Audio
Audio is converted to text and not stored.
Privacy and security
Privacy and security
Therapy sessions contain some of the most sensitive data there is. Below you will find what is in place, what is in certification and which documents your CISO and DPO can request straight away.
Data flow
Transcript
The transcript is processed into a draft report.
Report
After your approval the report is stored.
Logging
Access and changes are logged in line with NEN 7513 and retained.
Agreements
Data processing agreement available as standard
Overview of sub-processors.
DPIA input for your own data protection impact assessment.
Your data is not used to train models.
Processed and stored in the Netherlands.
Information security
We have set up our policies and processes in line with NEN 7510-1:2024 and ISO/IEC 27001:2022. The certification audit has been scheduled. As soon as the certificate is issued, we will publish it here with its scope and validity.
Medical device
Notal Care's clinical modules are going through certification as a medical device under the MDR, class IIa. Expected completion: third quarter of 2027. Until then these modules are not available for clinical use. The core functions for documentation and record building do not fall under the MDR and are available now.
EU AI Act
As a certified medical device, the clinical modules fall under the requirements for high-risk AI systems. We are preparing for this in parallel with the MDR process.
Division of roles
Your organisation is the data controller; Notal Care is the processor. You decide who has access; we provide the evidence you need for NEN 7510, the Dutch Cybersecurity Act (Cyberbeveiligingswet) and your internal audits.
You can read more about the status per standard under certification and regulation.
Document pack
Data processing agreement
Based on Article 28 GDPR.
RequestList of sub-processors
Which parties process data, and where.
RequestData flow diagram
From audio to approved report.
RequestDPIA input
For your own data protection impact assessment.
RequestSecurity policy and Statement of Applicability
Set up in line with NEN 7510 and ISO/IEC 27001.
RequestAudit schedule
When each audit takes place.
RequestMDR status statement
Status of the clinical modules, class IIa.
RequestClient information
What happens to the session, for your clients.
RequestFrequently asked questions
Is the session stored?
The audio is not. The transcript is.
Is Notal Care certified to NEN 7510 or ISO 27001?
We work in line with both standards.
Is Notal Care a medical device?
Partly. The core for documentation and record building is not. The clinical modules are being certified as a class IIa medical device; they will become available after CE marking, expected in the third quarter of 2027.
Your CISO and DPO at the table?
Schedule a 30-minute demo. We will answer questions about privacy, security, MDR and EHR.