Privacy policy

This Policy covers our websites and Services. It should be read with our Terms of Service, Data Processing Addendum (DPA), any study-specific notice and our separate Cookie Policy.

1. Who is responsible

The contracting entity is exactly the independent Virtuosis company identified when you sign up, order or join a study: Virtuosis Artificial Intelligence SA or its affiliates, including but not limited to Virtuosis Health SAS.

For our websites, Virtuosis Artificial Intelligence SA is controller. For direct individual use, the contracting entity is controller. If an organization or study sponsor provides the Service, it normally decides why and how Service data is used and is controller; the contracting entity processes that data for it under the DPA. The contracting entity remains controller for its own accounts, billing, security, legal compliance and business contacts.

For people in the EU, Virtuosis Health SAS is the GDPR Article 27 representative of Virtuosis Artificial Intelligence SA. The legal manufacturer named in the product documentation is controller for its regulatory, vigilance and complaint records. Data Protection Officer and privacy contact: privacy[at]virtuosis.ch.

2. Data we process

• Website and device: IP address, browser, device, language, pages, timestamps, identifiers and logs.

• Account and transactions: name, contact and organization details, user ID, settings, contract, subscription, payment and support records.

• Service data: audio, speech and derived features, metadata, questionnaires, notes, health or wellbeing information, inferences, scores, reports and other submitted content.

Data comes from you, the organization or study that gives you access, connected services, our providers and lawful public or business sources. Study-specific data and conditions are described in the participant notice. Voice is biometric data only if technically processed to identify or authenticate a person; we do not do this unless expressly agreed.

3. Why and on what basis

As controller, we process data to provide and support the requested Service or contract; secure, administer and improve it; manage accounts and payments; communicate with you; comply with law and medical-device obligations; and establish or defend claims. We rely on contract for the Service, accounts and payments; legal obligation for legal and medical-device compliance; legitimate interests that do not override your rights, for security, administration, improvement and claims; and consent where stated below. We use consent for non-essential cookies and marketing where required. Health or other sensitive data is processed only with an applicable condition such as explicit consent for direct individual use, healthcare, scientific research or another condition permitted by law.

We do not sell personal data. We do not use identifiable customer Service data to train models without written authorization and a lawful basis. Properly anonymized data is not personal data; pseudonymized data remains protected.

4. Sharing and locations

We disclose only what is needed to the relevant organization and authorized users; contracted service providers; professional advisers; authorized research partners under the study documents; authorities where legally required; and a successor in a lawful transaction. Technical providers used to deliver the Services are listed in Section 6 of our DPA. Where used for direct consumer Services, they act as our processors.

We also use service providers for website hosting, customer relationship management and email communications. Production Service data is hosted in Azure West Europe (Netherlands). Backups, if enabled, remain in the EEA and within the applicable HDS scope. Transfers to a destination without adequate protection use applicable standard contractual clauses or another lawful safeguard; a copy may be requested from privacy[at]virtuosis.ch, subject to necessary redactions.

5. Retention

Unless configured, agreed or legally required otherwise, raw audio is deleted after processing. Other Service data is kept for the period shown in the Service, order, study notice or controller instruction. After the Service ends, data remains available for export for up to 30 days unless another period is agreed, then is deleted; protected backup copies are removed on their normal cycle. Contract, payment, security, regulatory and dispute records are kept for applicable legal periods. Anonymized data may be kept without time limit.

6. Cookies

We place non-essential cookies or similar technologies only after the consent required by law. Details and controls are in our separate Cookie Policy and cookie-settings tool. You may withdraw consent at any time without affecting earlier processing.

7. Security and health-data hosting

We use proportionate technical and organizational measures, including restricted access, confidentiality, encryption where appropriate, logging, resilience and incident procedures. Where French HDS rules apply, relevant data is hosted using Azure services within the scope of Microsoft’s HDS certification.

8. Outputs, choices and required data

Medical Features must be used for their documented intended purpose and with appropriate professional review; Wellbeing Features are not diagnosis or treatment. We do not make decisions producing legal or similarly significant effects solely by automated means unless the law permits this and required safeguards apply. Data marked as required is needed to create an account, provide the selected feature, meet safety duties or perform the contract; without it, that use may be unavailable.

9. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent. If an organization or study controls your Service data, contact it first; we will assist it. Contact privacy[at]virtuosis.ch. We may verify identity. You may complain to the competent authority, including the authority where you live or work, the Swiss FDPIC, or the French CNIL if applicable.

10. Children and changes

A person below the legal age of majority may use a Service only through or with a parent or legal representative, and only where that Service or study is intended for minors and required permissions and approvals are in place. We may update this Policy and will show the new date; material changes will be notified where required.

Last updated: 18 September 2026