Privacy as a foundation, not a feature
Vocadoc was designed around GDPR and data sovereignty from the first line of code. Your patient data stays in the Netherlands and the EU, on infrastructure we run ourselves.
Compliance
Developed to the highest standards
GDPR
Compliant by design
Vocadoc is designed with privacy as a core principle. All data processing complies with the General Data Protection Regulation.
EU Data Residency
Active
All data is processed and stored exclusively within the EU (Netherlands and Germany). No data leaves European borders.
Transient Audio Processing
Active
Audio recordings are never stored. Deleted immediately after successful transcription.
0 audio retained
Audio in, text out, nothing retained
Audio recordings are processed exclusively in working memory. The moment transcription completes successfully, the audio file is permanently and irreversibly deleted. No archive, no backup, no training dataset. You keep the text, not the voice.
- No persistent storage of audio on disk
- Permanently deleted within seconds of transcription
- No backups, no logs, no AI training data
- You stay in full control of what remains: only the text
Full functionality without patient data
You decide how much patient data you share, even zero
Patient linking is fully optional. You can use Vocadoc without ever entering a name, date of birth, or national ID. Transcription and summarization work independently. Linking notes to patient records is only there to support your own organization, and it always stays your choice.
- Transcription and summarization work fully without patient data
- Patient linking is opt-in and only for your own overview
- Keep patient identifiers entirely in your own systems if you prefer
- Less data with us means less risk, for everyone
- Name optional
- Date of birth optional
- National ID optional
All fields are optional
Data architecture
Your data, fully protected
Your data is processed and stored on our own servers in the Netherlands. Every step in data processing is designed with security as a priority.
- Primary data storage on our own self-hosted servers in the Netherlands
- TLS 1.3 encryption for all data transfers
- AES-256 encryption for stored data
- Audio is deleted after successful processing
- All data remains within the EU
- The practitioner retains full control over the data
Access control and authentication
Multiple security layers protect access to your data. Only authorized users have access to the platform.
Secure authentication
Login with strong password requirements. Multi-factor authentication available for additional security.
Role-based access
User roles determine which data and features are available. Practitioners can only see their own patient data.
Audit logging
All access to patient data is logged. Full traceability of who viewed or modified what.
Session management
Automatic session expiration after inactivity. Active sessions are visible and can be terminated.
API security
All API communication is encrypted and authenticated. Rate limiting and abuse detection protect against unauthorized access.
Security documents
Data Processing Agreement
Standard data processing agreement based on the BoZ model. Available upon request.
Request via contactSub-processor overview
Overview of all sub-processors involved in data processing. Available upon request.
Request via contactDPIA summary
Summary of the Data Protection Impact Assessment for Vocadoc. Available upon request.
Request via contactSub-processors
The following parties are involved in data processing within Vocadoc. All processing takes place within the EU.
| Name | Purpose | Location | Processing type |
|---|---|---|---|
| Vocadoc (Self-hosted) | Primary data storage and audio transcription | Netherlands (EU) | Primary infrastructure |
| Hetzner Online GmbH | Failover infrastructure and gateway | Germany (EU) | Failover and routing |
| Worldstream B.V. | Gateway infrastructure (reverse proxy) | Netherlands (EU) | Routing |
| AWS (Amazon Bedrock) | Document generation (AI language processing) | Germany (EU) | AI processing |
Incident response
Vocadoc has an incident response plan for security incidents. In the event of a suspected data breach, you will be informed within 72 hours, in accordance with the GDPR. Security researchers who report vulnerabilities are treated with respect.
security@vocadoc.comWe respond to security reports within 24 hours on business days.
Frequently asked questions about security
Answers to the most common questions about Vocadoc's security and privacy.
Where is my data stored?
All data is stored on our own servers in the Netherlands (self-hosted). Hetzner (Germany) and Worldstream (Netherlands) provide failover and gateway services only. All processing remains within the EU.
Do you offer a data processing agreement?
Yes, we offer a standard data processing agreement based on the BoZ model. You can request it via our contact page.
What happens to the audio after processing?
Audio recordings are automatically deleted after successful processing of the transcription. No audio files are retained long-term.
Is patient data used for AI training?
No. Patient data is never used for training AI models. Your data is only processed for generating your documentation.
How do I report a security incident?
Security incidents can be reported via security@vocadoc.com. We respond within 24 hours on business days.
What security standards does Vocadoc follow?
Vocadoc is GDPR-compliant by design. All data is stored and processed within the EU. We maintain comprehensive audit logging, role-based access control, and multi-layer encryption.
Is a DPIA available?
Vocadoc conducts a Data Protection Impact Assessment (DPIA) as part of the development process. The summary will be made available once completed.
How does Vocadoc handle audio recordings?
Audio recordings are processed transiently on Vocadoc's own servers within the EU. After successful transcription, audio is immediately and permanently deleted. No audio files are retained.