Avara Viewer – Instructions for Use

READ ALL INSTRUCTIONS BEFORE USE. These Instructions for Use (IFU) describe the indications for use, warnings, precautions, and limitations of the Avara Viewer medical device software.

1. Device Identification

2. Indications for Use

Avara Viewer is a software only Medical Image Management and Processing System intended to display, process, read, report, communicate, distribute, store, and archive medical data which is available as DICOM data, including mammographic images. It supports the physician in diagnosis.

For primary image diagnosis in Mammography, only uncompressed or non-lossy compressed images must be used.

Typical users of this system are trained professionals, including but not limited to physicians, radiologists, nurses, medical technicians, and assistants.

Note: Web-based image distribution and mobile device display of mammographic images are not intended for diagnostic purposes. Mobile device display is not intended for diagnostic purposes.

3. Getting Started

This section provides a high-level overview of the Avara Viewer workflow. Complete step-by-step operational instructions are maintained at https://docs.avarasoftware.com/viewer/overview.

Accessing the Viewer

Users access the Avara Viewer either through the Avara platform (authenticated via email and password) or through a third-party SDK integrator's deep link (no Avara credentials required; access is scoped by the integrator). Upon successful authentication, the viewer loads and the user is presented with the diagnostic workspace. Platform users login at https://www.avarasoftware.com/auth.

Loading a Study

Studies are loaded automatically when the viewer opens. DICOM data is fetched from cloud object storage in the background and rendered in the diagnostic viewports as series become available. Loading progress is indicated in the sidebar. Failed series are flagged with a notification.

Diagnostic Display

The diagnostic workspace consists of a configurable viewport grid, a series sidebar, and a toolbar. Users navigate through slices using the mouse wheel, arrow keys, or trackpad. Window/level is adjusted by click-drag with the configured mouse button. Pan, zoom, and rotation are configurable via toolbar or mouse bindings. Multiple series may be displayed simultaneously across viewports and monitors.

Measurements and Annotations

Measurement and annotation tools are selected from the toolbar. Each tool is placed via mouse interaction (left or right click) in the viewport. Annotations and measurements are saved automatically in real time; a warning is displayed if a save operation fails. Annotations may be edited (move, resize, modify) or deleted via the viewport context menu or selection controls. Measurement tools are disabled in 3D rendering viewports per W-06.

Advanced Rendering

Multiplanar reconstruction (MPR), 3D volume rendering, maximum intensity projection (MIP), and PET/CT fusion are accessible from the toolbar. These operations require valid spatial metadata per W-07 and co-registeration via sharing a Frame of Reference UID.

Saving, Exiting, and Session Management

All annotations and measurements are saved automatically. There is no manual save action. The user exits the viewer by closing the browser tab or navigating away. Sessions expire after 60 minutes of inactivity per P-04. Tokenized access sessions expire after 60 minutes with no refresh.

Export and Secondary Capture

Studies and series may be exported as a ZIP archive of DICOM files via the toolbar download action. The current viewport state (including annotations) may be saved as a Secondary Capture DICOM object via the viewport context menu.

4. Contraindications

The Avara Viewer is contraindicated for the following uses:

Primary diagnosis using lossy or compressed images

The Avara Viewer must not be used for primary diagnostic interpretation of images that have been subjected to lossy compression. This restriction applies to all modalities. For mammographic primary diagnosis, only uncompressed or losslessly compressed images must be used per the cleared indications for use.

Diagnostic interpretation on mobile devices

The Avara Viewer must not be used for primary diagnostic interpretation on mobile devices. Clinical measurement and annotation tools are disabled on mobile viewports. This restriction applies to all modalities including mammography.

Web-based distribution of mammographic images for diagnostic purposes

Mammographic images distributed via web-based systems must not be used for primary diagnostic purposes.

Intraoperative guidance

The Avara Viewer is not validated or indicated for intraoperative imaging guidance or real-time procedural support.

Radiation therapy planning

The Avara Viewer is not validated or indicated for radiation therapy planning workflows.

5. Warnings

Read all warnings before use. Failure to observe these warnings may result in missed or incorrect diagnosis.

W-01: Lossy Compression

A warning indicator is displayed on the viewport and series thumbnail when a series is identified as potentially lossy compressed. Users must not perform primary diagnostic interpretation on series displaying this warning. The interpreting provider is responsible for verifying the compression status of imaging data before clinical use.

W-02: Pixel Spacing Reliability (Plain Film)

Pixel spacing metadata on computed radiography and digital radiography series may be absent or unreliable depending on the acquisition system. When pixel spacing is absent or invalid, measurements are displayed in pixel units with a visual indicator. The calibration tool is available to manually specify the correct pixel spacing when it is known. Users should verify pixel spacing accuracy before relying on measurements from plain film series for clinical decisions.

W-03: Tabular VOI LUT

When a series is encoded with a tabular VOI LUT (DICOM tag 0028,3010), the Avara Viewer applies analytic windowing (WC/WW) rather than the tabular transform. A persistent notification is displayed in the affected viewport. Users should manually adjust the window/level if the default display does not reflect the intended rendering.

W-04: Patient Identity Verification

Patient name, patient ID, and study date are displayed persistently in each viewport and in the sidebar. Users must verify patient identity and study date before beginning diagnostic interpretation to ensure the correct study is being reviewed.

W-05: Study Completeness

The Avara Viewer displays the study as received at the time it was opened. If updated or additional imaging data has been sent to the PACS or storage system after the study was opened, the user must reload the study to ensure all available series are present before completing interpretation.

W-06: Measurement Tools Restricted to 2D Views

Measurement and annotation tools are available in 2D slice viewports only. Measurement placement is disabled in the 3D volume rendering viewport. All quantitative measurements must be performed on 2D views anchored to calibrated pixel data.

W-07: MPR and 3D Require Valid Spatial Metadata

Multiplanar reconstruction and 3D rendering require valid Image Position Patient (0020,0032) and Image Orientation Patient (0020,0037) DICOM tags. If these tags are absent or invalid, MPR and 3D reconstruction are blocked and a notification is displayed. Users should use 2D axial viewing for series that do not support reconstruction.

W-08: Mammography Hanging Protocol

The built-in mammography hanging protocol assigns series to viewports based on laterality and view metadata. Color-coded viewport tags display laterality (L/R) and view (CC/MLO) for each assigned series. Users must verify the laterality and view assignments before beginning mammographic interpretation. If a series is assigned to an incorrect viewport, it can be manually reassigned via drag-and-drop.

W-09: Multi-Patient Study Sessions

When multiple studies from different patients are loaded simultaneously, the patient name and study date for each series are displayed in each viewport. Users must verify patient identity per viewport when reviewing multi-patient sessions to prevent attribution errors.

6. Precautions

P-01: Display Hardware

For primary diagnostic use, Avara recommends a medical-grade display meeting the following minimum specifications: luminance ≥ 350 cd/m², resolution ≥ 5 megapixels, and GSDF (Grayscale Standard Display Function) calibration. Compliance with display hardware requirements is the responsibility of the deploying institution. Use of consumer-grade or uncalibrated displays for primary diagnosis may result in suboptimal image quality.

P-02: Network Connectivity

The Avara Viewer retrieves DICOM data over HTTPS from cloud object storage. A stable network connection is required for study loading. In the event of a network failure during study loading, the viewer displays an error notification for affected series. Users should verify that all expected series have loaded successfully before beginning interpretation.

P-03: Annotation Persistence

Annotations and measurements are saved automatically in real time when a network connection is available. A warning is displayed if a save operation fails due to network interruption. Users should verify that annotations have been saved before closing the viewer, particularly in environments with unreliable network connectivity.

P-04: Session Timeout

User sessions expire after 60 minutes of inactivity and the user is automatically logged out. Tokenized/temporary access sessions expire after 60 minutes with no refresh. Users should save and close their session before the timeout in environments where unattended sessions are a concern.

7. Minimum System Requirements

Mandatory

Optional

8. Known Limitations

• Tabular VOI LUT: When a series contains a tabular VOI LUT, the Avara Viewer renders using analytic windowing rather than applying the tabular transform. A persistent viewport notification is displayed. Users may manually adjust window/level as needed.
• Lossy transfer syntaxes: Series encoded with lossy transfer syntaxes are accepted for display with a per-viewport and per-thumbnail warning indicator. Primary diagnosis must not be performed on lossy series per the IFU restriction.
• Curved MPR: Curved multiplanar reconstruction is not available in this version. Standard planar MPR (axial, coronal, sagittal) is fully supported.
• Digital subtraction angiography: DSA image processing is not available. Fluoroscopy and X-ray angiography series are supported for standard diagnostic display without DSA processing.
• Vendor-specific CAD objects: Proprietary vendor-specific CAD output objects are not rendered. CAD marks encoded as standard DICOM pixel overlays or burned into secondary capture pixel data are displayed normally.

9. User Population

The Avara Viewer is intended for use by trained clinical professionals operating in acute care, ambulatory care, teleradiology, and other clinical settings. Typical users include board-certified radiologists, physicians, nurses, medical technicians, and clinical assistants who are familiar with PACS-based diagnostic imaging workflows. Users are expected to have received training in the use of the Avara Viewer prior to clinical use. User training materials are accessible at https://docs.avarasoftware.com/viewer/overview.

10. Technical Support

To report a serious injury or malfunction related to this device, contact Avara Software LLC and, where applicable, submit a MedWatch report to FDA at fda.gov/medwatch.

11. Cybersecurity Information

11.1 Cybersecurity Overview

The Avara Viewer is a zero-footprint, browser-hosted Software as a Medical Device with no local installation, no persistent on-device storage of DICOM data, and no patient-facing hardware interface. Its cybersecurity posture is built on the following design principles: all data in transit is encrypted via TLS 1.2 or higher; all data at rest in Avara-managed infrastructure is encrypted using AES-256 or equivalent standards; session authentication is enforced through JWT tokens bound to server-side session records; DICOM pixel data is fetched directly from object storage to the browser without server-side proxying and is never written to disk; and HIPAA-compliant audit logging captures all authenticated API and user requests. Defense-in-depth is applied at both the application layer (authentication, authorization, input validation, rate limiting) and the infrastructure layer (managed identity, DDoS protection, append-only telemetry).

11.2 Recommended Use Environment Controls

Secure operation of the Avara Viewer requires that the deploying institution maintain the following controls on the clinical workstation and network environment. These controls are the responsibility of the deploying institution and are outside the device boundary.

Workstation Security Policy:

• Endpoint protection (anti-virus / anti-malware) installed, active, and current per institutional policy.
• Host firewall enabled per institutional policy.
• Operating system patching current per institutional policy.
• Browser (Chromium, Firefox, or WebKit) kept current per institutional update policy.
• Workstation screen lock policy enforced; physical workstation security per institutional policy.

Network:

• TLS 1.2 or higher internet connectivity to Avara platform domains and the institution's or integrator's DICOM object storage.
• Network access restrictions consistent with institutional network security policy. The Avara Viewer does not require inbound network connections; only outbound HTTPS (TCP 443) is used.

Identity and access:

• Multi-factor authentication (MFA) is strongly recommended for all emails associated with Avara platform accounts.
• Account provisioning and deprovisioning must follow institutional onboarding and offboarding policy. Organization administrators can revoke user access immediately through the Avara dashboard.
• API keys issued to SDK integrators must be stored as server-side secrets and rotated per the integrator's security policy. API keys must never be embedded in client-side code or shared.

SDK integrator-specific controls:

• Integrator object storage must be configured to permit CORS requests from Avara Viewer origins (https://*.avarasoftware.com). Misconfigured storage will cause DICOM fetch failures.
• Authentication of end users accessing the viewer via SDK integration is the integrator's responsibility and is covered under the executed Business Associate Agreement.

11.3 User and Institutional Responsibilities

The following responsibilities are owned by the user and the deploying institution and are not enforced by the device:

• Maintain workstation security posture per Section 11.2.
• Lock the workstation when unattended. The Avara Viewer applies a 60-minute inactivity timeout per P-04, but this is a complementary control and does not replace workstation-level screen lock policy.
• Verify patient identity per W-04 and W-09 before beginning diagnostic interpretation.
• Operate the device only on workstations meeting the minimum system and display hardware requirements (Section 7 and P-01).
• Report suspected security incidents, credential compromise, or anomalous device behavior to Avara Software LLC immediately at support@avarasoftware.com.
• Comply with the executed Business Associate Agreement between the deploying organization and Avara Software LLC.

11.4 Network Interfaces and Ports

The Avara Viewer communicates exclusively over HTTPS (TCP port 443). No other network ports are used or exposed by the device. The device does not accept inbound network connections. All outbound connections are initiated by the browser to Avara platform servers and to DICOM object storage via presigned HTTPS URLs.

11.5 Software Updates and Vulnerability Communications

The Avara Viewer is a zero-footprint, browser-hosted application. No software installation is required and no user action is required to receive updates. When Avara deploys an updated version, users automatically receive the current version upon the next browser page load or session start. The current software version is displayed within the application interface at all times.

Routine security patches are deployed automatically through this mechanism without individual user notification. Users automatically receive the patched version on the next page load with no version fragmentation across the installed base.

Significant security vulnerabilities – including any vulnerability appearing in the CISA Known Exploited Vulnerabilities Catalog, any vulnerability with confirmed exploitation in the wild, and any vulnerability with direct PHI exposure risk – are communicated to affected customers via:

• Direct email notification to the primary organizational contact from support@avarasoftware.com
• Security advisories posted to avarasoftware.com
• Communication within the Avara platform dashboard where applicable

The deploying institution should ensure that the primary organizational contact is subscribed to communications from support@avarasoftware.com.

11.6 Anomalous Condition Response and Security Event Logging

The Avara Viewer detects and responds to the following anomalous conditions: failed DICOM data fetch (network error, timeout, expired or invalid presigned URL), DICOM parse failure, WebGL2 context failure, and annotation save failure. Each condition triggers a user-visible notification in the viewer interface describing the error type and affected series or operation. All authenticated user sessions and API requests are captured in Avara's append-only audit telemetry pipeline. Security events including authentication failures, session expirations, and anomalous access patterns are detectable via the Avara Analytics dashboard accessible to organization administrators. Users who detect unusual behavior or suspect unauthorized access should contact Avara immediately at support@avarasoftware.com.

11.7 End of Support

Avara Software LLC is committed to providing security patches and software updates for the Avara Viewer for the supported lifetime of the device. End-of-support dates for the Avara Viewer and its software components are communicated to customers via avarasoftware.com and support@avarasoftware.com with advance notice prior to any reduction in support. If end of support is reached, Avara will communicate the cybersecurity risks to end users and provide guidance on transition options. Users should ensure their organization is subscribed to communications from support@avarasoftware.com to receive end-of-support notifications.

11.8 Decommissioning and Data Sanitization

The Avara Viewer does not write DICOM imaging data to the local workstation disk at any point during operation. All DICOM pixel data and DICOM headers exist only in browser memory during the active session and are automatically cleared when the browser tab is closed or the React component is unmounted. No decommissioning procedure is required for the clinical workstation with respect to DICOM imaging data handled by this device. Annotation data stored on Avara servers is subject to the data retention and deletion terms of the executed Business Associate Agreement between the deploying organization and Avara Software LLC.

11.9 Software Bill of Materials

A Software Bill of Materials for the Avara Viewer and its supporting platform infrastructure is maintained and updated at each release. The SBOM is available to authorized customers upon request to support@avarasoftware.com.

Software Version: 1.0.0
Last Updated: June 2, 2026