Health / Special-Category Data Addendum
Processor: D.O.D.O. OFFICE OUTLET S.R.L. (brand Vocalyy), CUI 48578743, ONRC J23/4990/2023, seat Sat Dudu, Comuna Chiajna, Str. Rezervelor nr. 54, bl. 7, ap. 23, județul Ilfov. Annex 4 to the Vocalyy DPA.
Scope: Applies to, and only to, a Customer whose use of the Service involves special-category personal data (Art. 9 GDPR), in particular health data (for example medical, dental, pharmacy or optical practices). Without a signed copy of this Addendum, the Customer must not use the Service to process special-category data.
1. Definitions
- Special-category data
- personal data listed in Art. 9(1) GDPR, including data concerning health.
- Health data
- personal data related to physical or mental health, including the provision of healthcare, per Art. 4(15) GDPR.
- Prohibited data
- national ID (CNP), payment-card numbers (PAN), bank-account details (IBAN); not permitted on the Service (see §5).
2. Controller responsibilities and warranties
2.1 The Customer is the Controller of special-category data processed through the Service and warrants that, before any such processing, it holds a valid Art. 9(2) condition, in particular explicit consent (Art. 9(2)(a)) or the healthcare basis (Art. 9(2)(h)) together with the professional-secrecy safeguards of Art. 9(3), alongside an Art. 6 basis.
2.2 The Customer provides the required caller notice (recording, AI disclosure and health-data processing) and operates data minimisation: it does not configure its agent to solicit more special-category data than strictly necessary.
2.3 As between the parties, the Customer is responsible for the lawfulness of what its agent asks, states and collects (DPA §3.3) and indemnifies Vocalyy for claims arising from the Customer's configuration or a missing Art. 9 basis. This does not limit a data subject's rights or the supervisory authority's powers.
3. Vocalyy processor commitments (enhanced Art. 32 measures)
3.1 Access to health-tenant transcripts and recordings is restricted to named, role-based staff on a need-to-know basis and is logged.
3.2 Encryption in transit and at rest.
3.3 No secondary use and no model-training on health data, by Vocalyy or any sub-processor (reinforces DPA §6.5).
3.4 Sub-processors receiving health data are bound to equivalent terms; the current list is disclosed per the DPA sub-processor annex.
3.5 Processing is only on the Customer's documented instructions (the configured Service).
4. Internal AI features
Where an in-platform AI assistant processes transcripts that may contain health data, §3.1 access-logging and §3.3 no-training apply, and the feature and its access are disclosed to the Customer.
5. Prohibited data (detect and redact)
5.1 The Customer must not configure its agent to request CNP, payment-card numbers or bank-account details.
5.2 Vocalyy applies automated detection and redaction of such values in transcripts and logs. Vocalyy does not act as a payment processor and the Service is not PCI-DSS scoped for cardholder data.
6. Retention
Health data follows the Service retention rules (audio 30 days; transcripts and metadata 90 days), unless the Customer sets a shorter period. No retention of health data beyond the stated rule except a minimal billing skeleton under Legea 82/1991.
7. Breach notification
For a personal-data breach involving special-category data, Vocalyy notifies the Customer without undue delay and in any event within 24 hours of becoming aware, with the information the Customer needs for its Art. 33/34 duties.
8. Order of precedence
Imperative law > executed Order > DPA > this Addendum > Terms. This Addendum supplements, and does not reduce, the DPA.