Data processing agreement (health data)
A provisional text
This text is provisional. No lawyer has reviewed it yet.
A final version, written by a lawyer, replaces it before the data of a first real patient is processed.
Subject
The practice entrusts Doctalis with its patients’ data, health data included, so that its members record, transcribe, draft and keep their records. The practice is responsible for this data. Doctalis processes it on its behalf.
An administrator accepts this agreement for the practice, and each new version of it.
Instructions
Doctalis processes the data only to provide the service, as the practice’s members direct it in the product. It uses the data for no purpose of its own.
The AI receives a patient’s identity only where the material itself holds it, such as a voice or a letter, never as a field Doctalis adds. The AI vendors never use the data they process to train a model, under their terms. Doctalis deletes a recording’s audio as soon as its transcript is written. The transcription’s vendor offers no way to delete a result on its side: how long it keeps one is confirmed in writing before the first patient.
Security
The data is stored in Switzerland, and its backups too. It travels encrypted; the host states it encrypts the file storage, and the encryption of the databases and the backups is confirmed in writing before the first patient. The AI processes it only in Switzerland or the European Union. A processing anywhere else is refused before it is made.
Every reading of a patient’s medical content is logged, with the reader’s name. The log is kept at least 10 years; each of its months is deleted once all of it is older. Until then, the application can neither change nor delete a reading; deleting a reader’s account only removes the link to that account, their name staying in the log. The practice’s journal keeps every change, validation and export.
Sub-processors
Doctalis names its sub-processors and where each one processes. It announces a new one 30 days before using it, in the product and by email to the administrators, with the date and what it will process.
A practice that objects may leave at the end of its paid period, with its data.
| Service | Company and seat | Where it processes | For | Since |
|---|---|---|---|---|
| Infomaniak | Infomaniak, Switzerland | Switzerland | Hosting: servers, database, files and backups | 31 October 2026 |
| Infomaniak AI Services | Infomaniak, Switzerland | Switzerland | Drafting, checking and summarising with a language model, which never learns from it and keeps it only while it processes it | 31 October 2026 |
| Infomaniak AI Services | Infomaniak, Switzerland | Switzerland | Transcribing recordings, never learning from them and keeping them only temporarily, while processing them | 31 October 2026 |
| Stripe | Stripe, LLC, United States | United States | Subscriptions and payments, without patients’ data | 31 October 2026 |
| ResendTo be confirmed | Plus Five Five, Inc., United States | United States | Account emails, without patients’ data | 31 October 2026 |
| GoogleTo be confirmed | Google, United States | United States | Signing in with a Google account | 31 October 2026 |
| CodAgents | CodHash Agency Ltd, United Kingdom | Germany | Booking a demo: the name, email and phone of whoever books it | 31 October 2026 |
| CodOps | CodHash Agency Ltd, United Kingdom | Germany | Deployment: the encrypted vault of the production secrets | 31 October 2026 |
Access by the Doctalis team
At a member’s request, or to find a fault, a member of the Doctalis team may open the practice’s space, read-only, under their own name, for a few hours at most.
Each opening, and each reading made through it, is kept in the platform’s journal. The members of the team are bound by the medical secrecy of the practices they serve.
Security breaches
Doctalis tells the practice’s administrators of any breach touching its data, in the product and by email.
The final version sets the time limits and the procedure.
End of the agreement
The practice takes out everything it holds, at any time. It closes once it has named who keeps its records.
After its trial or its subscription ends, the practice keeps reading and taking out its data, and Doctalis keeps its records meanwhile. After 90 days without a subscription, Doctalis closes the practice, its administrators told beforehand, and deletes its data 30 days later. Something deleted can no longer be restored from the backups after 30 days.