Data processing agreement

• The customer is the organization that accepts this agreement in the dashboard (the controller).
• The processor is nyra health GmbH, Salzgries 19/3–4, 1010 Vienna, Austria (see the imprint). Contact: info@nyra.health.

This agreement covers the personal data that the customer's content holds. It does not cover the account and billing data of the customer's team. For that data, we are the controller. The privacy policy describes it.

We process personal data to provide the Nyra Labs API: we transcribe the audio the customer sends and return the results. The processing lasts as long as the customer uses the API, plus the time needed to delete the data after the contract ends.

• We process the data only on the customer's documented instructions. The terms of service, this agreement, the API calls and the dashboard settings are those instructions.
• If we think an instruction breaks data protection law, we tell the customer at once. If the law requires us to process the data in another way, we tell the customer first, unless the law forbids it.
• We do not use the customer's audio or transcripts to train or improve models.
• We do not sell the data and we do not share it with anyone except our sub-processors.
• We keep the data logically separate from the data of other customers.

The customer decides why and how the data is processed. The customer makes sure that it has a lawful basis, gives people the information the law requires, and has the right to send the audio to us. The customer chooses the retention setting. The acceptable use policy has more rules.

Everyone who may access the data at nyra labs is bound to confidentiality, by contract or by law. Access is limited to people who need it to provide the service.

We take technical and organizational measures that fit the risk, under Article 32 GDPR. These include:

• hosting in data centers of Google Cloud in the EU
• encryption of data in transit with TLS, and encryption at rest by our cloud provider
• role-based access for the customer's team, with separate data for each organization
• API keys kept only as a hash
• rate limits, and logs for the detection of abuse
• least-privilege access for our staff and cloud accounts
• automatic deletion of stored audio and responses when the retention time ends
• an incident response process

We review these measures from time to time and we may improve them. We will not make the overall level of security lower.

The customer gives us a general authorization to use sub-processors. We have a written contract with each one. These contracts require data protection duties that are at least as strong as those in this agreement. We stay fully responsible to the customer for our sub-processors.

These are our sub-processors on the effective date:

We tell the customer at least 30 days before we add or replace a sub-processor. We do this by email to the organization owners, in the dashboard, or by an update to this page. The customer may object for a good data protection reason within that time. We then try to find a solution. If we cannot, the customer may end the contract for the affected service and we refund unused balance.

The sign-in providers GitHub and Google are not our sub-processors. They are independent controllers for the accounts that people hold with them.

We process audio and transcripts in the EU. Some sub-processors for billing and email are in the United States, or may reach data from there. They do not receive audio or transcripts. For such transfers we rely on the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses. If the customer is outside the EU, the standard contractual clauses (module 2, controller to processor) apply to the transfer between us as an addition, with Austrian law and the courts of Vienna.

If a person asks us for access, correction, deletion or another right about the customer's data, we forward the request to the customer and we do not answer it ourselves, unless the law says otherwise. We help the customer to answer such requests with suitable technical and organizational measures. The customer can delete stored content in the dashboard. If the customer needs more help, write to us. We may charge for work that is clearly more than a small effort.

We tell the customer without undue delay, and in any case within 48 hours, after we find out about a personal data breach that affects the customer's data. We send the notice to the organization owners. We give the information we have: what happened, which data it touches, the likely effects and the steps we take. We update the customer as we learn more. We help the customer to meet its own duties to notify the authority and the people concerned.

We help the customer with data protection impact assessments and with consultation of authorities, as far as they concern our processing and the customer cannot do them without our information.

We give the customer the information that is needed to show that we meet this agreement. The customer may audit us once a year, or after a personal data breach, if it gives 30 days' notice, keeps the audit reasonable in scope and time, protects our confidentiality and the data of other customers, and bears the cost. We may meet an audit request in the first place with current certificates, audit reports of our sub-processors or written answers.

The customer can export results and delete stored content in the dashboard at any time. Stored content is deleted automatically when the retention time ends. After the contract ends, we delete the remaining customer content within 30 days, and we delete it from backups on their normal cycle. We keep data only if the law requires it. We confirm deletion on request.

The liability rules of the terms of service apply to this agreement. If this agreement and the terms of service conflict on the processing of personal data, this agreement comes first. Austrian law governs this agreement. The courts of Vienna, Austria have exclusive jurisdiction, as far as the law allows.

We may update this agreement when the law changes or when our service changes. We give notice as the terms of service describe. The dashboard asks the customer to accept a new version.