Legal
Last updated 2026-08-26
Medical disclaimer — not a medical device
MedSeal is an integrity and provenance tool. It attests whether a medical image is the one a trusted issuer sealed and shows where pixels changed. It does not perform diagnosis, does not interpret images, and is not a medical device. It is not cleared or approved by the FDA, EMA, CDSCO, or any regulator. Do not use it as a basis for any clinical, diagnostic, or treatment decision. Clinical judgment remains solely with qualified healthcare professionals.
Terms of Service
By using MedSeal (the "Service"), operated by [Provider], you agree to these Terms. If you do not agree, do not use the Service.
Acceptable use. You may use the Service only for lawful purposes and only with images you are authorized to process. You must not upload content that infringes rights, violates privacy law, or that you lack consent to handle. You must not attempt to break, overload, or misuse the Service, or use it to mislead others about a scan's authenticity.
No reliance for clinical use. The Service is provided for integrity verification and demonstration only; see the medical disclaimer above. You are responsible for how you use its output.
Intellectual property. MedSeal is open source under its published license; your use is subject to that license. You retain rights to your own images and data.
Changes & termination. [Provider] may modify or discontinue the Service and may update these Terms; continued use means acceptance.
Governing law. These Terms are governed by the laws of [jurisdiction], without regard to conflict-of-laws rules.
Privacy
What we process. Images and identifiers (e.g. patient/hospital IDs) you submit to seal or verify. Do not upload real patient data (PHI/PII) to a public demo instance; use synthetic or de-identified images.
How it is handled. Processing happens in-memory for the request. Per-session artifacts are held transiently and evicted after a short TTL; the cryptographic signing material stays server-side and is never sent to clients. The Service can run fully offline. We do not sell your data and do not use it for advertising.
Third parties. If you choose to anchor a proof on Bitcoin via OpenTimestamps, only a hash (the Merkle root) leaves the server — never your image or identifiers. TLS is provided via Let's Encrypt.
Your rights. Depending on your jurisdiction (GDPR, India DPDP, CCPA) you may have rights to access or delete data. Contact [contact email]. For any deployment handling real PHI, a HIPAA Business Associate Agreement and a formal DPA are required and are your responsibility as the operator.
Warranty & limitation of liability
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. [Provider] does not warrant that the Service is error-free, uninterrupted, or that it will detect every possible manipulation.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, [Provider] SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS ARISING FROM CLINICAL DECISIONS, DATA LOSS, OR RELIANCE ON THE SERVICE. Some jurisdictions do not allow certain exclusions; those may not apply to you.
Contact. [contact email].