Privacy policy

Vounded is a service of Inevitable Software: an artificial intelligence application that lets care home professionals record care information by voice and add it, already structured, to the management system the care home normally uses.

For any question about data protection you can write to us at antonio@vounded.com.

This policy is addressed to the users of the app: the care professionals who record information by voice. We distinguish between two situations:

• With regard to your account data, your use of the app and diagnostic data, Vounded acts as data controller.
• With regard to residents’ clinical content (what you dictate and is structured in their record), Vounded acts as data processor on behalf of the care home, which is the controller of that data and whose instructions we follow.

• Name and email, as the login credentials for your account. Accounts are created by the care home: the app does not allow self-registration.
• Voice audio: the recording you dictate, together with the transcription and the note generated from it.
• User identifier, linked to the audit log to ensure traceability.
• Usage and interaction data from the app (product analytics), to understand how it is used and improve it. It does not include any resident information.
• Diagnostic data: error reports (crash logs) and performance metrics.

The microphone is the only sensitive permission the app asks for, and it is requested when you start recording, not when you open the app. We do not access your camera, location, contacts or photos.

When a professional dictates a note, the information goes through these steps:

1. The audio is uploaded, encrypted, to our storage in the Spain region.
2. It is sent to an EU-based transcription provider, which returns the text and deletes the audio and the transcription from its servers immediately afterwards.
3. The transcription is sent to an EU-based language model provider to structure it into the fields of the care record. For the short dictation used to identify the resident, the list of names at the care home is also sent, to improve recognition; that audio is deleted as soon as the text has been obtained.
4. The professional reviews, corrects and signs the note. If it is not signed, nothing is recorded. Once signed, it is transferred to the care home’s management system, which becomes the record of reference.

We process this data to provide the service (voice-based care recording and its transfer to the management system), to ensure security and traceability through the audit log, and to improve the stability and quality of the product. We do not use it for advertising, and we do not sell it or share it with third parties for commercial purposes.

• Account data and credentials: performance of the contract between us and your care home (Art. 6(1)(b) GDPR).
• Residents’ clinical content (health data): processed on behalf of the care home and under its instructions, on the basis of the management of health and social care (Art. 9(2)(h) GDPR).
• Usage analytics and diagnostic data: our legitimate interest in keeping the service secure, stable and improving (Art. 6(1)(f) GDPR).

We design and operate the service in accordance with the GDPR (Regulation (EU) 2016/679), the Spanish Data Protection Act (LOPDGDD, Organic Law 3/2018), Spanish Law 41/2002 on patient autonomy and the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). Our solution operates as an administrative support system under full human oversight.

We work with a small number of top-tier providers. All of them are bound by data processing agreements (DPAs) that require them to apply a level of protection equivalent to our own:

Primary storage is located in the Amazon Web Services Spain (Madrid) region. All clinical content — audio, transcriptions and notes — is stored and processed exclusively within the European Union.

We apply data minimisation by design: we keep information for as short a time as possible, and the care home’s management system is the record of reference.

• Each care home sets the retention period in its contract for the audio and clinical text we hold, and can change it at any time from its dashboard. The default is 7 days. Once that period has passed, a daily automated process deletes them.
• Transcriptions are deleted from the provider’s servers as soon as it returns the text. On our servers they are kept for the same period and then deleted together with the rest of the note’s text.
• After deletion, we keep only the record metadata — dates, status, who made the record and which resident it concerns — and the values of the observations recorded, which are needed for traceability. The free text, transcription, audio and the resident’s name are removed.
• The audit log stores only metadata — who, when, which resident and for what purpose — and a cryptographic fingerprint (hash); never the audio or the transcription text.
• Encrypted backups are kept for 30 days and are overwritten on rotation.

None of our providers uses the data we process to train their artificial intelligence models; this is set out in the agreements signed with each of them.

• Encryption of information in transit (TLS) and at rest (AES-256).
• Restricted access. In the care home’s dashboard, every time a clinical audio recording is played it is logged in the audit log.
• Authorised Vounded staff may access the information only to provide support and maintain the service, under a duty of confidentiality and in accordance with the contract signed with the care home.
• Security breach notification procedures in accordance with Art. 33 GDPR.

Artificial intelligence always plays a supporting role: it suggests, but never decides. A professional reviews, validates and signs the information before it is recorded. This is how we guarantee the right not to be subject to decisions based solely on automated processing (Art. 22 GDPR).

You can exercise your rights of access, rectification, erasure, objection and portability by writing to antonio@vounded.com. We will respond to your request within the time limits set by law.

Deleting your account. Because accounts are created and managed by the care home, you can request deletion from the care home’s management or directly at antonio@vounded.com. Deleting an account also deletes the pending recordings and notes linked to it. Information already recorded in the care home’s management system is governed by that system’s policies, for which the care home is responsible.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.

We may update this policy to reflect changes to the service or to the regulations. We will always show the date of the last update at the beginning of the document.