Acceptable Use Rules

This is an English translation for your convenience. The Czech version is legally binding.

1. Who the rules apply to

1.1These rules (the “Usage Rules”) form part of the Contract under the NexaCare Terms and Conditions (the “Terms”). They apply to the Customer and all its Users.
1.2Capitalised terms have the meaning given in the Terms. The Customer familiarises each User with the Usage Rules before their first login.

2.1The Application is used only in accordance with the law, the Contract and for its intended purpose – supporting the administration and documentation of a healthcare facility.
2.2Content that is unlawful, infringes the rights of third parties, contains malicious code or serves to harass or deceive recipients (e.g. bulk unsolicited messages) must not be entered into or sent through the Application.
2.3The Application is not a medical device and must not be used to make a diagnosis or determine treatment (Terms, clause 2.4).

3.1One person, one account. Login credentials are not shared or lent – not even to a colleague from the same practice. Everyone who uses the Application has their own account.
3.2A User with access to patient data uses two-factor authentication.
3.3A User does not leave a logged-in device unattended and logs out of shared or third-party devices.
3.4If login credentials are suspected to have been compromised, the User changes their password without delay and proceeds in accordance with Article 10.
3.5The Practice Administrator revokes or restricts, without undue delay, the access of persons who no longer work for the Customer or no longer need access.

4.1A User opens only the patient data they need for their work. Viewing out of curiosity or for personal purposes is prohibited. Every access to patient data is logged and visible to the Practice Administrator.
4.2The Practice Administrator sets permissions according to the principle of least privilege.
4.3Only data for which the Customer has a legal basis for processing is entered into the Application, and only to the extent needed for the given purpose.
4.4The duty of confidentiality of healthcare professionals also applies when working in the Application.
4.5A User displays patient data in such a way that unauthorised persons cannot see it (e.g. patients in the waiting room or participants in a shared screen).

5.1Before starting a recording, the User informs the patient that the conversation will be temporarily audio-recorded to create material for the medical records and allows them to refuse the recording.
5.2If the patient refuses the recording, the User does not start it and keeps the records in another way. A refusal must not affect the care provided.
5.3If the patient withdraws their permission during the conversation (Section 87 of the Civil Code), the User stops the recording and discards the recording and the transcript in progress.
5.4For minors and persons with limited legal capacity, the User also informs their legal representative or guardian.
5.5It is prohibited to record covertly, to record persons who are not aware of it and to record conversations unrelated to the provision of health services. The User ensures that the recording does not capture uninvolved persons.
5.6The Application does not record that the patient was informed. The Customer chooses a suitable way of evidencing this (e.g. a notice in the waiting room, a note in the medical records).
5.7The legal framework and the processing are described in the document Voice Recording and Transcription in NexaCare.

6.1Exporting data from the Application (e.g. transcripts, documentation, accounting records) is permitted only for the Customer’s needs – in particular into its information system, for archiving or for supervisory authorities.
6.2Exported data containing patient data is stored only in systems that the Customer manages and secures – not in private accounts, unapproved storage or unencrypted portable media – and is not passed on to unauthorised persons.
6.3The Customer is responsible for the security of exported data.

7.1Every AI Output (transcript, draft report, extracted data, suggested action) is verified before use by a person with appropriate qualifications (Terms, clause 7.3). Unverified AI Output is not included in the medical records and is not sent to a patient, authority or insurance company.
7.2It is prohibited to circumvent the restrictions of AI features, to feed them instructions intended to misuse them or to use them for a purpose other than the one for which they are intended in the Application.
7.3The Customer is responsible for the content of the final report and for professional decisions (Terms, clause 13.2); this does not affect the User’s responsibility towards the Customer.

8.1It is prohibited to circumvent or test the security, login verification or licensing restrictions of the Application.
8.2It is prohibited to attempt to access other people’s accounts, the data of other Practices or the infrastructure of the Application.
8.3It is prohibited to attack the Application, in particular to overload it, introduce malicious code into it or exploit vulnerabilities.
8.4It is prohibited to scrape the Application by automated means or to access it other than through a supported interface.
8.5It is prohibited to reverse engineer, decompile or otherwise obtain the source code of the Application, unless expressly permitted by law (Terms, clause 5.4).
8.6The Application is not used on a device infected with malicious software or with an outdated operating system or browser.
8.7Security testing is possible only with the Provider’s prior written consent. Anyone who discovers a vulnerability reports it to the Provider and neither exploits nor discloses it.

9.1The Provider responds in proportion to the seriousness of the breach:

Seriousness	Typical example	Provider’s response
Minor	an outdated device, repeatedly leaving a logged-in device unattended	a warning and a request to remedy
Serious	failure to remedy a minor breach after a request, storing exports in unapproved storage	restriction or suspension of the access of the User or the Practice (Terms, clause 14.4)
Breach under clause 9.2	see clause 9.2	suspension of access and withdrawal from the Contract, even with immediate effect where the nature of the breach so requires (Terms, clause 14.5)

9.2A breach whose nature usually justifies immediate termination of the Contract includes in particular unauthorised access to the data of patients or other Practices, an attack on the Application, sharing accounts and recording without the patient’s knowledge.
9.3If there is an imminent threat to the security of the Application or data, the Provider may suspend access even without prior notice; it informs the Customer without undue delay.
9.4The Provider may claim compensation for damage caused by a breach of the Usage Rules (Terms, clause 13.7). Where required by law, it reports the breach to the competent authorities.

10.1The Customer and Users report to the Provider without undue delay any suspected misuse of an account, loss or theft of a device with access to the Application, leak of login credentials or other security incident, by e-mail to gdpr@nexacare.cz.
10.2The Customer cooperates with the Provider until the incident is resolved. The sessions of affected Users can be invalidated remotely.
10.3The Customer’s obligations as a personal data controller towards the supervisory authority and patients (Articles 33 and 34 GDPR) are not affected.