VISU Terms of Service

By using VISU (the “Service”), a secure computing environment provided by the ICT Services of the University of Oulu (“UO”), you accept these Terms of Use and the information security practices described in the Privacy Notice.

The Service is provided and maintained by the University of Oulu.

Visiting address: Pentti Kaiteran katu 1, Linnanmaa
Postal address: P.O. Box 8000, FI-90014 University of Oulu, Finland
Telephone: +358 294 480 000
Email: ict@oulu.fi

The current user instructions, pricing information, privacy notice, and these Terms of Use for the VISU service are available on the University of Oulu ICT Services VISU website at ict.oulu.fi.

The Service is a secure processing environment referred to in Section 20 of the Finnish Act on the Secondary Use of Health and Social Data (552/2019) (“Secondary Use Act”) and complies with the requirements set by the Finnish Social and Health Data Permit Authority Findata (“Findata”) for secure operating environments (Regulation 1/2022).

Orders for the Service (the “User Environment”) and any modifications thereto shall be submitted using the order and change request forms designated by the University of Oulu ICT Services and completed in accordance with the provided instructions.

The forms shall be completed electronically and submitted through the service management system for processing by the administration team. The order form must specify the individuals for whom access to the requested User Environment is sought. Ordering the Service and obtaining access rights require a University of Oulu user account and an affiliation with the University of Oulu.

The ordering party (the “Customer”), which may be either an organization or a natural person, shall be identified in the order form. The individuals listed on the order form become customers of ICT Services. An agreement (the “Agreement”) concerning the delivery of the Service is formed between the Customer and ICT Services (the “Parties”) when the VISU administration has approved and confirmed the order.

No separate order confirmation is sent to customers. However, the administration may acknowledge receipt of the order and notify the customer that the User Environment deployment process has been initiated.

The VISU administration shall approve an order provided that all requirements for approval are met and that the information requested in the order or change request form has been correctly completed in accordance with the instructions and accompanied by any required attachments.

ICT Services reserves the right to reject an order if it determines that the form has been completed incompletely or incorrectly, or if no lawful basis exists for the requested Service. In such cases, the administration will return the form to the applicant and request that the missing information be provided.

Where the User Environment is associated with a data permit, only the contact person designated in that permit, or a comparable natural person acting as the permit holder, may order the Service.

If, during the validity period of the data permit, the original contact person is no longer reachable by ICT Services or the VISU administration, both the data permit arrangements and service authorization must be renewed, even if the new contact person is already listed among the authorized data processors specified in the permit.

For changes relating to the Service, the new contact person must provide ICT Services with an amendment decision to the data permit identifying the new contact person. If such documentation is unavailable, ICT Services may request written confirmation from the organization of the original contact person.

The Customer shall notify ICT Services without delay of any changes to the data permit that affect the data, users, or access rights associated with the Service.

The Customer shall provide ICT Services with all information reasonably necessary for delivering the Service and otherwise cooperate in the delivery process. The Customer is responsible for the accuracy and maintenance of all information and instructions provided to ICT Services.

If the Customer considers the software provided within the User Environment insufficient or unsuitable for its intended purpose, the User Environment may be customized. Customization shall always be performed by a system administrator.

If the required software is not available in the Service Provider’s software catalog, the Customer shall provide the installation media, and the administrator shall perform the installation. The Customer is solely responsible for ensuring the validity, compliance, and costs of any software licenses.

Use of the Service is subject to a fee.

The applicable charges and the party responsible for payment shall be agreed upon when acquiring the Service. Costs shall be allocated either to a cost center or to a project number.

The Customer may choose to pay for the User Environment through a one-time payment.

A recurring monthly fee begins, or a one-time fee becomes chargeable, when all of the following conditions are met:

Current prices are available on the VISU web pages maintained by ICT Services. Prices are stated in euros and invoiced in euros.

The Customer may terminate the order before the expiry date specified for the User Environment. In such cases, any already charged minimum billing period fee (the current month, if monthly billing has been agreed) or any remaining portion of a one-time payment shall not be refunded.

ICT Services reviews pricing periodically and reserves the right to change prices.

Price changes take effect automatically for existing orders at the beginning of the billing period following the current billing period.

ICT Services reserves the right to revoke user access rights if the Customer fails to pay invoices relating to the Service.

Users may not independently transfer data subject to the Secondary Use Act into or out of the User Environment. Instead, the Customer must submit a service request through the service management system to the system administrators.

An external authorized party delivers the secondary-use data ordered by the Customer to the administrators, who transfer it through quarantine environment verification procedures into the User Environment specified in the data permit. This process ensures secure handling of data and compliance with data permit requirements.

Within the quarantine environment, the administrator initiates automated extraction of data packages, malware scanning, and integrity verification.

If the data is found to be corrupted, the administrator shall notify the Customer and permanently destroy the defective data. Valid and verified data shall be transferred to the User Environment for the Customer’s use.

Following data transfer, the Customer is responsible for verifying that the transferred data is correct and appropriate. If the Customer suspects that the transferred data is incorrect or anomalous, the Customer must notify the administration without delay.

The administration reserves the right to refuse the transfer of data into a User Environment if it determines that there is no lawful basis for such transfer.

The Customer is responsible for ensuring that all users named in the order form have the right to process the project data.

Users are granted standard user-level access rights to the Service. Users are identified and authenticated using strong multi-factor authentication procedures. Users access their User Environments according to the login instructions provided for the Service.

No separate usernames or passwords are issued specifically for VISU login purposes.

Access rights within the Service follow the principle of least privilege. Administrative privileges, confidential information processed by ICT Services personnel or users, and all other information requiring restricted visibility or access are protected through access control mechanisms and system operating procedures consistent with this principle.

VISU system administrators are the only personnel authorized to access administrative and maintenance functions of the secure operating environment.

System administrators are not authorized to view data processed within User Environments. Access to User Environments is permitted only through privileged administrative accounts, in predefined maintenance situations, and only when necessary to ensure service availability, functionality, or information security.

Users must use the Service in accordance with these Terms of Use and all applicable user instructions.

Users may begin using their User Environment once the first billing period associated with the environment has commenced.

The Service operates through a remote connection in which only screen images, keyboard input, and mouse input are transmitted between the user’s endpoint device and the Service.

Users shall have access to user instructions provided by ICT Services.

Neither the Customer nor users may resell, redistribute, or otherwise provide the Service to third parties.

A user’s access rights and access to the User Environment are suspended upon expiry of the User Environment’s usage period or, at the latest, upon expiry of the applicable data permit.

Access to the User Environment may be temporarily locked if a user repeatedly fails authentication attempts.

Users are authenticated using strong multi-factor authentication (MFA). After successful authentication, users select and open the User Environment to which they have been granted access.

ICT Services may restrict or suspend a user’s access to a User Environment if the user violates these Terms of Use, causes disruption to the Service, or is deemed to pose a threat to the Service.

In such cases, removal of access rights may also be considered. The affected user and the Customer shall be informed of the action taken.

Outside the User Environment, users may utilize only anonymous results derived from the data.

Transfers of material out of the User Environment are always performed by ICT Services system administrators.

Customers cannot independently export data, and software installed within the User Environment does not permit users to transfer or transmit data outside the environment.

The Customer undertakes to anonymize result datasets and perform a risk assessment in accordance with Findata guidelines. The outcome of the risk assessment determines whether the material is transferred to Findata or directly to the researcher.

Where data is transferred to Findata, the result dataset is packaged within the User Environment and transferred through quarantine procedures to Findata, which will notify the Customer once the material becomes available.

Within a User Environment intended for sensitive data, users may independently transfer data into and out of the environment using an SFTP connection.

When a User Environment is closed, the service agreement between the University of Oulu and the Customer also terminates.

A User Environment is closed when its agreed usage period expires on the date specified in the order confirmation. If the User Environment is associated with a data permit, the environment shall be closed no later than the expiry date of the permit.

Closure of a User Environment and termination of the Service may also be requested by the Customer’s designated contact person before the end of the usage period. Such a request must be submitted through the service management system using the designated change request process.

ICT Services may retain a closed User Environment and its data for up to six months following the expiry of the relevant data permit, where necessary. After that period, the User Environment and its contents shall be permanently deleted in accordance with Findata requirements, unless otherwise required by law or by the data permit.

If a user requests access to the data during this six-month retention period, a new User Environment order must be submitted. ICT Services will verify that the user possesses a valid permit for processing the data before access is granted.

ICT Services reserves the right to close a User Environment if use contrary to these Terms of Use or other misuse is detected.

ICT Services collects and stores personal data as well as legally required technical and usage log data, as described in the Privacy Notice.

The Service is intended solely for the personal use of the authorized user. Users must not intentionally or unintentionally disclose authentication credentials to any other person, nor leave their endpoint device unattended and unlocked while logged into the Service. Users are responsible for ensuring the secure use and storage of all authentication methods and devices used to access the Service.

When processing data, users must ensure that confidential information is not disclosed to unauthorized parties. Even where data has been pseudonymized, it must remain confidential both during and after the use of the User Environment.

In particular, it is prohibited to attempt to circumvent security controls implemented within the Service in order to obtain non-aggregated data on the user’s local device or any storage medium located outside the User Environment.

ICT Services shall not be liable for damages resulting from technical failures, software defects, or inappropriate use of resources.

ICT Services reserves the right to modify the content, functionality, and availability of the Service at its sole discretion as necessary for service development or other justified reasons.

If a user identifies a security vulnerability, the user must immediately report it to ICT Services/the administration. Information regarding security vulnerabilities must not be disclosed to third parties. Any security weaknesses discovered during use of the Service must be reported to ICT Services.

In all circumstances, users shall comply with good scientific practice, the rules and guidelines of the University of Oulu, and applicable Finnish legislation.

ICT Services is responsible for ensuring that the Service conforms to the Agreement and that all responsibilities assigned to ICT Services are performed with due care and professional competence.

ICT Services shall promptly inform the Customer of any circumstance that may prevent the Service from being used in accordance with the Agreement.

The Customer ordering the User Environment is responsible for ensuring that all obligations assigned to it under the Agreement are fulfilled carefully and appropriately.

The Customer is responsible for obtaining and maintaining all necessary devices, network connections, software other than standard software provided with the Service, related licenses, and associated costs, as well as ensuring that such resources meet the requirements of the Service.

The administration reserves the right to refuse installation or use of software if it is considered harmful to information security or otherwise deemed inappropriate for the environment.

If ICT Services or the administration detects misuse, or has reasonable grounds to suspect misuse, it shall take immediate action to prevent damage or further damage from occurring.

Depending on the circumstances, such actions may include:

For the provision of the Service, ICT Services procures data centre services from Oulun DataCenter Oy as a subcontractor.

Data centre technologies and security-related software may be updated as part of planned maintenance activities.

If a maintenance outage is required, ICT Services/the administration shall inform customers in advance through official ICT Services communications.

ICT Services does not guarantee uninterrupted or error-free operation of the Service.

The Service is monitored and maintained regularly to prevent operational disruptions. The Service Provider reserves the right to interrupt the Service for modifications, upgrades, maintenance, installation work, or similar service-related reasons, or where required by legislation or instructions from competent authorities.

However, users will be informed of planned service interruptions as early as reasonably possible.

ICT Services reserves the right to amend these Terms of Use for justified reasons.

Changes shall be announced on the ICT Services website and communicated separately to Service users.

Separate notification is not required where the amendment is minor or purely technical in nature.

ICT Services shall not be liable for delays or damage caused by circumstances beyond its reasonable control that could not reasonably have been foreseen and whose effects could not reasonably have been avoided or overcome.

Force majeure events include, unless proven otherwise:

A strike, lockout, boycott, or similar industrial action shall be considered a force majeure event even where ICT Services is itself affected by or involved in such action.

Force majeure shall also include decisions or orders by public authorities, changes in legislation preventing ICT Services from fulfilling its contractual obligations, large-scale disruptions to internet infrastructure, global cybersecurity incidents, or other comparable events beyond the control of ICT Services.

A force majeure event affecting a subcontractor of ICT Services shall likewise be considered a force majeure event affecting ICT Services.

However, a subcontractor’s lack of resources or financial difficulties shall not constitute force majeure unless such difficulties result directly from a force majeure event described above.

A party affected by a force majeure event shall notify the other party without undue delay after becoming aware of the event and its effects.

Once the force majeure event ceases, contractual obligations shall resume without unnecessary delay, and the affected party shall take reasonable measures to mitigate the consequences of the event.

This Agreement shall be governed by and construed in accordance with the laws of Finland, excluding its rules on conflict of laws.

Any disputes arising from or relating to this Agreement shall primarily be resolved through negotiations between the Parties.

Any dispute that cannot be resolved through negotiation shall be submitted to the District Court of Oulu.

If the Parties separately agree, the dispute may instead be resolved through arbitration.

Arbitration proceedings shall be conducted in accordance with the arbitration rules of the Finland Chamber of Commerce. The seat of arbitration shall be Oulu, Finland, and the proceedings shall be conducted in the Finnish language, unless otherwise agreed by the Parties.