Data processing agreement

1. Roles

The Customer is the controller of the personal data it records and keeps in ClinoVoice. CSSL Ltd, trading as ClinoVoice (ICO registration ZB417718), is its processor.

For anything under this agreement, contact show our email address.

2. What is processed

• Subject matter: recordings of consultations and meetings, and the documents drafted from them.
• Duration: the life of the Customer's account, and the export and deletion periods in section 8.
• Nature and purpose: transcription of the recordings, extraction of the clinical facts they contain, and drafting of letters and records for the Customer's clinicians to review, correct and approve.
• Categories of data subject: patients, clinicians, other staff, and anyone present at a recorded meeting.
• Categories of personal data: identity and contact details, and health data, which is special category data.

3. Our obligations

We will:

• process the personal data only on the Customer's documented instructions, which are the service as the Customer configures and uses it, unless the law requires otherwise, in which case we will tell the Customer first unless the law forbids it;
• make sure everyone we allow to process the data is bound to keep it confidential;
• keep the security measures in section 4;
• use sub-processors only as section 6 describes, under written terms that protect the data as this agreement does;
• help the Customer answer requests from people exercising their data protection rights;
• help the Customer with its own security, breach notification, data protection impact assessments and consultation with the Information Commissioner, as far as the information we hold allows;
• at the end of the service, make the data available for export and then delete it, as section 8 describes;
• give the Customer the information it needs to show that these obligations are met, on request.

4. Security measures

• Data is encrypted in transit with TLS: between the browser and the app, and between the app and its database, its audio storage and AssemblyAI.
• Data is encrypted at rest: audio by Amazon S3 with S3-managed keys, and the database by Neon's storage encryption.
• Each organisation's data is separated in the database by row-level security, so a request made for one organisation cannot read another's.
• Passwords are stored only as hashes. Every user signs in with a password and a code from an authenticator app.
• Audio is reached only through signed links that expire within minutes.
• Request logs carry organisation and user ids, the page requested and the response status. They never carry clinical content.
• Audio is deleted according to the Customer's retention setting.
• Data at rest is held in London. Processing takes place in the EU.

5. Personal data breach

If we become aware of a personal data breach affecting the Customer's data, we will tell the Customer without undue delay, and in any case within 48 hours, with what we know at the time, and keep it informed as we learn more.

6. Sub-processors

The Customer authorises us to use the sub-processors below. We will give 30 days' notice of a new sub-processor by email to the Customer's organisation owner, and the Customer may object within that time. If we cannot meet an objection, the Customer may end the service under the Terms.

AssemblyAI states that requests to its EU language-model gateway stay within the European Union. The language-model providers behind that gateway are AssemblyAI's own sub-processors, listed at assemblyai.com/legal/subprocessors.

7. International transfers

Recordings, transcripts, extracted facts and drafted documents are stored in London and processed in the EU, which the UK's adequacy regulations cover. The only part of ClinoVoice outside the UK and EU is this website's contact form, hosted by Netlify in the United States, which carries no clinical data.

Render and AssemblyAI are companies based in the United States. Their data processing agreements cover any transfer of the data from the UK to them under the UK Extension to the EU-US Data Privacy Framework. SMTP2GO is a company based in New Zealand, which the UK's adequacy regulations also cover.

8. Deletion and return

When the Customer's account ends, its data stays available for export for 30 days. We then delete it from the database and from audio storage within a further 30 days. Backup copies held by our database and storage providers expire within 7 days after that.