Data ownership
- Customers retain their content
- Processing follows instructions
How customer data is handled
The essentials behind every conversation.
Retention & deletion
- Retention depends on purpose
- Customer agreements matter
Privacy rights
- Rights depend on applicable law
- Requests may require verification
International processing
- Processing may cross borders
- Transfer mechanisms vary
Policies & resources
View all policiesReviewing a healthcare deployment?
PHI use requires agreed applicable services and any required executed BAA.
Compliance & frameworks
Explore the frameworks referenced by Persistence and the scope relevant to your deployment.
SOC 2An assurance framework for service organizations. Report scope and assessment period determine applicability.
SOC 2 addresses assurance for service organizations. The relevant report identifies the services covered, assessment period and findings.
ISO 27001A management-system standard. Certificate validity and covered services determine its scope.
ISO 27001 addresses management of information. Certificate validity, issuing body and covered services determine applicability.
ISO 42001A management-system standard for artificial intelligence.
ISO 42001 addresses management systems for AI. The organization, systems and activities covered by an assessment define its scope.
CSA STARA cloud assurance program and public registry.
CSA STAR is a cloud assurance program and registry. Any listing should be evaluated for its level, scope and current status.
PCI DSSAn industry standard for handling payment-card data.
PCI DSS concerns payment-card data. Applicability depends on whether payment information is stored, processed or transmitted and the payment arrangement.
FedRAMPA US federal cloud-services assessment and authorization program.
FedRAMP is a US federal assessment and authorization program. Refer to the relevant authorization and service boundary when evaluating applicability.
HIPAAPHI use requires agreed applicable services and any required executed BAA.
Use involving PHI requires agreed applicable services and any required executed BAA. The customer’s configuration and use must also be appropriate.
GDPRRights and obligations depend on the processing, jurisdiction and each organization’s role.
Rights and obligations depend on the processing, jurisdiction and roles of the organizations involved. The Privacy Policy and applicable agreement describe the arrangement.
EU AI ActEuropean rules for AI systems; applicability depends on the system and the organization’s role.
The EU AI Act concerns AI systems and their uses. Obligations depend on the organization’s role, system classification and applicable requirements.
Policies & legal documents
Read a short summary here, then open the full policy when you need the detail.
Personal information
Privacy Policy
How personal information is collected, used and handled.
What this covers
Covers processing roles, retention, international transfers and rights that may apply to your information.
Public policyRead policy
Customer agreement
Terms & Conditions
Terms for access to the platform and use of the services.
What this covers
Explains customer content, permitted service use and responsibilities, including notices and permissions for calls and recordings.
Public policyRead policy
Website & platform
Cookie Policy
Cookies, browser storage and available preferences.
What this covers
Covers necessary, functional, analytics, visitor communications and third-party technologies across the website, dashboard and authentication services.
Public policyRead policy
Privacy requests
Data Deletion
Guidance for information you want removed.
What this covers
Detailed instructions on the public deletion page are being prepared. Requests depend on processing roles, applicable law and retention obligations.
Guidance in preparationRead policy
No matching policies. Try privacy, cookies or deletion.
Data privacy
Browse the topics that matter to your deployment. Each summary links to its governing policy.
Data ownership
Customers retain their content
Customers retain their rights in prompts, knowledge, audio, recordings and transcripts, subject to service permissions.
Processing follows instructions
Customer data processed on a customer’s behalf follows documented instructions and the applicable agreement.
Service permissions have defined purposes
The Terms describe permitted uses, including delivering services, support, legal obligations and expressly agreed rights.
Retention & deletion
Retention depends on purpose
Retention reflects the purpose, the agreement and applicable legal obligations.
Customer agreements matter
Customer-data handling also depends on the DPA and documented instructions.
Deletion has exceptions
Data may be deleted or anonymized when no longer needed, subject to lawful retention requirements.
Privacy rights
Rights depend on applicable law
Available rights may include access, correction, deletion, restriction, objection and portability.
Requests may require verification
Identity and representative authority may need to be verified before fulfillment.
The responsible organization matters
A business whose agent handled a call may be responsible for the request.
International processing
Processing may cross borders
Personal information may be processed outside the country where it was collected.
Transfer mechanisms vary
Required mechanisms depend on applicable law and the arrangement; they may include contractual safeguards.
Location is deployment-specific
Confirm location and transfer terms in the applicable agreement rather than assuming one universal location.
Calls & AI
Customers configure the agent
Customers set prompts, knowledge, workflows, integrations and permitted actions for their use case.
Call permissions are required
Customers must obtain legally required notices, consents and permissions for calling, recording and transcription.
Human judgment remains important
AI outputs can be inaccurate. Customers must evaluate suitability and provide human review where required.
Health data
PHI requires an agreed arrangement
Protected health information may be used only with agreed applicable services and any required executed BAA.
A framework does not cover every use
A healthcare deployment must be assessed in the context of its configuration, agreements and actual use.
Agreements
Understand the documents that may apply to your deployment. Availability and execution depend on your arrangement.
Need an agreement for your deployment?
Contact sales to discuss the DPA, BAA, service terms or transfer documentation that applies.
| Document | What it covers |
|---|---|
| Terms & ConditionsService terms | Access to services, customer content and responsibilities. A separate written agreement may govern specific matters. |
| Data Processing AgreementDPA | Agreed terms for processing personal data on a customer’s behalf. |
| Business Associate AgreementBAA | Applicable obligations for a healthcare arrangement involving PHI. Agreed services and any required executed BAA are prerequisites. |
| Customer agreementMSA / Order form | Purchased services and commercial or deployment-specific terms. |
| International transfer termsFor example, SCCs | A transfer mechanism where required under applicable law; the mechanism depends on the processing involved. |
Persistence’s role
Provide services under the applicable terms and follow agreed customer-processing instructions.
Your organization’s role
Establish lawful use, provide required notices and obtain permissions for calls and recording.
Frequently asked questions
A few important distinctions about compliance and data handling.
What do the framework references mean?
They identify frameworks referenced by Persistence. Applicable reports, assessment status and certificate scope need to be evaluated from supporting documentation. A framework reference alone is not evidence of certification.
Is every healthcare deployment covered?
No. PHI use requires agreed applicable services and any required executed BAA. Customer configuration and use also matter.
Does this page guarantee a data location?
No. The Privacy Policy allows international processing. Deployment-specific locations and transfer arrangements depend on the applicable documents.
Does account deletion remove every record immediately?
Not necessarily. The information involved, applicable agreement and legal retention obligations determine how deletion is handled.
Which document governs?
The published policies and applicable signed agreements govern. This center provides summaries for reading convenience.
No matching questions.