Does DICOM de-identification (anonymization) happen before data leaves our site?

Yes. All anonymization takes place entirely within the uploading user's web browser before any data is transmitted to Bioxydyn's servers. Images leave the device already de-identified, and a secondary PII verification check is performed on receipt.

Is the platform 21 CFR Part 11 compliant?

Yes. VoxelFlow is built to meet 21 CFR Part 11 requirements for electronic records and electronic signatures, with full audit trails, access controls, and version control across all study data.

Can sites upload data from any MRI scanner?

Yes. VoxelFlow accepts standard DICOM data and is compatible with all major scanner vendors and imaging protocols. No site-side configuration or software installation is required.

What happens to imaging data at the end of the study?

All data is securely archived and locked at study completion. Where downstream transfer to a sponsor or academic system has been completed and validated, Bioxydyn's copy is removed at the agreed time in line with the data management plan.

Data transfer solutions

Secure imaging data transfer for multicentre trials

Bioxydyn has been supporting multicentre imaging trials for over 15 years. We provide end-to-end image de-identification, transfer, and storage through VoxelFlow, our proprietary in-house platform built specifically for the demands of multicentre MRI trials.

Data upload

Browser-based DICOM upload — no software at sites

VoxelFlow makes it straightforward for sites to submit imaging data, with no software installation required. The complete upload process runs entirely within the user's web browser, minimising site burden and accelerating study start-up.

Supports DICOM images and associated metadata
Configurable metadata capture to meet project-specific requirements
Compatible with all major scanner vendors and imaging protocols
Guided workflows that reduce errors and site burden
Fully flexible support for uploading all type of metadata files

De-identification

Client-side DICOM de-identification (anonymization)

All de-identification and anonymization takes place within the uploading user's browser before any data leaves the site. Images are de-identified before they leave the device, with no need to install dedicated software or configure local infrastructure at study sites.

Fully client-side: images are anonymized before they leave the device
Secondary PII verification on receipt of data from each site
Images are only permanently stored once verified as de-identified
Transparent issue management if data quality problems are identified

Training & support

Comprehensive site onboarding and support

Bioxydyn manages all aspects of site onboarding for data submission, from initial training to ongoing technical support throughout the study with a dedicated project manager.

Training delivered to sites on how to use the VoxelFlow image transfer portal
Support for sites throughout the full duration of the study
Rapid response to site queries and upload issues
Built-in support for site qualification workflows

Secure storage

ISO 27001 certified secure storage

All imaging data are held in an ISO 27001 certified data centre and protected at every stage of transit and storage. VoxelFlow is built to meet 21 CFR Part 11 requirements for electronic records and signatures, and data handling practices are aligned with GDPR obligations for clinical research.

Data encrypted in transit using TLS
Data encrypted at rest
ISO 27001 certified data centre
21 CFR Part 11 compliant audit trails and access controls
GDPR-aligned data handling for EU clinical research
Data held for the full duration of the study
Secure data archiving and lock at study completion

Downstream transfer

Automated transfer to XNAT, and imaging platforms

Once data have been received and verified, Bioxydyn can facilitate automated or manual transfer to sponsor or academic imaging platforms, including systems such as XNAT.

Automated transfer via API integration where supported
Manual transfer managed by Bioxydyn staff as a fallback option
Bioxydyn coordinates all technical arrangements, with reasonable support from the recipient institution
Full traceability of all data transfers
Bioxydyn holds a copy for the study duration and removes it once downstream transfer is validated

FAQ

Frequently asked questions

Does DICOM de-identification (anonymization) happen before data leaves our site?: Yes. All anonymization takes place entirely within the uploading user's web browser before any data is transmitted to Bioxydyn's servers. There is no intermediate server at the site; images leave the device already de-identified. A secondary PII verification check is performed on receipt as an additional safeguard.
Is the platform 21 CFR Part 11 compliant?: Yes. VoxelFlow is built to meet 21 CFR Part 11 requirements for electronic records and electronic signatures, with full audit trails, access controls, and version control across all study data.
Can sites upload data from any MRI scanner?: Yes. VoxelFlow accepts standard DICOM data and is compatible with all major scanner vendors and imaging protocols. No site-side configuration or software installation is required.
What happens to imaging data at the end of the study?: All data is securely archived and locked at study completion. Where downstream transfer to a sponsor or academic system has been completed and validated, Bioxydyn's copy is removed at the agreed time in line with the data management plan.