Privacy policy
A provisional text
This text is provisional. No lawyer has reviewed it yet.
A final version, written by a lawyer, replaces it before the data of a first real patient is processed.
Who is responsible
Doctalis is responsible for the data of the people who use it: their account, their use and their subscription.
A practice is responsible for its patients’ data. Doctalis processes that data for it, under the processing agreement.
The data collected
Your title, first and last name and email, and, for a practitioner, the specialty. The practice’s name, canton and size, and a phone number. Your acceptance of each legal text, with its version, language and time. Whoever books a demo gives their name, email and phone. The time of your last activity, rounded to 5 minutes, and the time of each sign-in. The IP address and the browser (user agent) of each open session. Your account’s security events (a sign-in, a failed or refused attempt, a sign-out, an email change, the account’s deletion), with the IP address they came from. When you read a patient’s medical content, your name, what you read and when, in the practice’s read log.
Payment is made on the pages of a payment service.
Why it is used
To sign you in, run your account and your practice, bill the subscription, send by email what concerns your account, answer your messages, and find and fix faults.
Who receives it
Your name and email reach the services that send email, take payment and sign in with Google. The calendar in which a demo is booked receives the name, email and phone of whoever books one.
Each of these services is in the list below, with its seat and where it processes the data.
| Service | Company and seat | Where it processes | For | Since |
|---|---|---|---|---|
| Infomaniak | Infomaniak, Switzerland | Switzerland | Hosting: servers, database, files and backups | 31 October 2026 |
| Infomaniak AI Services | Infomaniak, Switzerland | Switzerland | Drafting, checking and summarising with a language model, which never learns from it and keeps it only while it processes it | 31 October 2026 |
| Infomaniak AI Services | Infomaniak, Switzerland | Switzerland | Transcribing recordings, never learning from them and keeping them only temporarily, while processing them | 31 October 2026 |
| Stripe | Stripe, LLC, United States | United States | Subscriptions and payments, without patients’ data | 31 October 2026 |
| ResendTo be confirmed | Plus Five Five, Inc., United States | United States | Account emails, without patients’ data | 31 October 2026 |
| GoogleTo be confirmed | Google, United States | United States | Signing in with a Google account | 31 October 2026 |
| CodAgents | CodHash Agency Ltd, United Kingdom | Germany | Booking a demo: the name, email and phone of whoever books it | 31 October 2026 |
| CodOps | CodHash Agency Ltd, United Kingdom | Germany | Deployment: the encrypted vault of the production secrets | 31 October 2026 |
How long it is kept
Your account data is kept as long as your account. A notification shown in the product is kept 90 days. The practice’s journal keeps an entry 10 years, or as long as the record of the patient it concerns. Something deleted can no longer be restored from the backups after 30 days. The time of your last activity is kept as long as your account, the time of each sign-in 2 days. A session’s IP address and browser are kept until it ends, 30 days at most after the sign-in, then deleted within the following day. The read log keeps your name 10 years, even after your account is deleted. Security events are kept in the technical logs for a period the final version sets.
The final version sets the remaining periods.
Your rights
Under Swiss data protection law, you may ask what data Doctalis holds about you, have it corrected or deleted, and receive a copy. Write to the Doctalis team through the help in the product.
A patient addresses their practice, which answers their requests.