillance, and is the recognised benchmark for organisations supplying software or services into regulated device and diagnostic programmes.

How we comply: IAG operates a certified quality management system covering imaging core lab services and the design, development, and maintenance of our imaging software. Risk management is applied across the software lifecycle, all procedures are version-controlled with documented training records, and vendors and subcontractors are formally qualified. The system is subject to internal audit and annual surveillance audit by our notified certification body.

Certified: BSI certificate no. MD 565340, ISO 13485:2016. Originally registered 22 February 2011; current certification effective 22 February 2023, expiring 21 February 2026. Certified scope: design and manufacture of a software system for viewing and post-acquisition processing of MRI data from DICOM files.

ISO 13485 standard

GDPR

EU General Data Protection Regulation

What it is: The GDPR is the European Union regulation governing the processing of personal data, including the special-category health and imaging data generated in clinical trials. It requires a lawful basis for processing, data minimisation, transparency, security by design, controlled international transfers, and prompt breach notification.

How we comply: All imaging data is pseudonymised on receipt and handled under documented data processing agreements that define IAG’s role as processor. We maintain records of processing activities, complete data protection impact assessments for new studies and systems, and apply encryption in transit and at rest. International transfers rely on approved safeguards, staff complete mandatory annual data protection training, and a documented incident response process governs breach notification timelines.

European Commission — GDPR

HIPAA

US Health Insurance Portability and Accountability Act

What it is: HIPAA sets the US federal standards for protecting individually identifiable health information. Its Privacy, Security, and Breach Notification Rules govern how protected health information may be used and disclosed, and mandate administrative, physical, and technical safeguards for organisations handling it on behalf of covered entities.

How we comply: IAG operates under business associate agreements with US sponsors and sites, and de-identifies imaging data in line with HIPAA standards before it enters the review workflow. Technical safeguards include encryption, unique user authentication, automatic session termination, and audit logging of every access to protected health information. Administrative safeguards cover workforce training, sanction policies, and documented risk analysis, with a formal breach notification procedure in place.

US Department of Health & Human Services — HIPAA

SOC 2

AICPA Service Organization Control reporting — security, availability, and confidentiality

What it is: SOC 2 is an independent attestation framework developed by the American Institute of Certified Public Accountants. An accredited audit firm examines a service organisation’s controls against the Trust Services Criteria — security, availability, processing integrity, confidentiality, and privacy — and issues a report on their design and, in a Type II report, their operating effectiveness over time.

How we comply: IAG’s hosting environment, imaging platform, and supporting operational processes are covered by an annual SOC 2 examination. Controls span logical access provisioning and revocation, change management, network monitoring, vulnerability management, backup and disaster recovery, and vendor risk oversight. The resulting report is available to sponsors under NDA to support their own vendor due-diligence and audit requirements.

Report issued: SOC 2 Type 2 independent service auditor report covering the DYNAMIKA system, reporting period 4 October 2024 to 4 October 2025, against the Security Trust Services Criteria. Management assertion signed 26 November 2025 by the Chief Product Officer. Report available to sponsors under NDA.

AICPA — SOC 2