Skip to content
Doctalis

Data protection

Privacy policy

How Doctalis handles contact, account and clinical data, and how to exercise your rights.

1. Who is responsible

Doctalis is a product published by CodHash Agency Ltd, a private limited company registered in England and Wales under company number 15446527, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For the public website, demo requests, account administration, security and billing records, CodHash Agency Ltd acts as data controller. Contact: [email protected].

2. Roles for clinical data

For patient and consultation data entered by a healthcare practice, the practice normally determines why and how the data is used and therefore acts as controller. Doctalis acts as processor under the practice’s documented instructions and the applicable data processing agreement.

The practice remains responsible for informing patients, establishing the applicable legal basis, collecting consent where required, managing professional secrecy and keeping the medical record for the legally required period. Doctalis makes no medical decision.

3. Data we process

Depending on how you interact with Doctalis, we may process:

  • demo and contact data: professional email, name, role, organisation, phone number, country and message;
  • technical data: IP address, device/browser information, pages visited, timestamps and security logs;
  • account and practice data: identity, authentication, membership, professional profile and configuration;
  • clinical data, only in the Doctalis application (including during a free trial): patient identifiers, consultation audio, transcripts, clinical notes, documents, signatures where used and audit events;
  • commercial data: subscription, invoices and payment status, without storing full payment-card details ourselves; payments are processed by Stripe.

4. Purposes and legal bases

We use personal data only for defined purposes:

  • answering demo and commercial requests, based on steps requested before a contract and our legitimate interest in responding;
  • creating accounts and providing the contracted service;
  • protecting accounts, investigating incidents, preventing abuse and meeting legal obligations;
  • processing clinical information on the healthcare practice’s documented instructions;
  • sending optional communications only where a valid consent or another lawful basis applies.

5. Health data and AI

Never place real patient or health data in a public demo or contact form. Real patient data may be entered only in the Doctalis application, including during a free trial, under these terms and the data processing agreement presented there.

Doctalis produces drafts. The clinician must review, correct and validate every final medical document; signing it is optional. Automated output is not a diagnosis, prescription or clinical decision.

6. Providers and recipients

Access is limited to authorised CodHash personnel and providers needed to operate the service. The public site and its demo-request database are currently hosted in Germany by Hetzner Online GmbH; a migration to Infomaniak, in Switzerland, is planned. For the website, Cloudflare provides network delivery and protection, and Discord carries restricted internal notifications about demo requests. For the application, account emails, such as sign-in codes, are sent through Resend (Plus Five Five, Inc., United States), certified under the EU-U.S. Data Privacy Framework; for persons in Switzerland, this transfer relies on the contractual safeguards of its data processing agreement.

The Doctalis application (app.doctalis.com and api.doctalis.com: application servers, database and file storage) is hosted in Germany by Hetzner Online GmbH; a migration to Infomaniak, in Switzerland, is planned. For clinical data, the application relies on the following sub-processors, which are bound by the same data-protection obligations as CodHash, including the prohibition on reusing the data or using it to train models:

  • Hetzner Online GmbH (Germany): hosting of the application servers, database and file storage;
  • Gladia (European Union): speech-to-text transcription;
  • Cloudflare, Inc. (United States): network delivery and protection of app.doctalis.com and api.doctalis.com, including the encrypted connection (TLS) through which the data passes; certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework (adequacy decisions).
  • Vercel Inc. (United States), through its AI Gateway: AI-assisted text generation; certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework (adequacy decisions). It will be replaced by a provider processing the data in the European Union.

7. International transfers

Doctalis is published by a UK company, but patient health data is hosted in Germany and is not stored in the United Kingdom. Any transfer outside the European Economic Area relies on an appropriate safeguard: an adequacy decision (in particular for the United Kingdom and Switzerland) or standard contractual clauses. Network delivery of the application passes through Cloudflare, Inc., and AI-assisted text generation currently passes through Vercel Inc., both in the United States and certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework (adequacy decisions); Vercel will be replaced by a provider processing the data in the European Union. Account emails are sent through Resend (Plus Five Five, Inc., United States), certified under the EU-U.S. Data Privacy Framework; for persons in Switzerland, this transfer relies on the contractual safeguards of its data processing agreement.

8. Users in Switzerland

When we process personal data of persons in Switzerland, the Swiss Federal Act on Data Protection (FADP, in French nLPD), in force since 1 September 2023, also applies. You notably have a right of access, rectification, deletion and data portability, which you can exercise as described in section 11.

The website, its demo-request data and the Doctalis application are currently hosted in Germany (see the Legal notice). The Swiss Federal Council recognises the Member States of the European Union as providing adequate data protection. A migration of hosting to Infomaniak, in Switzerland, is planned; this policy will be updated when it takes place. Network delivery (Cloudflare), account emails (Resend) and AI-assisted text generation (Vercel) involve transfers to the United States, described in sections 6 and 7.

The Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC, in French PFPDT), Feldeggweg 1, 3003 Bern, Switzerland.

9. Retention

Demo-request data is retained until the request is closed and, where no commercial relationship follows, for no longer than 24 months after the last meaningful contact. Account, contract and billing records are kept for the relationship and applicable statutory periods. Free-trial account data can be exported during the trial and for 30 days after it ends. If no subscription follows, the account is then closed: validated documents (final reports) that were not exported are kept in an encrypted archive for two years at most, then deleted; all other data, and the data that was exported, is deleted; in both cases, except data we must keep by law.

In the application, clinical data follows fixed retention periods, which are not configurable: consultation audio is kept for 90 days and transcripts for 180 days, then deleted (a transcript that is the source of a validated document is kept with it, for provenance); unvalidated drafts are purged after 90 days; validated documents are kept for the duration of the contract and can be exported at any time; at the end of the contract, data is returned and then deleted after an export period; the practice remaining responsible for the legal retention of the medical record. Security and technical logs are kept for 12 months. Data is then deleted or irreversibly anonymised, subject to a legal hold or mandatory archive.

10. Security

We apply access controls, encryption in transit and at rest, restricted storage grants, audit trails, tenant isolation, cryptographically signed clinical states and incident procedures. No internet service can guarantee zero risk. Please use the coordinated disclosure process on the Security page rather than sending sensitive evidence through a demo form.

11. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and may withdraw consent without affecting prior lawful processing. Write to [email protected] and specify that the request concerns Doctalis. We may need to verify identity without collecting excessive information.

For patient data controlled by a healthcare practice, contact that practice first; we will assist it as processor. You may also complain to the UK ICO, the Swiss FDPIC, the data-protection authority of your EU Member State or the competent authority in your country.

12. Updates and contact

We may update this policy when the product, provider list or law changes. Material changes will be highlighted on this page or in the product. Privacy questions and rights requests: [email protected].