Hosting, retention periods and health data
Answers for the data protection officer: where data is stored, which providers are involved, how long it's kept and what applies to professionals bound by secrecy.
Before signing, your customer's data protection officer often wants four things clarified: the place of processing, the providers involved, the retention period and the handling of health data. Here are the answers you can back up.
The data protection block for the demonstration
You can say these four sentences as they are. They correspond to the approved statements:
- "Web interfaces, data storage and real-time communication run in Frankfurt am Main."
- "bhomy obtains the language models via an inference broker, and some of its providers are based in the USA. Providers and the legal bases for transfers are disclosed in the data processing agreement."
- "The data processing agreement under Art. 28 GDPR is incorporated when the contract is concluded and is available in German."
- "Call transcripts are deleted automatically 30 days after the call."
Don't name individual providers from memory. Refer to the list of sub-processors in the data processing agreement (opens in a new tab), which shows the current status.
What is stored for a call
| Data | Stored |
|---|---|
| Audio recording of the call | no |
| Transcript | 30 days, then deleted automatically |
| Captured data, such as name and request | 90 days |
| Connection data such as numbers, time and duration | for the term of the contract, for billing and call history |
| Telephony event messages | 7 days |
If a caller refuses recording and the Automatic transcript deletion on refusal setting is switched on, bhomy stores no transcript for this call and extracts no data. The customer can delete individual calls in the call history themselves at any time. When the contract ends, bhomy deletes all data in the account 30 days after the notification, and an export is possible until then. More under Privacy and data.
Notice about the AI
The templates for the greeting and the prompt already contain the notice that an AI system is speaking. The notice remains in every agent, including in customer accounts that you manage and with co-branding.
Professionals bound by secrecy and health data
| Customer | What applies |
|---|---|
| Medical practice, therapy, law firm, tax advisory and others bound by professional secrecy | bhomy provides a confidentiality undertaking under § 203 of the German Criminal Code (StGB). When referring via datenschutz@bhomy.ai, when reselling via Annex 4 of the partner agreement in favour of your customer |
| You access the account of such a customer | You also undertake to maintain confidentiality, for example with Template B |
| Callers mention health data | These are special categories of personal data. Whether and how the customer may process them via the agent is something they check with their data protection officer |
For the prompt of a healthcare customer:
- The agent only asks for what it needs for the purpose, for an appointment, for example, the name, callback number and preferred time, not the diagnosis.
- For acute complaints, it refers callers to the emergency number 112 or the out-of-hours medical service 116117.
- It doesn't give a medical assessment.
What you see as a partner
| Situation | What you see |
|---|---|
| A referral customer is assigned to you | company, plan, billing period, contract status and paid invoices with date and net amount. No call data, no callers' phone numbers, no agent content, no payment details |
| The customer grants you access | what they release, for the period they set. Conversation content only if they explicitly release it. The log stores every access for 12 months |
| You manage the customer account when reselling | the account, as your customer's processor |
Was this page helpful?