## 3 Defining the Use Cases: The Gaia-X-Med Project
### The Six Use Cases  
Each of the six medical use cases of Gaia-X-Med focused on one application, thus they covered a broad spectrum of the eHealth domain. Some of the applications are intended for commercial use, some for research use, some are mainly developed by companies, some mainly by researchers, some of them are customer-facing, some target medical professionals, some represent business-to-business (B2B) cooperation between companies and hospitals, and some service official national institutions to fulfill their monitoring duties. They all incorporate various data sources with differing levels of associated privacy regulations, from non-personal temperature sensor data to the personal, biometric data of individual patients. Therefore, several different data protection measures come into play, ranging from custom concepts regarding broad consent ([[https://www.medizininformatik-initiative.de/en/template-text-patient-consent-forms](https://www.medizininformatik-initiative.de/en/template-text-patient-consent-forms)]([https://www.medizininformatik-initiative.de/en/template-text-patient-consent-forms](https://www.medizininformatik-initiative.de/en/template-text-patient-consent-forms)) (accessed on 5 December 2024)) for research use to individual patient consent. Generally speaking, if the personal data of individual persons are involved, they are entitled to a certain set of rights due to the GDPR and related regulations. To give a short overview, personal data here in particular refer to sets of data which can be associated with an individual, both general, such as name, age, nationality, height, weight, etc, but also biometric, such as fingerprints or images of the face or eyes. Even some medical images like from radiology can be considered biometric, and are thus personal and subject to the GDPR. The rights it affords to individuals include the right to delete no longer critical personal data, to forbid the transfer to third parties, to request the complete delivery of all data, and more. In practice, this requires individual patients to give explicit consent to the transfer of any of their personal data for any reason. To address this, our use cases employ custom data protection agreements, explicit patient consent forms or broad consent, covering the most common approaches to this requirement. In the following, we briefly present each use case in detail (see also Figure 1):  
1. Case 1 (in red in the figure)--AI-based process optimization for radiology. The exchange of radiologic images has been standardized in DICOM ([[https://www.dicomstandard.org/](https://www.dicomstandard.org/)]([https://www.dicomstandard.org/](https://www.dicomstandard.org/)) (accessed on 5 December 2024)) and represents a opportunity for collaboration between hospitals and companies to improve diagnosis, possibly enhanced by AI. DICOM data consist of CRT, MRI, or x-ray images, alongside information about the patient like name, date of birth, and identification number; about the image, such as resolution; and about the imaging device, like calibrations. The seamless exchange of these data technically and organizationally, however, remains challenging, thus a device accessing the CT/MRT device producing radiological data was developed to ease this process. This commercial B2B application for hospitals hasto respect strict regulations due to its commercial use of personal, and even biometric data, of individual patients and thus involves a custom data protection concept, possibly including ethical approval and patient consent forms, as well as medical device development regulation. Use Case 2 (blue)--Integration of patient data for individual ablation therapy. Ablation therapy is a suggested treatment for certain heart diseases, but its effectiveness varies based on many parameters. To improve its efficacy, three-dimensional cardiologic images of treated patients are collected and a model is trained to predict expected outcomes for patients with similar characteristics.