Data processing details
Last Modified October 1, 2020 / Previous Versions
The following processing details are provided for the associated Services and tools:
Dragon Medical One (DMO) Data Processing Details
(a) The subject matter, nature and purpose of the Processing is delivery of the Services to Company in accordance with Nuance’s published product documentation for the product in question, including voice recognition services to translate voice dictation to text for healthcare providers. Dragon Medical One is a cloud-based platform that helps to produce clinical documentation for medical professionals, through voice recognition services to translate voice dictation to text. To fully optimize the voice recognition abilities of these programs, Company or Distributor, depending on whether Nuance uses a Distributor, instructs Nuance and its service providers/sub-processors and Affiliates to use, compile (including creating statistical and other models), annotate and otherwise analyze the data to develop, train, tune, enhance and improve the speech recognition, natural language understanding and other components of Nuance’s software and technologies embodied in the Services.
(b) The categories of Data Subjects are (1) patients or clients who receive medical care from the Company and who are the subject of reports Processed by the Services, (2) Company personnel, including doctors, nurses, administrators, medical personnel and other authorized individuals who use the Services, (3) employees, agents, and contingent workers of Resellers (who are natural persons), and (4) employees, agents, or contingent workers of Distributor (who are natural persons).
(c) The types of Personal Data involved are under the control of Company as Controller, and will depend on the categories of Personal Data Processed by Company using the Services, but will likely include name, date of birth, medical record number, other identification numbers, age, description of medical treatment and diagnosis, or financial information. Additionally, Personal Data of Company personnel will also be Processed, including name, contact information and voice recordings. Further, Personal Data of Distributor and Reseller personnel, including name and contact information, will also be Processed in the provision of third level service support and data analytics.
(d) Processing of Personal Data will be conducted in the following locations:
North America: in the US for US Companies and in Canada for Canadian Companies;
EMEA: in Germany for German Companies and in France for all other EMEA Companies;
(e) The duration of the Processing is the duration of
(i) the Main Agreement in case of a DPA for End Users;
(ii) the Terms of Service in case of a DPA for Nuance Services;
(iii) the Agreement in case of a DPA for Nuance Distributors.
Any data retention period specified in the above terms, as applicable, or by law (or, if no specific data retention period is specified in the above terms, the data retention period specified by Nuance data retention and destruction policy).
Virtual Assistant, Live Chat, MIX, Conversational AI and Nuance Experience Studio Data Processing Details
(a) The categories of Data Subjects are:
Employees, agents, or contingent workers of Company (who are natural persons);
Natural persons authorized by Company to use the Services (for example customers and prospective customers of Company);
(b) The nature and purpose of the Processing is to facilitate chat conversations between Company’s customers/prospects and Company’s employees, agents, or contingent workers and to operate, maintain, tune, enhance, improve, and provide technical support for the Services. These conversations can include general Company information or requests and transactions specific to an individual Data Subject. This conversation could also include dialog with a virtual assistant;
(c) The subject matter of the Processing is the chat conversations related to a specific request by the Data Subject, to answer a question or make updates to the Company services provided to the Data Subject;
(d) The types of Personal Data involve information necessary to enable communications between Company and Data Subject and provided by the Data Subject in order to gain the information or update Company services, including but not limited to:
Device/Client Identifier – Identifier that enables communication between Company and user, such as a socket id or IP Address;
Chat Message Content – Transcript of the chat message between Company and user, including personal information normally exchanged during a customer service conversation such as name, address, or email address;
Meta Data – Specific personal information requested by the Data Subject or Company necessary to fulfil the customer service request, such as customer id, verification information such as mother’s maiden name, date of birth, or social security number, credit card number, or information related to Data Subject’s account with Company;
(e) The Processing will comprise of collecting data from Company’s web site, mobile app, or via a messaging channel (such as SMS), sending it to Company’s employee, agent, or contingent worker via an HTML-based agent desktop application. This data will be retained in a hosted database (with the exception of data that is masked according to predefined forms, automatic pattern matching, or manual overrides) and made available to authorized users of Nuance data APIs or reporting web tools;
(f) Processing of Personal Data will be conducted in the following locations:
For Companies in North America in the USA;
For Companies in EMEA in UK, Ireland, France, and The Netherlands;
For Companies in APAC in Australia;
(g) The duration of the Processing will be for 18 months for Services, reporting and analytics, and 3 years to maintain, tune, enhance, improve and provide technical support or the duration specified in documented instructions by Company or Distributor, depending on whether Nuance uses a Distributor, but in no event longer than 90 days following the duration of
(i) the Main Agreement in case of a DPA for End Users;
(ii) the Terms of Service in case of a DPA for Nuance Services;
(iii) the Agreement in case of a DPA for Nuance Distributors.
Gatekeeper Data Processing Details
(a) The categories of Data Subjects are:
Employees, agents, or contingent workers of Company (who are natural persons)
Natural persons authorized by Company to use the Services (for example customers and prospective customers of Company);
(b) The nature and purpose of the Processing is to facilitate chat conversations between Company’s customers/prospects and Company’s Employees, agents, or contingent workers and to operate, maintain, tune, enhance, improve, and provide technical support for the Services. These conversations can include general Company information or requests and transactions specific to an individual Data Subject. This conversation could also include dialog with a virtual assistant.;
(c) The subject matter of the Processing is the chat conversations related to a specific request by the Data Subject, to answer a question or make updates to the Company services provided to the Data Subject.;
(d) The types of Personal Data involve information necessary to enable communications between Customer and Data Subject and provided by the Data Subject in order to gain the information or update Company services, including but not limited to:
Device/Client Identifier – Identifier that enables communication between Company and user, such as a CLI, socket id or IP Address;
Call Center Conversation – audio recording of the Data Subject/user speaking with a Company representative. Although not explicitly requested, unstructured conversation can contain personal information including, but not limited to: name, address, credit card number;
Chat Message Content – Transcript of the chat message between Company and user, including personal information normally exchanged during a customer service conversation such as name, address, or email address;
Meta Data – Specific personal information requested by the Data Subject or the Company necessary to fulfill the customer service request, such as customer id or CLI;
(e) The Processing will comprise of collecting data from Company’s call center, IVR, or digital channels such as mobile apps or web (e.g. live chat). This data will be retained in a hosted database (with the exception of data that is masked according to predefined forms, automatic pattern matching, or manual overrides) and made available to authorized users of Nuance data APIs or reporting web tools;
(f) Processing of Personal Data will be conducted in the following locations:
For Companies in North America in the USA and Canada;
For Companies in EMEA in UK, Ireland, France, Germany, and The Netherlands;
For Companies in APAC in Australia;
(g) The duration of the Processing will be for 18 months for Services, reporting and analytics, and 3 years to maintain, tune, enhance, improve and provide technical support or the duration specified in documented instructions by Company or Distributor, depending on whether Nuance uses a Distributor, but in no event longer than 90 days following the duration of
(i) the Main Agreement in case of a DPA for End Users;
(ii) the Terms of Service in case of a DPA for Nuance Services;
(iii) the Agreement in case of a DPA for Nuance Distributors.
Cloud IVR Services Data Processing Details
(a) The categories of Data Subjects are:
Employees, agents, or contingent workers of Company (who are natural persons)
Natural persons authorized by Company to use the Services (for example, customers and prospective customers of Company);
(b) The nature and purpose of the Processing is to facilitate automated conversations between Company’s customers/prospects and Company’s IVR applications, employees, or contingent workers and to operate, maintain, tune, enhance, improve, and provide technical support for the Services. These conversations can include general Company information or requests and transactions specific to an individual Data Subject.;
(c) The subject matter of the Processing is the automated conversations related to a specific request by the Data Subject, to answer a question or make updates to the Company services provided to the Data Subject;
(d) The types of Personal Data involve information necessary to enable communications between Customer and Data Subject and provided by the Data Subject in order to gain the information or update Company services, including but not limited to:
Device/Client Identifier – Identifier that enables the communication between Company and user, such as customer’s phone number
Automated Conversation Content – Recording or logging of the conversation between Company and user, including personal information normally exchanged during an automated conversation such as name, address, or email address
Meta Data – Specific personal information requested by the Data Subject or the Company necessary to fulfil the customer service request, such as customer id, verification information such as mother’s maiden name, date of birth, or social security number, credit card number, or information related to Data Subject’s account with Company;
(e) The Processing will comprise of collecting data during the automated conversation or collecting from Company’s backend systems. This data will be retained in a hosted database (with the exception of data that is masked according to predefined forms, automatic pattern matching, or manual overrides) and made available to authorized users of Nuance data APIs or reporting web tools.;
(f) Processing of Personal Data will be conducted in the following locations:
For Companies in North America in the USA;
For Companies in EMEA in UK;
(g) The duration of the Processing will be for 13 months for Services, reporting, and analytics, and 3 years to maintain, tune, enhance, improve and provide technical support or the duration specified in documented instructions by Company or Distributor, depending on whether Nuance uses a Distributor, but in no event longer than 90 days following the duration of
(i) the Main Agreement in case of a DPA for End Users;
(ii) the Terms of Service in case of a DPA for Nuance Services;
(iii) the Agreement in case of a DPA for Nuance Distributors.
Dragon TV Data Processing Details
(a) The categories of Data Subjects are:
Employees, agents, or contingent workers of Company (who are natural persons)
Natural persons authorized by Company to use the Services (for example, customers and prospective customers of Company);
(b) The nature and purpose of the Processing is to facilitate television user experience enhancements by means of voice services between Company’s customers/prospects and Company’s television delivery services, SmartSpeaker support services, employees, or contingent workers and to operate, maintain, tune, enhance, improve, and provide technical support for the Services. These interactions can include general Company information or requests and transactions specific to an individual Data Subject;
(c) The subject matter of the Processing is the audio and resulting transcription related to each specific request by the Data Subject, to answer a question or make updates to the Company services provided to the Data Subject;
(d) The types of Personal Data involve information necessary to enable communications between Customer and Data Subject and provided by the Data Subject in order to gain the information or update Company services, including but not limited to:
Device/Client Identifier – Identifier that enables the communication between Company and user, such as a unique identifier allocated to the device by the OEM.
Audio Command/Query Content – Incoming audio captured from microphones on Device or a Remote Control Unit (RCU) and the transcription of that audio.
User identifier – Specific personal information requested by the Data Subject or the Company necessary to fulfil the customer service request, such as userID;
(e) The Processing will comprise of receiving speech requests from the Data Subject via the Device or RCU on their premises during the transaction conversation or collecting from Company’s backend systems. This data will be retained in a hosted database (with the exception of data that is masked according to predefined forms, automatic pattern matching, or manual overrides) and made available to authorized users of Nuance data APIs or reporting web tools;
(f) Processing of Personal Data will be conducted in the following locations:
For Companies in EMEA:
•In the EU (Ireland) for DTV (based on NCS)
•In UK1 for DTVaaS (based on Core Tech SaaS);
For Companies in Rest of World: in the USA;
(g) The duration of the Processing will be for 120 days for Services, reporting, and analytics, and 3 years to maintain, tune, enhance, improve and provide technical support or the duration specified in documented instructions by Company or Distributor, depending on whether Nuance uses a Distributor, but in no event longer than 90 days following the duration of
(i) the Main Agreement in case of a DPA for End Users;
(ii) the Terms of Service in case of a DPA for Nuance Services;
(iii) the Agreement in case of a DPA for Nuance Distributors.
1Depending on the outcome of Brexit, this may be split between UK hosting for customer in the UK and elsewhere in the EU for EMEA customer outside of the UK.
Proactive Engagement Data Processing Details
(a) The subject matter, nature and purpose of the Processing is delivery of Services to Company in accordance with Nuance’s published product documentation for the product in question, including outbound Voice, SMS and Email notifications. The Proactive Engagement Platform is a Nuance hosted platform that sends consumers notifications on behalf of our clients. Flight cancelation/delay messages, fraud on a credit card, payment reminders, utility outages, appointment reminders. The data is the list of consumers to be notified, the messages are personalized, the data includes, phone numbers, email addresses, first and last name, and additional data related to the use case, flight numbers, overdue payment amounts, credit card transactions, appointment details etc
The categories of Data Subjects are:
Employees, agents, or contingent workers of Company (who are natural persons)
Natural persons authorized by Company to use the Services (for example, customers and prospective customers of Company);
(b) The nature and purpose of the Processing is to facilitate personalized automated outbound notifications to Company’s customers who have opted on to receive outbound Voice, SMS or Email notifications related to the Company’s products or services.
(c) The subject matter of the Processing is the data used to create the outbound notification.
(d) The types of Personal Data involve information necessary to enable outbound notifications to the Data Subject, including but not limited to:
Phone number/Email Address
Data related to the specific use case – Specific personal information related to the notification necessary to personalize the message, such as customer id, verification information such date of birth, or last 4 social security number, last 4 credit card number, or other information related to Data Subject’s account with Company.
(e) The Processing will comprise of collecting data during the automated conversation or collecting from Company’s backend systems. This data will be retained in a hosted database and made available to authorized users of Nuance data APIs or reporting web tools.
(f) Processing of Personal Data will be conducted in the following locations:
data center in Tuwila WA (Seattle) and Aurora CO (Denver)
(g) The duration of the Processing will be for 13 months for detailed data related to the notification and 7 years for aggregate data (count of total SMS sent or email sent etc).