Legal

Data processing agreement

A contract addendum that governs the processing of personal data where Nicra processes such data on a client’s behalf. It is mandatory for healthcare providers.

Last updated: October 2026
Contact: contact@nicra.ch

Roles

The client is the controller and determines the purpose of the processing. Nicra is the processor and acts solely on the client’s documented instructions.

Purpose and scope

Data is processed solely for the purposes of receiving calls, conducting conversations, booking appointments and reporting to the client. No other use is permitted.

Sub-processors

Nicra uses these sub-processors: Supabase (database, login and server functions, EU, Frankfurt), Infomaniak (hosting of the website and dashboard and sending emails, Switzerland), Retell AI (telephony, call handling and storing recordings), OpenAI (language model in calls), Microsoft Azure (speech recognition), ElevenLabs (voice synthesis), Anthropic (language model in chat), Meta Platforms Ireland (WhatsApp and Instagram messages), Resend (receiving and sending emails in Chat, US) and Cloudflare (protecting forms from bots). Transfers outside the EU/EEA and Switzerland rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. We give the client advance notice of any changes to this list.

Security

Data is encrypted in transit and at rest, access is restricted to named individuals, and all access is logged. Recordings and transcripts are not publicly accessible: a recording is played only for a member of the business, through an address that is valid for a short time.

Incident notification

We notify the client of any incident that compromises personal data without delay, and in any event within 24 hours of becoming aware of it, together with a description of its scope and the measures taken.

Deletion upon termination

We delete recordings and transcripts 90 days after the conversation, also while the relationship lasts. Upon termination of the business relationship, we delete the other data or, at the client’s request, export it in a readable format, within 30 days.

This document is a working draft and will be supplemented following a legal review before any contracts are signed with clients. In the meantime, please send any questions to contact@nicra.ch.