Licensing medical imaging data for AI: a buyer's checklist

Licensing data is now a normal part of building imaging AI. Data licences aren't standard yet, though, and when something goes wrong it's usually in the contract, not the data. Here's what to pin down before you sign, in the order we'd check it.

1. Who has the right to license it?

Start with the chain of rights. The organisation selling you data is often not the one that collected it. Ask three things:

• Who holds the rights, by name?
• What agreement lets the seller license it to you?
• What did the patients consent to, or which ethics approval or waiver covers this kind of secondary use?

If the answers are vague, everything after them rests on nothing.

2. What exactly you're allowed to do

• Purpose. Training, validation, regulatory submission, a commercial product: each should be named.
• Field of use. Is the licence limited to one condition, body part or product?
• Territory and term. Where you can use it, for how long, and what happens at the end.
• Exclusivity. Most data licences are non-exclusive. Exclusivity costs more and is rarely needed.
• Who else can touch it. Your cloud provider, annotation vendor or contract research organisation may need access. Make sure the licence allows it.

3. Who owns the model

This is the clause teams most often skim. The licence should say plainly that models, weights and outputs trained on the data belong to you, and that you can keep using and selling the model after the licence ends and the data is deleted.

Watch for two traps: royalties on revenue from the model, and clauses requiring you to delete "derivatives" of the data, which could be read to include the model itself.

4. The data specification

Write down what "the dataset" means, in a schedule to the contract:

• modalities and body parts
• number of patients and number of studies (both matter: studies per patient changes what you can do)
• sites, countries, scanner makers and models
• date range
• population: age, sex and ethnicity where recorded
• what comes with each study: reports, labels, clinical data, follow-up
• format: DICOM at original resolution, or converted and compressed
• how cases were chosen: every consecutive patient, or enriched for a condition

5. An evaluation sample first

Ask for a small de-identified sample under a short evaluation agreement before you commit. It shows you image quality, report quality, how complete the headers are and whether de-identification was done properly. A supplier who won't share any sample, even under a confidentiality agreement, is telling you something.

6. De-identification evidence

Ask how the headers, burned-in pixel text and reports were de-identified, and for the documentation behind it, such as an Expert Determination report under HIPAA. Our guide to de-identifying medical images lists the questions.

7. Delivery, security and deletion

• How the data is delivered: secure transfer, cloud storage or remote access only.
• What security you must have in place.
• A ban on re-identifying patients or linking the data to other sources.
• Return or deletion at the end, with a certificate of deletion.
• Breach notification: who tells whom, and how fast.

8. Price

Common models are a price per study, per cohort, or a fixed fee for a defined dataset, sometimes with extra fees for labels or exclusivity. Prices tend to rise with rarity (rare conditions, specific populations), richness (reports, follow-up, outcomes) and restrictions (exclusivity, commercial use). Ask what's included: replacing corrupt files, answering questions about the data, refreshes with newer data.

Red flags

• Answers about rights that still have template brackets in them.
• No sample under any terms.
• A licence that says nothing about who owns the model.
• "Anonymised" with no method described.
• Dataset sizes that change from one call to the next.

We check these points with every data partner before we offer their data. If you're looking for imaging data for training or validation, see medical imaging datasets or tell us what you need.