Voice Recording and Transcription
This is an English translation for your convenience. The Czech version is legally binding.
In brief
- Recording is always started and stopped by the user; they inform the patient in advance and the patient may refuse.
- Audio is not stored on NEXACorteX servers – it exists only as a temporary file while it is converted to text.
- Speech-to-text conversion and language processing take place exclusively in the EU and the data is not used to train models.
- The result is always a draft – nothing is written to the records without the user’s confirmation.
- How long transcripts are kept is set by the practice (10 days by default).
1. What this document is for
- 1.1This document describes how the NexaCare service, operated by NEXACorteX s.r.o., Company ID 24475483, Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic (the “Provider”), processes audio recordings of speech in the Conversation Module and how it protects personal data, including data concerning health.
- 1.2This document is for information only. Binding obligations are set out in the NexaCare Terms and Conditions (the “Terms”), the Data Processing Agreement (the “DPA”) and the NexaCare Acceptable Use Rules (the “Usage Rules”). Capitalised terms have the meaning given in the Terms.
2. Before you start recording
- 2.1Informing the patient. Before starting a recording, the User informs the patient that the conversation will be temporarily audio-recorded to create material for the medical records and allows them to refuse the recording. The obligations of the Customer and Users are set out in Article 5 of the Usage Rules.
- 2.2Data protection. Processing of data concerning health for this purpose is not based on the patient’s consent under the GDPR. The legal basis is determined by the Customer as controller; usually it will be compliance with the obligation to keep medical records (Article 6(1)(c) GDPR in conjunction with Act No. 372/2011 Coll., on Health Services) and the exception for the provision of health care (Article 9(2)(h) and (3) GDPR). Recording is an optional tool that the patient may refuse.
- 2.3Protection of personality. Making an audio recording is also assessed under Section 86 et seq. of the Civil Code. The patient’s permission does not have to be in writing and may be given implicitly – if the patient is properly informed in advance, has a real opportunity to refuse the recording and continues with the consultation. The patient may withdraw their permission at any time (Section 87 of the Civil Code); the User then stops the recording and discards the recording and the transcript in progress. The Application does not record that the patient was informed; the Customer chooses a suitable way of evidencing this. Written consent from the patient is not expected for normal use of the Application.
- 2.4Impact assessment. Processing data concerning health using artificial intelligence will usually require the Customer to carry out a data protection impact assessment (Article 35 GDPR); the Provider gives it the necessary information (DPA, Article 12).
3. Life cycle of a recording
The Application offers two modes: real-time transcription (text appears while speaking) and transcription after completion (the recording is processed after it ends or after an audio file is uploaded).
| Step | Who processes | Where | What is processed | How long |
|---|---|---|---|---|
| 1. Recording | User – starts, pauses and stops | browser, mobile app (iOS / Android), or file upload | audio | for the duration of the recording |
| 2. Recovery backup | User’s browser | User’s device | audio | until successfully uploaded; unfinished recordings no longer than 24 hours (Article 4) |
| 3. Transfer | Provider | encrypted connection to servers in the EU | audio | — |
| 4. Speech-to-text conversion | Sub-processor | EU | audio in its original form – names and other information spoken in the conversation cannot be removed from it in advance | real-time transcription: not stored; transcription after completion: no longer than 30 days, then automatically deleted. On the Provider’s servers only a temporary file, deleted immediately after conversion, even if it fails |
| 5. Draft report | Sub-processor (language model) | EU | transcript text, from which sensitive personal data is automatically removed before it is passed on (anonymisation) | not stored (zero data retention mode) |
| 6. Storing the transcript and draft | Provider | database in the EU | transcript, draft report | according to the setting in the Application (set by the Customer); 10 days by default |
| 7. Final report | Customer | its information system for medical records | report confirmed by the User | according to the rules for medical records |
- The speech-to-text Sub-processor is certified to ISO/IEC 27001:2022 and has a SOC 2 Type 2 attestation report. Data is encrypted in transit and at rest, logically separated from other customers’ data and not used to train models.
- The language model Sub-processor works for the Provider in zero data retention mode: inputs and outputs are processed only for the time needed to handle the request, are not stored and are not used for training.
- All Sub-processors act on the Provider’s instructions under a contract pursuant to Article 28 GDPR. Their categories are listed in Annex 2 to the DPA; the Provider discloses their identity to the Customer on request.
- Data is not transferred to third countries outside the EU/EEA.
4. Recovering a recording after a crash
- During recording, the audio is also continuously saved to the browser’s storage. It serves exclusively for recovery – if the window closes or the device crashes, the recording is not lost.
- After successful completion and upload, the recording is automatically deleted from the device; unfinished recordings are deleted automatically after 24 hours.
- The next time it starts, the Application offers the rescued recording for use; the User can delete it immediately with the Discard button.
- This backup is not used in the Android mobile app – the system recorder returns the audio only after the recording ends.
5. Reviewing the draft
- The result is always a draft. The Application does not make a diagnosis or determine treatment.
- Places where the Application is not certain are marked as “Data to review”; the report cannot be sent until the User resolves them.
- When rephrasing a sentence, the Application shows the difference from the original wording and checks that no numbers have changed.
- The draft is fully editable. Nothing is sent to the outpatient information system or saved to the medical records without the User’s express confirmation.
- The Customer is responsible for the content of the final report; the User verifies it before confirming (Terms, clauses 7.3 and 13.2).
6. The “My style” feature
- The Application learns from the differences between the draft and the text the User confirmed, so that future drafts better match their style.
- It stores pairs of “original → corrected wording” (e.g. “shortness of breath” → “dyspnoea”), the number of their occurrences and sample sentences in which patient identifiers, including names, are replaced before storage. After three identical edits, a pair becomes a rule.
- Changes to numbers and clinical data are deliberately not learned – “3 days” → “4 days” is a correction of fact, not style.
- The rules are personal: they apply only to the given User, are not shared and are not used to train models. They are kept for as long as the user account exists and are irreversibly deleted when it is closed.
7. Retention
| Type of data | Where | Retention period | Deletion |
|---|---|---|---|
| Audio recovery backup | User’s browser | until uploaded; unfinished recordings no longer than 24 hours | automatically; the User can delete it immediately |
| Audio on the Provider’s servers (uploaded or recorded in the Application) | EU | not stored – only a temporary file during conversion | automatically immediately after conversion, even if it fails |
| Audio and transcript at the Sub-processor – real-time transcription | EU | not stored | — |
| Audio and transcript at the Sub-processor – transcription after completion | EU | no longer than 30 days | automatically |
| Language model inputs and outputs | EU | not stored (zero retention) | — |
| Transcript and draft report (Conversation history) | Provider’s database (EU) | according to the setting in the Application (set by the Customer) – a chosen period, no automatic deletion, or immediate deletion; 10 days by default | automatically after the period expires or manually by the User |
| “My style” rules | Provider’s database (EU) | for as long as the user account exists | when the account is closed |
| Final report | Customer’s system | according to the rules for medical records | on the Customer’s instruction |
| Audit and access logs (no audio content) | Provider’s database (EU) | 90 days (error logs 30 days) | automatically by a daily job |
| Database backups | EU | 14 days; they contain no audio; deleted transcripts may persist in them for no longer than 14 days | by automatic overwriting |
Neither the Provider nor Sub-processors use audio recordings, transcripts or reports for any purpose other than providing the service to the Customer, and they do not use them to train models.
8. Security
- Encryption of data in transit and at rest.
- Separation of Practices’ data at database level. Reading across Practices is reserved for automated jobs (e.g. cleanup of old transcripts, e-mail processing) and the Provider’s administrative tools, and each such read is logged with the reason stated.
- Permission management – a User sees only the Modules and data that the Practice Administrator allows.
- Two-factor authentication, remote sign-out and a limit on concurrent sessions.
- A log of every access to patient data; the Practice Administrator can see who looked at which patient and when.
- Audit logs are cryptographically chained – any subsequent alteration of history can be detected.
- The Provider’s staff access content only to the extent necessary for operation or at the Customer’s request.
The Provider notifies the Customer of a security breach within 24 hours (DPA, Article 11).
9. Who is responsible for what
- The Customer (the healthcare provider) is the controller of patients’ personal data: it determines the purpose of processing, informs patients and is responsible for the medical records.
- The Provider is the processor of audio, transcripts and reports and acts only on the Customer’s instructions and the DPA.
- For user accounts, invoicing and operational security, the Provider is an independent controller – see the Privacy Policy.
Questions: gdpr@nexacare.cz · Data protection officer: Mgr. Stanislav Kukal, stanislav.kukal@nexacare.cz