EchoReview AI
RESEARCH PREVIEW — NOT FOR CLINICAL USE. EchoReview AI is an investigational workflow tool. Output is a preliminary, non-diagnostic impression intended to support cardiologist review for research and quality-improvement purposes only. Not FDA-cleared. Do not use for patient care decisions. Do not upload identified PHI without an executed BAA.
Template — for review by hospital counsel

Data Use Agreement (DUA)

This template governs the exchange of de-identified echocardiogram data between a participating hospital and EchoReview AI during a non-clinical pilot. A separate Business Associate Agreement (BAA) is required before any Protected Health Information (PHI) is exchanged.

1. Parties

This DUA is entered into between [Hospital Legal Name] ("Data Provider") and [EchoReview AI Legal Entity] ("Recipient").

2. Purpose

The data is provided solely for the purpose of conducting a quality-improvement and product-validation pilot of Recipient's echocardiogram triage software. The pilot is not intended to inform individual clinical decisions.

3. Data Description

De-identified DICOM echocardiogram studies stripped of HIPAA Safe Harbor identifiers (45 CFR § 164.514(b)(2)), accompanied by optional non-identifying metadata (study date offsets, modality, indication code).

4. Permitted Uses

  • Algorithm benchmarking against cardiologist ground-truth reads.
  • Workflow validation and turnaround-time measurement.
  • Internal product improvement and aggregate reporting.

5. Prohibited Uses

  • Re-identification of any individual.
  • Use of pilot outputs to direct clinical care.
  • Re-disclosure to any third party except subcontractors bound by equivalent terms.

6. Security

Recipient will maintain encryption at rest (AES-256) and in transit (TLS 1.2+), role-based access controls, audit logging, and the technical safeguards described at /compliance.

7. Term & Termination

This DUA is effective for ninety (90) days and may be terminated by either party with thirty (30) days' written notice. Upon termination, Recipient will destroy or return all data within thirty (30) days.

8. Liability

Recipient's aggregate liability under this DUA is limited to direct damages and shall not exceed $10,000. Recipient disclaims all warranties; the software is provided AS IS for research purposes.

9. Governing Law

This DUA is governed by the laws of [State], without regard to its conflicts-of-law principles.

Disclaimer: This template is provided for convenience and is not legal advice. Both parties should have qualified counsel review and execute the final agreement.

Request executable DUAView BAA template