Privacy Policy
This is an English translation for your convenience. The Czech version is legally binding.
1. Who processes the data
- 1.1The NexaCare service is operated by NEXACorteX s.r.o., Company ID (IČO): 24475483, registered office at Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 440386 (“we”).
- 1.2Contact: e-mail gdpr@nexacare.cz, or in writing to our registered office.
- 1.3Data protection officer: Mgr. Stanislav Kukal, e-mail stanislav.kukal@nexacare.cz.
- 1.4We provide this information under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”). Capitalised terms have the meaning given in the NexaCare Terms and Conditions.
2. When we are a controller and when a processor
| Our role | What it concerns | Where to find details |
|---|---|---|
| Controller | data about our customers, users of the Application, prospective customers and website visitors – account management, invoicing, support, security, business communication | this document, sections 3 to 7 and 9 to 12 |
| Processor | data of patients and other persons that the practice keeps in the Application (patient records, conversations, communication, documents) | the controller is the healthcare provider using the Application; see section 8 and the Data Processing Agreement (DPA) |
3. Purposes, legal bases and retention periods
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Providing the Application and managing accounts – registration, login, management of Practices and permissions, subscription | first name, surname, titles, e-mail, telephone, role and permissions, Practice membership, account settings, subscription details | performance of a contract (Article 6(1)(b) GDPR); for users who are not a party to the contract, legitimate interest in providing the service to the customer (Article 6(1)(f) GDPR) | for as long as the account exists; after it is closed, the data is irreversibly deleted (logs and backups under the “Security and operation” row expire within the periods stated there) |
| Invoicing and accounting | business name or name, Company ID, VAT ID, address, billing e-mail, payment details | compliance with a legal obligation (Article 6(1)(c) GDPR; Act No. 563/1991 Coll., on Accounting, and tax regulations) | accounting records 5 years, financial statements 10 years from the end of the accounting period (Section 31 of the Accounting Act); tax documents for the period required by tax regulations |
| Customer support | user identification, content of communication | performance of a contract (Article 6(1)(b) GDPR) and legitimate interest in handling the request (Article 6(1)(f) GDPR) | online chat 7 days; other requests for as long as necessary to handle them |
| Security and operation – protection against misuse, troubleshooting, traceability | user identifier, time and type of activity, login records; no audio content or transcript text | legitimate interest in the security of the service (Article 6(1)(f) GDPR); Article 32 GDPR | 90 days; error logs 30 days; backups 14 days. We process logs of access to patient data as a processor under the DPA. |
| Enquiries and contact via the website | name, e-mail, telephone, name of the facility, message text | steps prior to entering into a contract (Article 6(1)(b) GDPR) and legitimate interest in handling the enquiry and dealing with the prospective customer (Article 6(1)(f) GDPR) | 12 months from the last contact |
| Marketing communication and news – information about the Application and related services | name, e-mail | for customers, legitimate interest (Article 6(1)(f) GDPR; Section 7(3) of Act No. 480/2004 Coll.); for other persons, consent (Article 6(1)(a) GDPR; Section 7(2) of Act No. 480/2004 Coll.). You can unsubscribe at any time using the link in every message. | until you unsubscribe or withdraw consent; for customers no longer than until the end of the contractual relationship |
| Establishing and defending legal claims | data needed to prove the contractual relationship and its performance | legitimate interest in protecting our rights (Article 6(1)(f) GDPR) | for the limitation period (Section 629 et seq. of the Civil Code) and the duration of any proceedings |
Data for providing the Application and invoicing is necessary to conclude and perform the contract; without it the Application cannot be provided.
4. Where we obtain data from
- Directly from you – when you register, use the Application and communicate with us.
- From your employer or practice – if a Practice Administrator set up an account for you or invited you (name, e-mail, role).
- From the Application – technical logs generated when it is used.
5. Recipients
- Provider of cloud infrastructure and the sign-in service – operation of the Application, database and login verification (EU).
- Public authorities – where required by law.
- Legal and tax advisers – to the extent necessary to fulfil legal obligations and protect our claims; they are bound by confidentiality.
We do not sell data or pass it on to third parties for their marketing.
6. Place of processing
We process data exclusively in the European Union and do not transfer it to third countries outside the EU/EEA.
7. Security
- Encryption of data in transit and at rest.
- Passwords are stored only as an irreversible cryptographic hash.
- Two-factor authentication, remote sign-out and a limit on concurrent sessions.
- Separation of individual practices’ data at database level.
- Our staff access data only to the extent necessary; staff are bound by confidentiality.
Details are given in the overview Security and Data Retention in NexaCare.
8. Are you a patient?
- 8.1We process patient data that the practice keeps in the Application as a processor – only on the practice’s instructions and in accordance with the Data Processing Agreement (DPA). The controller is the healthcare provider treating you.
- 8.2Exercise your rights (e.g. access to data, rectification or erasure) with your practice. If we receive your request, we forward it to the practice without undue delay.
- 8.3The following applies to this data:
- it is processed exclusively in the EU,
- it is not used to train artificial intelligence models,
- the audio recording of a conversation is not stored on our servers; at the speech-to-text processor it is kept for no longer than 30 days in the transcription-after-completion mode,
- the retention period for transcripts is set by the practice (10 days by default).
9. Your rights
To the extent we are the controller, you have the right:
- of access to your data (Article 15 GDPR),
- to rectification of inaccurate data (Article 16 GDPR),
- to erasure (Article 17 GDPR),
- to restriction of processing (Article 18 GDPR),
- to portability of data processed on the basis of a contract or consent (Article 20 GDPR),
- to object to processing based on legitimate interest (Article 21 GDPR); to marketing communication at any time and without giving a reason,
- to withdraw consent – at any time, without affecting the lawfulness of processing before its withdrawal.
Send your request to the contact in clause 1.2. We will handle it without undue delay and within 1 month at the latest; in complex cases the period may be extended by a further 2 months, of which we will inform you (Article 12(3) GDPR).
10. Decisions without human involvement
No algorithm decides on anything that has a legal or similarly significant effect on you, and we do not profile you (Article 22 GDPR). Artificial intelligence in the Application only presents text suggestions; the user decides whether to use them.
11. Cookies
Information about cookies and local storage is given in the document Cookies and Local Storage in NexaCare.
12. Updates
We update this information when the Application or legislation changes. The current version is always available in the Application and on our website; we inform customers of material changes by e-mail or in the Application.