Security and Data Retention
This is an English translation for your convenience. The Czech version is legally binding.
This overview summarises how NexaCare protects data, where it processes it and how long it keeps it. Binding terms are set out in the NexaCare Terms and Conditions, the Data Processing Agreement (DPA) and the NexaCare Acceptable Use Rules; capitalised terms have the meaning given in the Terms and Conditions.
1. NexaCare in numbers
| Place of processing | exclusively the EU – the application, data, speech-to-text and the language model |
|---|---|
| Audio on NEXACorteX servers | not stored – only a temporary file while it is converted to text |
| Training AI on practices’ data | no |
| Transcripts and draft reports | 10 days by default, set by the practice |
| Incident notification to the practice | within 24 hours |
| Database backups | 14 days |
| Data export after the contract ends | 30 days, then irreversible deletion |
2. How long we keep data
| Type of data | Purpose | Retention period | Deletion |
|---|---|---|---|
| Audio backup in the browser | recovering a recording after a crash or closed window | until successfully uploaded; unfinished recordings no longer than 24 hours | automatically; the user can delete it immediately |
| Audio on NEXACorteX servers | speech-to-text conversion | not stored – only a temporary file during conversion | automatically immediately after conversion, even if it fails |
| Audio and transcript at the speech-to-text processor – real-time transcription | speech-to-text conversion | not stored | — |
| Audio and transcript at the speech-to-text processor – transcription after completion | speech-to-text conversion | no longer than 30 days | automatically |
| Language model and OCR inputs and outputs | draft report, extraction, text recognition | not stored (zero retention) | — |
| Transcripts and draft reports | working with the conversation | according to the setting in the Application (set by the practice); 10 days by default | automatically or manually by the user |
| “My style” rules | adapting drafts to the user’s style | for as long as the user account exists | when the account is closed |
| Other practice content (patient records, communication, documents, receipts, tasks, attendance) | providing the Application | for the term of the contract | manually by the user; after the contract ends see below |
| Practice data after the contract ends | export | 30 days | irreversibly afterwards |
| User account | login and management | for as long as the account exists | irreversibly when the account is closed |
| Audit and access logs | security, traceability | 90 days; error logs 30 days | automatically by a daily job |
| Database backups | disaster recovery | 14 days | by automatic overwriting |
| Support online chat | handling requests | 7 days | after the period expires |
| Other support requests | handling requests | for as long as necessary to handle them | once handled |
| Website contact form | handling the enquiry | 12 months from the last contact | after the period expires |
| Marketing communication | news and offers | until you unsubscribe; for customers no longer than until the contract ends | after unsubscribing |
| Billing and accounting data | accounting and taxes | accounting records 5 years, financial statements 10 years; tax documents according to tax regulations | after the statutory period expires |
| Data proving the contractual relationship | establishing and defending legal claims | for the limitation period and any proceedings | after the period expires |
3. Patient data and roles
| Data | Role of NEXACorteX | Governed by |
|---|---|---|
| Data of patients, practice employees, correspondence, documents and other content that the practice keeps in the Application | processor – the controller is the healthcare provider (the Customer) | DPA |
| User accounts, invoicing, support, security logs, website and business communication | controller | Privacy Policy |
- We process patient data only on the practice’s instructions and only to provide the Application.
- The legal basis is determined by the practice as controller; usually it will be the obligation to keep medical records and the provision of health care (Article 6(1)(c) and Article 9(2)(h) GDPR) – not the patient’s consent.
- Patients’ requests are handled by the practice; we help it. In the Application it can correct and delete patient data, export transcripts and documentation, and see an overview of access to patient data.
4. Audio and artificial intelligence
| Step | What happens |
|---|---|
| Recording | Always started and stopped by the user. The practice informs the patient in advance; the patient may refuse the recording. |
| Speech-to-text conversion | A processor in the EU certified to ISO/IEC 27001:2022 with a SOC 2 Type 2 attestation report. It receives the audio in its original form. |
| Draft report, OCR, extraction | A processor’s language model in the EU in zero data retention mode – neither inputs nor outputs are stored. |
| Review | Uncertain places are marked “Data to review”; the report cannot be sent until the user resolves them. |
| Saving | To the records or the outpatient system only after the user’s express confirmation. |
Details are given in the document Voice Recording and Transcription in NexaCare.
5. Where we process data
| Activity | Place of processing |
|---|---|
| Cloud infrastructure and sign-in – application, database, documents, backups | EU (application, database and documents in the Netherlands) |
| Speech-to-text conversion | EU |
| Language processing and text recognition from documents | EU |
We do not transfer data to third countries outside the EU/EEA. Processors are bound by a contract under Article 28 GDPR. We disclose the specific companies to the practice upon an e-mail request and treat them as confidential; we announce a change of processor 30 days in advance (DPA, Article 8).
6. Security
Encryption
- Data is encrypted in transit and at rest.
- Access credentials for the data box, e-mail and insurance company portals are encrypted with a key stored outside the database.
- Passwords are stored only as an irreversible cryptographic hash.
- The private key for electronic signatures never leaves the user’s device.
Access control
- Separation of practices’ data at database level; the Application verifies at startup that the rule applies.
- Roles and permissions down to the level of modules and individual e-mail inboxes.
- Two-factor authentication, remote sign-out and a limit on concurrent sessions.
- Our staff access content only to the extent necessary or at the practice’s request.
Logging and traceability
- Every access to patient data is logged; the Practice Administrator can see who looked at which patient and when.
- Audit logs are cryptographically chained – any subsequent alteration of history is detectable.
- Reading data across practices is reserved for automated jobs (e.g. cleanup of old transcripts, e-mail processing) and administrative tools; each read is logged with the reason stated.
7. Security incidents
- We notify the practice of a breach of security of its data without undue delay, within 24 hours at the latest.
- We provide information and assistance for assessing the risk, for any notification to the Czech Office for Personal Data Protection (within 72 hours) and for informing patients.
- We evaluate the incident, mitigate its consequences and eliminate its cause.
8. Contact
- NEXACorteX s.r.o., Company ID 24475483, Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic
- Data protection: gdpr@nexacare.cz
- Data protection officer: Mgr. Stanislav Kukal, stanislav.kukal@nexacare.cz