Terms of Service

Vocca operates in France and in the United States. Where the applicable rules differ between the two, both are set out side by side under the headings France and the European Union and United States.

1. Purpose

These Terms of Service (the “Terms”) set out the conditions under which Vocca makes available its website and its voice assistant and patient communication platform (together, the “Services”).

They apply to website visitors, to healthcare organization customers (“Practices”), and to patients receiving communications sent through the platform.

For Practices, the subscription agreement and the data protection agreement take precedence over these Terms in the event of conflict. That agreement is a data processing agreement (DPA) under the GDPR for Practices in France and the European Union, and a Business Associate Agreement (BAA) under HIPAA for Practices in the United States.

2. Publisher

Vocca is a French société par actions simplifiée, registered in Paris under number 931 119 150. Registered office: 7 rue Mariotte, 75017 Paris, France. VAT: FR59 931 119 150. Contact: contact@vocca.com.

Vocca contracts with Practices in both France and the United States through this entity, unless the subscription agreement names another.

3. Definitions

Platform: the software enabling voice calls, appointment management and patient communications.

Message: any communication sent to a patient by SMS, voice or email.

Automated message: a communication triggered by the Platform without individual human intervention.

Personal data: information relating to an identified or identifiable natural person.

Protected Health Information (PHI): personal health information as defined by HIPAA. Applies to the United States.

Health data: data concerning health within the meaning of article 9 GDPR. Applies to France and the European Union.

4. Acceptance

Using the Services constitutes full acceptance of these Terms. If you do not accept them, you must discontinue use of the Services.

5. Access to the Services

5.1 Website

The website is freely accessible. Vocca reserves the right to change its content, structure and features at any time, without notice.

5.2 Platform

Access to the Platform is reserved for holders of a valid subscription and for the users they authorize. Practices manage their users’ permissions and are responsible for the confidentiality of credentials.

Vocca may suspend access in the event of a security breach, use that does not comply with these Terms, or non-payment, after informing the Practice except in an emergency.

5.3 Availability

Vocca uses reasonable efforts to keep the Services available. The Services may be temporarily interrupted for maintenance, for updates, or as a result of an event beyond Vocca’s control.

6. Communications sent to patients: SMS and messaging

6.1 Nature of Messages

Messages relate exclusively to patient care, including:

• appointment confirmations and reminders;
• changes, rescheduling or cancellations;
• practical information and preparation instructions;
• follow-up on patient requests;
• reminders for recommended examinations.

No promotional, advertising or marketing Message is sent to Patients through the Platform. Vocca does not use the Platform to promote its own products or services to Patients, nor to do so on behalf of third parties.

The Platform is not used for bulk or campaign-based messaging. Each Message is generated for one Patient, in connection with that Patient’s own appointment or their own request, within the existing care relationship between the Patient and the Practice. Patients are not added to marketing lists, and no Message is sent to a Patient with whom the Practice has no care relationship.

6.2 Respective roles

The Practice determines the purposes and means of the processing. Vocca acts on the Practice’s documented instructions.

France and the European Union

The Practice acts as data controller and Vocca as processor, under the DPA entered into between the parties pursuant to article 28 GDPR. The Practice obtains patient consent and establishes the legal basis where required.

United States

The Practice acts as Covered Entity and Vocca as Business Associate, under the BAA entered into between the parties. The Practice is responsible for its own obligations under HIPAA, including its notice of privacy practices, and for compliance with the TCPA in respect of the Messages it causes to be sent.

6.3 Consent and enrollment

A Patient’s mobile telephone number is provided by the Patient to the Practice in the course of their care, or is held in the administrative record kept by the Practice. It is never purchased, rented, or obtained from a third party.

The Patient’s consent is given when they provide their number for the management of their appointments.

United States

Messages sent through the Platform are transactional and care-related. Sending is carried out in accordance with the Telephone Consumer Protection Act (TCPA) and with the 10DLC registration requirements applicable to application-to-person messaging on U.S. carrier networks. The Practice is registered as the message originator.

6.4 Message frequency

Frequency varies according to the activity of the Practice and the Patient’s appointments. No minimum or maximum volume is guaranteed.

6.5 Opting out

Messages are sent within an existing care relationship, at a number the Patient has given to the Practice for the management of their appointments.

A Patient may ask at any time to stop receiving Messages, either by replying to a Message or by contacting the Practice directly. No charge applies to such a request, and it is acted on by the Practice.

Opting out of Messages does not affect the Patient’s care by the Practice, but may mean they no longer receive appointment reminders.

6.6 Costs

Neither Vocca nor the Practice charges the Patient any fee for receiving a Message. Message and data rates set by the Patient’s own carrier may apply.

6.7 Confidentiality of mobile information

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

Mobile information is disclosed only to the technical providers necessary for message delivery — telecommunications carriers and messaging platform providers — acting as processors or subcontractors without any right to use the data for their own purposes.

Text messaging originator opt-in data and consent are not shared with any third party.

7. User obligations

Users shall not:

• use the Services for unlawful or fraudulent purposes, or for purposes contrary to public policy;
• gain unauthorized access to the Services, circumvent security measures, or disrupt their operation;
• extract or reuse content beyond what is expressly permitted;
• send promotional communications through the Platform;
• breach applicable electronic communications law, including, in the United States, the TCPA and carrier 10DLC rules, and, in France and the European Union, the Post and Electronic Communications Code and the ePrivacy rules.

The Practice shall indemnify Vocca against any third-party claim arising from its breach of this section.

8. Intellectual property

All elements making up the Services, namely text, images, video, logos, graphics, layout, code, databases and trademarks, are the exclusive property of Vocca or are licensed to it.

A subscription grants the Practice a personal, non-exclusive, non-transferable right of use, for its internal needs only, for the duration of the subscription.

Unauthorized use constitutes infringement under French law and trademark or copyright infringement under U.S. law.

9. Personal data

The processing of personal data is governed by the Privacy Policy, which forms an integral part of these Terms.

France and the European Union

Data of European customers is hosted in the European Union, with providers holding HDS certification (Hébergeur de Données de Santé) as required by article L. 1111-8 of the French Public Health Code. Processing is governed by the GDPR and by the DPA entered into with the Practice.

United States

Data of U.S. customers is hosted in the United States, with providers bound as subcontractors under Business Associate Agreements. Processing of PHI is governed by HIPAA and by the BAA entered into with the Practice.

Certain corporate, support and engineering functions are carried out from France, which may involve access to U.S. customer data from outside the United States, under the safeguards described in the Privacy Policy.

Data protection enquiries: dpo@vocca.com

10. Security

Vocca implements appropriate technical and organizational measures to protect the Services and the data they process: encryption of communications in transit and of data at rest, access control and strong authentication, access logging, regular review of permissions, and periodic penetration testing by an external firm.

The Practice must report any security incident affecting the Services to Vocca without delay.

Breach notification follows the timeframes set out in the Privacy Policy: 72 hours to the CNIL where the GDPR applies, and 60 days to the Covered Entity under the HIPAA Breach Notification Rule.

11. Liability

Vocca is bound by an obligation of means (obligation de moyens) in the provision of the Services.

Vocca is not liable for:

• clinical decisions, which remain the sole responsibility of the Practice and its practitioners;
• the accuracy of information entered by the Practice or communicated by a Patient;
• unavailability of telecommunications networks;
• malfunctions in third-party software;
• non-receipt of a Message due to the Patient’s carrier, handset or plan.

The Practice’s liability is governed by the subscription agreement.

Nothing in these Terms limits Vocca’s liability for gross negligence or willful misconduct, for personal injury, or in any case where the law prohibits such limitation.

12. Links and third-party services

The Services may link to third-party websites or interface with third-party services, including scheduling and practice management software. Vocca exercises no control over those sites and services and accepts no responsibility for their content or operation.

13. Changes to the Terms

Vocca may amend these Terms at any time. The version that applies is the one published on the website at the time the Services are used.

Substantial changes affecting the rights of Practices are notified in advance, in accordance with the subscription agreement.

14. Governing law and jurisdiction

These Terms are governed by French law.

Any dispute falls within the exclusive jurisdiction of the courts within the jurisdiction of the Paris Court of Appeal, subject to any mandatory rules of jurisdiction applicable to consumers.

For Practices, the governing law and the competent courts for the contractual relationship are those set out in the subscription agreement, which may designate a different law and forum — in particular for Practices established in the United States.

15. Contact

VOCCA, 7 rue Mariotte, 75017 Paris, France

General enquiries: contact@vocca.com

Data protection: dpo@vocca.com