Data Processing Agreement (DPA)
This DPA defines data protection obligations between the customer (Controller) and AssistaNote (Processor).
1. Parties and roles
This DPA applies when a customer organization uses AssistaNote to process personal data on its behalf. The customer acts as Controller and AssistaNote acts as Processor unless the parties agree otherwise in writing.
2. Subject matter and duration
Processing covers personal data submitted to or generated through the Service for the duration of the applicable service relationship, including any retention period required by contract or law.
3. Data subjects and data categories
Data subjects may include customer personnel and other persons whose information is included in conversations, transcripts, documents or connected web applications. Data may include identification and contact data, account or session identifiers, audio, transcripts, documents, website content and, where the Controller chooses to process it, special-category data such as health information.
4. Nature and purpose of processing
AssistaNote processes personal data only on documented instructions from the Controller to provide the Service, including transcription, structuring user-provided content, generating notes, applying templates, identifying and mapping fields in supported web applications, filling mapped fields at the user's request, maintaining security and providing support.
5. Confidentiality and security
AssistaNote applies technical and organizational measures appropriate to risk, including access controls, encryption where appropriate, logging, service isolation and confidentiality obligations for authorized personnel.
6. Subprocessors
AssistaNote may engage subprocessors to provide functions such as hosting, transcription, AI processing, security, communications and billing. Subprocessors are engaged under written terms requiring appropriate data-protection obligations. Information about current subprocessors is available on request.
7. Data subject rights and compliance assistance
Taking into account the nature of processing and information available to it, AssistaNote will reasonably assist the Controller with data-subject requests and with obligations relating to security, impact assessments and supervisory authorities where applicable.
8. Incidents, return and deletion
AssistaNote will notify the Controller without undue delay after becoming aware of a personal-data breach affecting customer data. On termination, personal data is returned or deleted in accordance with the contract, applicable retention settings and legal requirements.
9. Audit and contact
Reasonable information demonstrating compliance with this DPA may be provided on written request, subject to confidentiality and security safeguards. For DPA matters, contact AssistaNote through the official channels listed on assistanote.com.