Data processing agreement

The controller is the practice that uses Praxovi. The processor is:

Subodh Yadav
Dr. med. dent. Jeong-Woo Yoo
c/o Smilezone
Bahnhofstrasse 32
6300 Zug
Schweiz

E-mail: subodh@praxovi.com

We provide the practice with software for organising the practice and process personal data on its behalf to do so. The agreement applies for as long as the contract runs, and afterwards for as long as we still process the practice’s data.

Which data is processed depends on the features the practice uses:

• The practice’s team: name, e-mail address, photo (if one is stored), role, workload and dates of employment; working hours, absences with their type (for example illness), holidays and overtime; completed tasks, including photos as evidence; entries in the employee journal and personal documents; messages in the practice chat; sign-in data.
• Patients, as far as the practice uses the features concerned: calls to the AI reception (number, concern, callback number and the course of the call); requests through the practice website (name, phone number, concern, preferred time); messages to patients (the address or number used to send them, shortened in the log) and replies by text message.
• Documents the practice uploads, with the data they contain.

This can include sensitive personal data, for example health data in the type of an absence or in the concern of a call. Praxovi keeps no patient records and no billing; these stay in the practice’s management system.

We process the data only to provide, bill, secure and support the service, and on the practice’s instructions; what the practice sets up and triggers in the application counts as such an instruction. We do not use the data for advertising or to train AI models, and for our own purposes in one form only: from the server logs we derive weekly usage figures for the whole platform, to improve the service, such as how often a feature was used. They name neither people nor practices, and we keep a figure only when at least three practices contributed to it.

Anyone at Praxovi with access to the practice’s data is bound to confidentiality and accesses it only as far as operations and support require. In place today:

• Hosting at Google Cloud in Zurich; transmission and storage are encrypted.
• Sign-in with a one-time code by e-mail instead of a password, signed sessions, and roles that decide who sees what. Every query is limited to the practice’s own data.
• A log of selected accesses to practice data, such as searches in the AI document search, stored apart from operations.
• Photos that evidence hygiene tasks are kept, and deleted only after their retention period has ended, on our operator’s confirmation.

We provide the practice with the technical and organisational measures in detail on request.

If we learn of a data security breach affecting the practice’s data, we report it to the practice as soon as possible.

The practice agrees that we use these sub-processors:

• Google Cloud: operation and storage in Zurich; the AI features, including speech recognition and speech synthesis, in the EU.
• Twilio (Twilio Inc., USA): text messages and telephony, including for the AI reception, and sending e-mail.
• Microsoft (USA): our mailbox when the practice writes to us.
• Google (USA): copies of notifications to the operator, for example feedback sent from the application.
• The push services of browser vendors (for example Google, Apple, Mozilla): they deliver notifications to the team’s devices.

We announce any further sub-processor to the practice by e-mail in advance; the practice may object for good cause.

The data is held in Switzerland (Zurich). For the AI features it is processed in the EU, whose data protection the Federal Council recognises as adequate; Twilio processes text messages in Ireland. Twilio, Microsoft, Google and the push services may also process data in the USA, and the server logs are not fixed to Switzerland. For these cases we rely on the providers’ safeguards, such as the Swiss-U.S. Data Privacy Framework where they are certified under it, or standard contractual clauses.

We support the practice as far as we can when it answers requests from data subjects (access, correction, deletion, data portability), carries out a data protection impact assessment or reports a data security breach to the FDPIC. The practice can meet many requests itself in the application, for example with the exports.

For 30 days after the contract ends, the practice can export its data. We then delete it within 90 days.

Excepted are records that must be kept, in particular the hygiene records: we keep them until their retention period ends and delete them once it has ended, on our operator’s confirmation. We keep the access log separately for ten years.

A hygiene record has to say who did each step, so the names of the team members who did them stay in it for as long as the record itself.

The practice can ask us in writing how we comply with this agreement and receives a written answer. A further audit is agreed case by case.