Security and data protection at NabuMed
What happens to your practice's conversations, transcripts and reports: where they are processed, who is involved and how we protect them. For your data protection impact assessment, your records of processing and your IT review.
Last updated:
At a glance
Patient data stays in the EU
By default, recordings and text are processed in the EU only. Services outside the EU become selectable only after your practice explicitly consents.
Operated in Germany
Servers, database and storage run at Hetzner in Germany, in an ISO 27001 certified data center.
Processing under Art. 28 GDPR
Your practice remains the controller; we process on its behalf. Our data processing agreement applies automatically with the contract; a signed copy is available on request.
No training on your data
NabuMed does not train AI models on your practice's recordings, transcripts or reports.
The clinician decides
NabuMed writes a draft. Your team always reviews, corrects and approves it.
Your data belongs to your practice
Sessions can be deleted at any time. After the contract ends you can export your data for three months; after that it is deleted completely.
Data residency: EU by default
Every recording travels encrypted to our servers in Germany. For transcription and documentation we use specialized AI services. Your practice decides which ones are used, within clear limits:
- Default for every practice: EU only. Without any further action, only services that process in the EU or on your own hardware are used. This applies to every feature, including reading translations aloud.
- Outside the EU only with documented consent. If your practice's administrator allows processing outside the EU, we record who agreed, when, and to which notice. The consent can be withdrawn at any time.
- Labelled in the application. Every model shows where it processes data. Models outside the permitted region are locked.
- On-premise available. For organizations, NabuMed can also run entirely on their own hardware.
Subprocessors
These companies process data of the application (app.nabu-med.ai) on NabuMed's behalf. We have data processing agreements with all of them. The list matches Annex 2 of our data processing agreement; we notify you 30 days in advance of any new or replaced subprocessor (DPA section 8.2). For the website, see our privacy policy.
Default: processing in the EUEU
These services process patient data in the EU only. They are the default for every practice; services marked "Selectable" are used only if your practice chooses them.
| Provider | Purpose | Processing | Company seat | Data | Use |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Data center: servers, database, sign-in service and recording storage; encrypted backups | Germany | Germany | All application data | Always |
| Microsoft (Azure) | Live transcription (Azure Speech) and documentation drafting (Azure AI Foundry) | Sweden (EU Data Zone) | USA (DPF) | Audio, transcripts | Always |
| Mistral AI SAS | Transcription of uploads and dictations, text recognition in uploaded documents | EU (France) | France | Audio, documents | Always |
| AssemblyAI, Inc. | Transcription (alternative speech recognition), run on Amazon Web Services | EU (Ireland) | USA | Audio | Selectable |
| Speechmatics Ltd | Transcription with speaker detection (alternative speech recognition) | EU | United Kingdom | Audio | Selectable |
| Gladia SAS | Transcription (alternative speech recognition) | EU | France | Audio | Selectable |
| pyannoteAI SAS | Speaker identification from voice profiles; only if your practice enables the feature and creates voice profiles with consent. Audio is kept by the provider for at most 48 hours. | EU | France | Audio, voice profiles (biometric) | Selectable |
Optional: outside the EU, only with your practice's consentOutside the EU
These services become selectable only after your practice's administrator explicitly allows processing outside the EU. The consent is recorded with a date and can be withdrawn at any time.
| Provider | Purpose | Processing | Company seat | Data | Use |
|---|---|---|---|---|---|
| Deepgram, Inc. | Transcription | USA | USA (SCC) | Audio | Opt-in only |
| ElevenLabs | Transcription; reading translations aloud | USA | USA (DPF) | Audio, translated text | Opt-in only |
| Microsoft (Azure, models without EU commitment) | Transcription with speaker separation (gpt-4o-transcribe-diarize, MAI-Transcribe) | USA or no location commitment | USA (DPF) | Audio | Opt-in only |
Account and billing (no patient data)No patient data
These services never receive recordings, transcripts or patient details, only the account and billing data listed.
| Provider | Purpose | Processing | Company seat | Data | Use |
|---|---|---|---|---|---|
| Twilio Inc. (SendGrid) | Sending application emails (invitations, password) | USA | USA | Name, email address | Always |
| Stripe | Processing subscription payments | Ireland, USA | Ireland, USA | Billing and payment data | Always |
"Processing" is where the data is processed; "Company seat" is where the company is registered. DPF: certified under the EU-US Data Privacy Framework. SCC: standard contractual clauses under Art. 46 GDPR.
Technical and organizational measures
A summary of the key measures. The full technical and organizational measures under Art. 32 GDPR are in Annex 1 of the data processing agreement.
- Encrypted transport. All connections between your devices, our servers and the AI services use TLS.
- Encrypted backups. Nightly backups are encrypted before they leave the server, stored in Nuremberg and deleted after 90 days. The restore procedure is documented in a runbook.
- Strict separation between practices. Each practice sees only its own data. For every practice-scoped interface, automated tests check that no other practice's data is reachable.
- Sign-in and roles. Central sign-in with two-factor authentication (TOTP) available. The practice assigns roles and manages its members itself.
- No patient data in logs. An automated check on every code change ensures that conversation content is never written to server logs.
- Logged support access. When our support team looks into an account at your request, the start and end of that access are logged.
- No tracking in the application. The application and the apps contain no advertising, no tracking and no third-party analytics.
AI and clinical control
- A draft, not a decision. NabuMed turns the conversation into a documentation draft. Your team reviews, corrects and approves it. There is no automated decision-making within the meaning of Art. 22 GDPR.
- Not a medical device. NabuMed is a documentation aid and is not intended for diagnosis or treatment decisions (Terms, section 5.4).
- Limits stated openly. AI output can be incomplete or wrong. That is why review by qualified staff is a fixed part of the workflow.
- Transparent model choice. The models in use are visible in the application. Your practice can restrict which models are allowed.
Your data, your decision
- GDPR roles. Your practice is the controller and NabuMed the processor (Terms, section 11.1). Patients contact the practice about their data.
- Audio is deleted automatically. Audio recordings are deleted after 90 days by default; your practice can change the period and archive individual recordings. Transcripts and reports remain until you delete them.
- Export and deletion when the contract ends. After the contract ends you can export your data for three months. After that we delete it completely (Terms, section 7.4).
- Patient consent. We provide a GDPR-compliant template for informing patients about recording the conversation.
Compliance overview
We distinguish clearly between what NabuMed does itself and what comes from our service providers.
| Topic | Status |
|---|---|
| GDPR and Austrian Data Protection Act | Data processing agreement under Art. 28 GDPR as part of the terms, applying with the contract; acceptance is recorded with date, person and version. Subprocessors under their own agreements (see above). |
| Health data (Art. 9 GDPR) | EU-only by default; transfers outside the EU only after the practice's documented consent. |
| ISO 27001 | Certification held by our data center operator, Hetzner Online GmbH. NabuMed itself is not ISO 27001 certified. |
| Medical Device Regulation (MDR) | Not a medical device; for documentation only (Terms, section 5.4). |
Documents
Public
On request
- A copy of the DPA signed by us
- Patient information and consent template
- Support for your data protection impact assessment
Found a security issue?
Please report possible vulnerabilities confidentially to support@nabu-med.at with the subject "Security". Describe how to reproduce the problem, do not access other people's data, and give us time to fix it before publishing details. Our security contact is also listed in our security.txt.
Report a vulnerability →