Purpose and roles
This statement explains publicly how Memoris Clinical ("Memoris") processes clinical content on behalf of healthcare institutions ("Institution"). The Institution is the data controller, within the meaning of Turkish Law No. 6698 (KVKK) and the GDPR, of the documents uploaded to the service, the audio recordings and the outputs produced from them. Memoris is a processor acting only on the Institution's instructions. Where the service agreement and data processing addendum signed between the Institution and Memoris differ from this statement, the signed documents prevail.
Clinical content processed and data subjects
Clinical content means the PDF documents the Institution uploads; Dictate and Ambient audio recordings; their transcripts; translation, report and note drafts; and the Institution's terminology glossaries. This content may contain patients' identity and health data (special categories of personal data) as well as the identity and voice data of clinicians and staff. Data subjects are patients, people accompanying them, clinicians and Institution staff.
Purpose of processing and instructions
Memoris processes clinical content only to provide the services defined in the agreement: translation, speech recognition, structuring, verification and flagging, presenting results to the Institution and storing them for the period the Institution sets. The Institution's instructions consist of the service agreement and the processing commands given through the portal.
Memoris does not use clinical content for its own purposes, does not use it for model training without the Institution's written permission, and does not sell or lease it to third parties. If Memoris considers an instruction to be unlawful, it informs the Institution without delay.
Sub-processors
Memoris uses the following sub-processors to provide the service.
Netcup GmbH (Germany): server hosting and database; clinical content is stored on these servers.
Cloudflare (EU region): network and DNS, object storage, bot protection, email delivery and the gateway through which requests to model providers pass; gateway logging and caching are switched off on clinical routes.
OpenAI (United States): language model; producing translation drafts and structuring report and note drafts.
Deepgram (United States): speech recognition; transcribing Dictate and Ambient audio.
DeepL (Germany): machine translation; preliminary translation drafts.
Content is sent to OpenAI, Deepgram and DeepL only at processing time; once the result is returned, it is not retained by the provider and is not used to train the provider's models. These conditions are bound in writing with each provider. Adding or replacing a sub-processor is announced to Institution administrators by email at least 30 days in advance; the Institution may raise a reasoned objection within that period.
International transfers and the Institution's responsibility
Clinical content is stored in the European Union (Germany). During translation and speech recognition, content is transmitted, for the duration of processing only, to providers in the United States (OpenAI, Deepgram) and to DeepL in Germany.
Under KVKK Art. 9 and, where applicable, Chapter V of the GDPR, establishing the legal basis for these transfers, informing patients and obtaining the necessary consents is the responsibility of the Institution as controller. Memoris provides the information needed to establish that basis: the list of sub-processors and their countries, a data flow diagram, the data protection provisions of its provider agreements, and the technical details required for any filing the Institution makes with the Turkish Personal Data Protection Board. Memoris states clearly to the Institution which provider is used for which operation.
Security measures
Technical measures: TLS in transit; server-side encryption in object storage; a separate storage prefix per institution and tenant isolation in the database; server-side authorization of every request by institution, facility, product and action, with any undefined access denied by default; clinical responses excluded from browser and intermediate caches; no browser download links for audio recordings; access, deletion and permission changes written to an audit log.
Organizational measures: invitation-only accounts and role-based authorization; operational interfaces reachable only by a small number of authenticated staff; Memoris staff access to clinical content only to provide the service, only when needed and always logged; confidentiality obligations for staff; fictional data only in demo and test environments; no-retention and no-training terms with sub-processors.
Retention and deletion
Documents, transcripts and outputs are kept for the period the Institution sets. Ambient audio is permanently deleted the moment the note is approved, and in any case no later than 24 hours after recording. Dictate audio is kept for 30 days by default; the Institution may shorten this period. Deletion is carried out by a scheduled clean-up job, and every deletion is written to the audit log.
When the agreement ends, the Institution may request an export of its data within 30 days. At the end of that period all clinical content is permanently deleted and written confirmation is given to the Institution. No clinical content is retained by sub-processors.
Breach notification
When Memoris becomes aware of a personal data breach that affects, or is likely to affect, clinical content, it notifies the contact points designated by the Institution without undue delay and no later than 24 hours. The notification describes the nature of the breach, the categories of data and the estimated number of records affected, the likely consequences, the measures taken and recommended, and the contact point at Memoris; it is updated as information becomes clearer. Notifying the Turkish Personal Data Protection Board within 72 hours and notifying data subjects are the Institution's obligations; Memoris provides the information and support needed for them.
Audit and information requests
Once a year, or after a breach, the Institution may audit compliance with this statement or request information in writing, giving at least 15 days' written notice. Memoris provides a description of its security measures, the data protection provisions of its sub-processor agreements, the audit records belonging to the Institution and a data flow diagram. Audits are planned so that they give no access to other institutions' data or to Memoris trade secrets. Memoris does not yet hold a third-party certification such as ISO 27001; this statement will be updated when that changes.
Data subject requests
Patients and other data subjects exercise their rights under KVKK Art. 11 and the GDPR against the Institution. Requests of this kind that reach Memoris are forwarded to the Institution within 3 working days; Memoris does not answer them in its own name. On the Institution's instructions, Memoris provides technical support for fulfilling access, rectification, erasure and restriction requests.
Changes
When this statement is updated, the new version and its date are published on this page. Changes to the sub-processor, retention and security provisions are also announced to Institution administrators by email.