1. Who is responsible
Doctalis is a product published by CodHash Agency Ltd, a private limited company registered in England and Wales under company number 15446527, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
For the public website, demo requests, account administration, security and billing records, CodHash Agency Ltd acts as data controller. Contact: hello@codhash.com.
2. Roles for clinical data
For patient and consultation data entered by a healthcare practice, the practice normally determines why and how the data is used and therefore acts as controller. Doctalis acts as processor under the practice’s documented instructions and the applicable data processing agreement.
The practice remains responsible for informing patients, establishing the applicable legal basis, collecting consent where required, managing professional secrecy and keeping the medical record for the legally required period. Doctalis makes no medical decision.
3. Data we process
Depending on how you interact with Doctalis, we may process:
- demo data: the details you enter when you book a demo call on our Cal.com page, and the demo requests received through the website’s former form (professional email, name, role, organisation, phone number, country and message), which the website no longer collects;
- technical data: IP address, device/browser information, pages visited, timestamps and security logs;
- account and practice data: identity, authentication, membership, professional profile (including the professional phone number and any demo-call request) and configuration, including the specialist vocabulary a practitioner adds;
- support reports sent from the application: the message, the page concerned, browser and screen size and, if the user attaches one, a screenshot, which may show whatever was on screen, patient data included;
- clinical data, only in the Doctalis application (including during a free trial): patient identifiers, consultation audio, transcripts, clinical notes, documents, signatures where used and audit events;
- commercial data: subscription, invoices and payment status, without storing full payment-card details ourselves; payments are processed by Stripe.
4. Purposes and legal bases
We use personal data only for defined purposes:
- answering demo and commercial requests, based on steps requested before a contract and our legitimate interest in responding;
- creating accounts and providing the contracted service;
- protecting accounts, investigating incidents, preventing abuse and meeting legal obligations;
- processing clinical information on the healthcare practice’s documented instructions;
- sending optional communications only where a valid consent or another lawful basis applies.
5. Health data and AI
Never place real patient or health data in a demo booking or an e-mail to us. Real patient data may be entered only in the Doctalis application, including during a free trial, under these terms and the data processing agreement presented there.
Doctalis produces drafts. The clinician must review, correct and validate every final medical document; signing it is optional. Automated output is not a diagnosis, prescription or clinical decision.
6. Providers and recipients
Access is limited to authorised CodHash personnel and providers needed to operate the service. The public website is hosted in Switzerland by Infomaniak Network SA. It no longer collects demo requests: those received through its former form are kept in a separate database, hosted in Switzerland by Infomaniak Network SA, and accessible only to authorised CodHash personnel, who view them in the application’s administration console, which is protected by authentication. Until the form was withdrawn, each of these requests was also notified, with its details, to authorised CodHash team members by direct message on Discord (Discord, Inc., United States); those messages remain there until we delete them. For the website, Cloudflare, Inc. provides network delivery and protection, and the website’s fonts are loaded from Google Fonts (Google LLC, United States), which receives your IP address and browser information when a page loads. Demo calls are booked on our Cal.com page (Cal.com, Inc., United States), which processes the details you enter there for us; if you request a demo call while signing up in the application, your name, email address, phone number and time zone are sent to Cal.com to book it. For the application, account emails, such as sign-in codes, are sent through Resend (Plus Five Five, Inc., United States), without medical content, certified under the EU-U.S. Data Privacy Framework; for persons in Switzerland, this transfer relies on the contractual safeguards of its data processing agreement. Payments are processed by Stripe. If you choose to sign in with a Google account, Google processes that sign-in as a separate controller.
The Doctalis application (app.doctalis.com and api.doctalis.com: application servers, database and file storage) is hosted in Switzerland by Infomaniak Network SA. For clinical data, the application relies on the following sub-processors, which are bound by the same data-protection obligations as CodHash, including the prohibition on reusing the data or using it to train models:
- Infomaniak Network SA (Switzerland): hosting of the application servers, database and file storage;
- Gladia (European Union): speech-to-text transcription and speaker separation, and live transcription during recording and of the practitioner’s dictated notes;
- Scaleway SAS (France): AI-assisted text generation (Generative APIs, processed in the European Union) and, as a fallback only, transcription of recordings when the service is not configured to use Gladia, without reuse or training;
- Cloudflare, Inc. (United States): network delivery and protection of app.doctalis.com and api.doctalis.com, including the encrypted connection (TLS) through which the data passes (traffic, including health data, passes through its servers to be filtered), and storage of the encrypted backups, which it cannot read; certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework (adequacy decisions).
7. International transfers
Doctalis is published by a UK company, but the application’s databases and files are hosted in Switzerland, which the European Commission recognises as providing an adequate level of protection, and no patient health data is stored in the United Kingdom (apart from encrypted backups, whose location is not contractually guaranteed). Speech-to-text transcription and AI-assisted text generation are performed in the European Union, which the Swiss Federal Council recognises as providing adequate protection. Any other transfer outside Switzerland and the European Economic Area relies on an appropriate safeguard: an adequacy decision (in particular for the United Kingdom) or standard contractual clauses.
The following providers are United States companies: Cloudflare, Inc. (network delivery and protection in front of the website and the application, and storage of the application’s encrypted backups), certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework (adequacy decisions); Cal.com, Inc. (booking of demo calls); Discord, Inc. (internal notification of the demo requests received through the website’s former form); Resend (Plus Five Five, Inc.; account emails, without medical content), certified under the EU-U.S. Data Privacy Framework, this transfer relying, for persons in Switzerland, on the contractual safeguards of its data processing agreement; and Stripe (payment, processed notably in the United States by Stripe, Inc.), under the Data Privacy Framework. Google LLC (United States, Data Privacy Framework) serves the website’s fonts (Google Fonts) and, if you choose to sign in with a Google account, processes that sign-in as a separate controller. For persons in Switzerland, transfers abroad comply with articles 16 and 17 of the Federal Act on Data Protection (FADP).
8. Users in Switzerland
When we process personal data of persons in Switzerland, the Swiss Federal Act on Data Protection (FADP, in French nLPD), in force since 1 September 2023, also applies. You notably have a right of access, rectification, deletion and data portability, which you can exercise as described in section 11.
The website and the Doctalis application are hosted in Switzerland (see the Legal notice). Network delivery and the application’s encrypted backups (Cloudflare), account emails (Resend), payment (Stripe), the website’s fonts (Google), demo-call booking (Cal.com) and the internal notification of past demo requests (Discord) involve transfers to the United States, described in sections 6 and 7.
The Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC, in French PFPDT), Feldeggweg 1, 3003 Bern, Switzerland.
9. Retention
Demo requests received through the website’s former form are kept for 24 months after the person’s last request, then deleted automatically (except the Discord copies mentioned in section 6). Account, contract and billing records are kept for the relationship and applicable statutory periods. Free-trial account data can be exported during the trial and for 30 days after it ends. If no subscription follows, the account is then closed: validated documents (final reports) that were not exported are kept in an encrypted archive for two years at most, then deleted; all other data, and the data that was exported, is deleted; in both cases, except data we must keep by law.
In the application, clinical data follows fixed retention periods, which are not configurable: consultation audio is kept for 90 days and transcripts for 180 days, then deleted (a transcript that is the source of a validated document is kept with it, for provenance); an unvalidated draft is deleted after 90 days once it is included in a full export of the practice’s data downloaded by one of its members, and is otherwise kept until it is exported or the account is closed; validated documents are kept for the duration of the contract and can be exported at any time; at the end of the contract, data is returned and then deleted after an export period; the practice remaining responsible for the legal retention of the medical record. Security and technical logs (including the log of e-mails sent by the service: a fingerprint of the recipient’s address and the message identifier at the sending provider) are kept in Switzerland for 12 months; the encrypted content of an e-mail whose sending was definitively abandoned or could not be confirmed is erased no later than three (3) days afterwards; traceability logs, which contain no medical content (identifiers, statuses, dates, file fingerprints), are deleted no later than ten (10) years after they are recorded; support reports sent from the application, with their screenshot, are deleted twelve (12) months after they were sent. Data is then deleted or irreversibly anonymised, subject to a legal hold or mandatory archive.
Backups: the application’s database is backed up continuously and every night; its files (including audio recordings) every night. These copies are encrypted on our servers, with a key Cloudflare does not hold, and then stored by Cloudflare, Inc. (R2 service, Western European data centres, without a contractual location guarantee; a United States company certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework), which cannot read their content. They are used only to restore the service after an incident and to check regularly that restoration works. Deleted data can no longer be restored after seven (7) months at most; encrypted fragments, attached to no backup, may remain in that storage beyond that, unreadable without the key, until they are erased.
10. Security
We apply access controls, encryption in transit and at rest, restricted storage grants, audit trails, tenant isolation, validated and cryptographically sealed clinical states and incident procedures. No internet service can guarantee zero risk. Please use the coordinated disclosure process on the Security page rather than sending sensitive evidence by ordinary e-mail.
11. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and may withdraw consent without affecting prior lawful processing. Write to hello@codhash.com and specify that the request concerns Doctalis. We may need to verify identity without collecting excessive information.
For patient data controlled by a healthcare practice, contact that practice first; we will assist it as processor. You may also complain to the UK ICO, the Swiss FDPIC, the data-protection authority of your EU Member State or the competent authority in your country.
12. Updates and contact
We may update this policy when the product, provider list or law changes. Material changes will be highlighted on this page or in the product. Privacy questions and rights requests: hello@codhash.com.