VoxDocs
Data Processing Addendum
Effective date: 01 August 2026
Last updated: 01 August 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between Codestax Pty Ltd (“Codestax”, “we”, “us” or “our”) and the Customer using VoxDocs.
This DPA applies where Codestax processes personal information on behalf of the Customer in providing VoxDocs.
1. Purpose of this DPA
VoxDocs is a healthcare documentation and workflow platform and may process personal information, including sensitive health information, on behalf of healthcare professionals and organisations.
This DPA describes the responsibilities of the Customer and Codestax when Codestax processes that information on the Customer's behalf.
This DPA supplements the VoxDocs Terms of Service and any applicable order, proposal or other agreement between the parties.
2. Definitions
In this DPA:
Customer Content means information provided to or created through VoxDocs by or on behalf of the Customer, including audio, transcripts, patient or client information, clinical notes, letters, reports, documents, templates and other information.
Customer Personal Information means personal information contained in Customer Content that Codestax processes on behalf of the Customer in providing VoxDocs.
Privacy Laws means privacy and data protection laws applicable to the processing covered by this DPA.
Security Incident means unauthorised access to, disclosure of, loss of or other compromise of Customer Personal Information that requires investigation or response under applicable Privacy Laws.
Subprocessor means a third party engaged by Codestax to process Customer Personal Information on behalf of Codestax in providing the Service.
3. Roles of the Parties
The Customer determines the purposes for which Customer Personal Information is collected and processed through VoxDocs and is responsible for its instructions to Codestax.
Codestax processes Customer Personal Information to provide VoxDocs and related services in accordance with the Customer's instructions, the applicable agreement and applicable law.
Each party remains responsible for complying with the Privacy Laws that apply to its own activities.
4. Customer Responsibilities
The Customer is responsible for:
- having an appropriate legal basis, authority or consent for collecting and processing Customer Personal Information;
- providing any privacy notices required by applicable law;
- obtaining any consent or authority required for recording consultations, dictations or other interactions;
- ensuring its instructions to Codestax comply with applicable law;
- managing and reviewing access granted to its users, bureaus, administrators and other authorised parties; and
- meeting its professional, legal and organisational clinical record-keeping obligations.
5. Codestax Responsibilities
Codestax will:
- process Customer Personal Information for the purpose of providing, securing, maintaining and supporting VoxDocs and otherwise in accordance with the Customer's documented instructions;
- limit access to Customer Personal Information to people and systems that reasonably require access for those purposes;
- require personnel with access to Customer Personal Information to be subject to appropriate confidentiality obligations;
- take reasonable technical and organisational measures appropriate to the nature and sensitivity of the information and associated risks;
- assist the Customer as reasonably necessary with privacy and security obligations relating to the processing performed by Codestax; and
- comply with applicable Privacy Laws in relation to its processing activities.
6. Processing Instructions
The Customer instructs Codestax to process Customer Personal Information as reasonably necessary to provide VoxDocs and the functionality selected or requested by the Customer.
This includes processing required for transcription, document preparation, workflow, storage, collaboration, security, support and related functionality.
If Codestax reasonably believes an instruction would cause it to breach applicable law, we may notify the Customer and suspend the affected processing while the parties address the issue.
7. Artificial Intelligence and Model Training
Customer Personal Information may be processed using artificial intelligence and automated technologies where required to provide VoxDocs functionality.
Codestax does not use patient or clinical Customer Content to train artificial intelligence models.
Codestax may use technical, operational, aggregated or appropriately de-identified information to operate, secure, maintain, analyse and improve VoxDocs.
8. Audio and Raw Transcripts
Audio recordings and raw transcripts are temporary processing materials.
They are automatically deleted when no longer reasonably required for processing, support or recovery and, in all cases, within 7 days.
Clinical notes, letters, reports and other documentation created using those materials may be retained separately according to the Customer's instructions, settings and applicable agreement.
9. Security
Codestax will maintain reasonable technical and organisational measures designed to protect Customer Personal Information against unauthorised access, loss, misuse, interference, alteration or disclosure.
Measures will be appropriate to the nature and sensitivity of the information, the way VoxDocs is used and the risks associated with the processing.
Security measures may evolve as technologies, risks and the Service change.
10. Confidentiality
Codestax will ensure that personnel authorised to access Customer Personal Information are subject to appropriate confidentiality obligations.
Customer Personal Information will only be accessed where reasonably necessary to provide, secure or support the Service or where required by law.
11. Subprocessors
The Customer authorises Codestax to engage Subprocessors where reasonably necessary to provide VoxDocs.
Codestax will take reasonable steps to ensure that Subprocessors processing Customer Personal Information are subject to privacy, confidentiality and security obligations appropriate to the services they provide.
Codestax remains responsible for managing its Subprocessors in accordance with this DPA and applicable Privacy Laws.
Information about relevant Subprocessors may be made available to Customers on request or through VoxDocs documentation.
12. Overseas Processing
The Customer acknowledges that some Subprocessors may process Customer Personal Information outside Australia.
Codestax will take reasonable steps required by applicable Privacy Laws in relation to overseas processing or disclosure of Customer Personal Information.
Where a Customer requires specific data-location arrangements, these may be agreed separately in writing.
13. Security Incidents
Codestax will investigate suspected Security Incidents involving Customer Personal Information.
Where Codestax becomes aware of a confirmed Security Incident affecting Customer Personal Information, we will notify the affected Customer without unreasonable delay where notification is required or reasonably necessary to allow the Customer to meet its obligations.
We will provide information reasonably available to us about the nature of the incident, the information affected, actions taken or proposed and other information reasonably required for the Customer's response.
Codestax may provide information in stages as the investigation progresses.
Notification of a Security Incident does not constitute an admission of fault or liability.
14. Privacy Requests
If Codestax receives a request from an individual relating to Customer Personal Information that we process on behalf of a Customer, we may refer the individual to the relevant Customer.
Taking into account the nature of the processing and the functionality available through VoxDocs, Codestax will provide reasonable assistance to the Customer in responding to requests relating to access, correction, deletion or other applicable privacy rights.
15. Privacy and Regulatory Assistance
Codestax will provide reasonable assistance to the Customer where information about our processing is required for a privacy assessment, regulatory enquiry or similar compliance activity relating to VoxDocs.
The scope of assistance will take into account the nature of the request, the information available to Codestax and whether the requested information can reasonably be provided without compromising the security or confidentiality of VoxDocs or another customer.
16. Return and Deletion
During the term of the Service, Customers may access, export or delete Customer Content using available VoxDocs functionality.
Following termination or closure of an account, Codestax will delete or return Customer Personal Information in accordance with the applicable agreement, Customer instructions, applicable retention arrangements and legal requirements.
Information may remain for a limited period in backups, logs or recovery systems before being removed through normal deletion and backup cycles, provided it remains protected and is not used for other purposes.
Codestax may retain information where required by law or where reasonably necessary to establish, exercise or defend legal rights.
17. Audits and Information
On reasonable request, Codestax will provide information reasonably necessary to demonstrate compliance with this DPA.
Where a Customer reasonably requires additional assurance, the parties will work together in good faith to determine an appropriate method of providing that assurance while protecting the security, confidentiality and operations of VoxDocs and other customers.
Any on-site or intrusive audit must be reasonably necessary, agreed in advance and conducted in a way that minimises disruption and does not compromise the confidentiality or security of other customers or systems.
18. Priority and Changes
If this DPA conflicts with the VoxDocs Terms of Service regarding the processing or protection of Customer Personal Information, this DPA prevails to the extent of that conflict.
Any separately agreed data processing terms between Codestax and a Customer may modify or replace this DPA for that Customer.
We may update this DPA to reflect changes to VoxDocs, our processing practices or applicable laws.
Where a change materially affects the Customer's rights or our obligations relating to Customer Personal Information, we will provide reasonable notice where appropriate.
19. Governing Law
This DPA is governed by the same law and jurisdiction that apply to the agreement between Codestax and the Customer unless applicable Privacy Laws require otherwise.
20. Contact
Codestax Pty Ltd
Western Australia, Australia
Email: support@voxdocshealth.com
Postal: PO Box 274, Karrinyup WA 6921, Australia