GDPR and HIPAA-Ready Notice for
AudioCodes Voca Solution
The AudioCodes Voca solution provide healthcare customers with services that are ready toaccept Protected Health Information (PHI), referring to these services as Health Insurance
Portability and Accountability Act (HIPAA)-Ready Services.
AudioCodes Voca solutions provide customers with services that are ready to accept Personal
Identifiable Information (PII), referring to these services as General Data Protection
Regulation (GDPR)-Ready Services.
AudioCodes provides all the necessary tools for the customer/administrator to be GDPR andHIPAA Compliant. The purpose of this document is to detail the different tools which help thecustomer remain compliant. GDPR/HIPAA aspects that are not listed in this document are notrelevant to the Voca product operation.

1Overview and Definitions
GDPR defines ‘personal data’ as any information related to an identifiable person. This person
may be identified directly (i.e., by name) or indirectly through any other identifier that is
unique to that person.
The HIPAA privacy rule defines all individually identifiable health information that is held ortransmitted.

1.1

Call Information
Voca optionally collects and stores call-related information.
Call data includes the following information which may be used to identify a person:◼

Caller phone number◼

Called phone number◼

Call start time◼

Call end time◼

Duration of the call◼

Audio recordings of the caller’s interaction with Voca

LTRT-28976

P a g e |1

AudioCodes Inc.

International Headquarters

Contact

200 Cottontail Lane Suite A101E
Somerset NJ 08873
Tel: +1-732-469-0880 Fax: +1-732-469-2298

1 Hayarden Street, Airport City, Lod 7019900
P.O. Box 255, Ben Gurion Airport, Israel 7019900
Tel: +972-3-976-4000 Fax: +972-3-976-4040

https://www.audiocodes.com/contact

Websitehttps://www.audiocodes.com

1.1.1

Call Information Retention Period
If the customer decides to store the call information, the retention period needs to beconfigured. The Call information retention period will be configured during the setup phase.

1.2

User Information
The Voca system can be configured to connect to the Active Directory using the LDAPs
protocol to retrieve the organization’s contacts information, into the Voca database. This
information is collected in accordance with the service and may vary depending on theactivity. The organization contacts’ data may include the following information:

1.2.1

◼

First and last name◼

Job title◼

Phone numbers◼

Mobile Phone number◼

Email addresses◼

Department

User Information Retention Period
The user information retention period will be as long as the customer uses the system and itis the customer’s responsibility to destroy/delete the data if the system is no longer used.

2Right of Access (Art 15)
The Overview and Definitions section above fully outlines what data the Voca system collects
and saves as personal data.
The Voca administrator can log in to the Web Management Interface using secured andencrypted Web access and look at the ‘personal data’. Detailed information on the Voca Web
Management Interface can be found in the Voca Administrator's Guide.
The Voca administrator can export the personal data outside of the Voca system. Moreinformation can be found in the Right to Data Portability (Art 20) section below.

LTRT-28976

P a g e |2

AudioCodes Inc.

International Headquarters

Contact

200 Cottontail Lane Suite A101E
Somerset NJ 08873
Tel: +1-732-469-0880 Fax: +1-732-469-2298

1 Hayarden Street, Airport City, Lod 7019900
P.O. Box 255, Ben Gurion Airport, Israel 7019900
Tel: +972-3-976-4000 Fax: +972-3-976-4040

https://www.audiocodes.com/contact

Websitehttps://www.audiocodes.com

3 Right to Rectification (Art 16)
The user’s information is taken from external sources but can be modified locally if needed.
The Call information is processed and stored on-the-fly in the Voca database. There is nomechanism that allows a user to edit or modify the information once captured and stored aspart of normal operation.
In the Voca system, the information is controlled by the Voca administrator through the Web
Management Interface only. The Voca administrator can create, delete and edit the personal
information and can rectify personal information per request.

4 Right to be Forgotten (Art 17)
The information collected by the Voca system as described in Section 1 can be removed toerase personal data.

4.1

Call Information
Call information is stored for a specific time range. Once this time range elapses, callinformation is deleted automatically. The retention time a call remains in the Voca databaseis configurable by the Voca administrator, to adhere and facilitate the relevant Data Protection
policy required by the administrator.
If there is a need to immediately erase personal call information, the Voca administrator
should approach AudioCodes for immediate support.

4.2

User Information
User information can be imported from the Active Directory server using the LDAPS protocol
or uploaded through a file to the Web Management Interface, to be created manually. User
information is actively retrieved by Voca. To erase the imported personal user information,
the Voca administrator can terminate the connection with the Active Directory and manually
delete all the users and their personal data from the Voca Web Management Interface on
demand.
Detailed information on how to delete a Contact from the Voca system can be found in the
Voca Administrator's Guide.

LTRT-28976

P a g e |3

AudioCodes Inc.

International Headquarters

Contact

200 Cottontail Lane Suite A101E
Somerset NJ 08873
Tel: +1-732-469-0880 Fax: +1-732-469-2298

1 Hayarden Street, Airport City, Lod 7019900
P.O. Box 255, Ben Gurion Airport, Israel 7019900
Tel: +972-3-976-4000 Fax: +972-3-976-4040

https://www.audiocodes.com/contact

Websitehttps://www.audiocodes.com

5 Right to Data Portability (Art 20)
Personal data which is stored in the customers OVOC as defined in Call Information above,
may be retrieved by the Voca administrator and sent to a data subject.

5.1

Call Information
The Voca administrator can save call information to a CSV file, which then can be sent to thedata subject. The calls saved to the CSV file, are according to the filters defined by the Vocaadministrator, who may use the Voca filter feature to filter only the calls related to the datasubject, prior to saving the calls to a CSV file.
The call records in the CSV file may contain other personal data which is not related to thedata subject. For example, if the data subject is the caller of the call, the callee personal dataof the same call may also be part of the call record in the CSV file. It is up to the Voca customer
to make sure that other personal data is not being exposed to the data subject. It is out of theVoca product’s scope to erase other information from the CSV file, that is not related to thedata subject personal data.
Detailed information on how to filter call information and save it to a CSV file in the Vocasystem, can be found in the Voca Administrator's Guide.

5.2

User InformationUser information in the Voca system can be retrieved using the Voca Web ManagementInterface. The Voca administrator can select a specific user and see its full user details. Thespecific user’s page can then be copied to a text file or screen capture. The saved user’s details
file can then be sent to the data subject.
As with Call information, also the Contacts section in the Voca Web Management Interface
may include other personal information. It is up to the Voca customer to make sure that others
personal data is not being exposed to the data subject.
Detailed information on how to view Contact’s information can be found in the Voca
Administrator's Guide.

LTRT-28976

P a g e |4

AudioCodes Inc.

International Headquarters

Contact

200 Cottontail Lane Suite A101E
Somerset NJ 08873
Tel: +1-732-469-0880 Fax: +1-732-469-2298

1 Hayarden Street, Airport City, Lod 7019900
P.O. Box 255, Ben Gurion Airport, Israel 7019900
Tel: +972-3-976-4000 Fax: +972-3-976-4040

https://www.audiocodes.com/contact

Websitehttps://www.audiocodes.com

6 Security of Processing (Art 32), Data Protection by
Design and by Default (Art 25) and HIPAA SecurityRules
6.1Encryption of Personal Data◼

Voca is configured by default: Caller speech inputs, Caller number.

◼

This data is saved encrypted on disk.

◼

Configuration can be changed to NOT saving any caller data.

◼

Voca can also be configured to mask the Caller number to show only the last 4 digits.

◼

Data in Transit is encrypted:
••

6.2

6.3

AudioCodes SBC creates TLS and SRTP session between caller and Voca.
Traffic from Voca to any 3rd party system is running over the HTTPS
session.

Access Control to Voca on Premises◼

Voca has two connectivity options: RDP or Web UI◼

Access by RDP is relevant for customer support by AudioCodes only on a “need to”
access. The customer is responsible to provide the secured connection andauthentication method.

◼

Voca Web access is for customers’ operational usage. The preferred way is tosynchronize Voca to customers’ Azure AD and use the MFA and credentials as defined inthe customer’s policy.

◼

Voca also provides the ability to use local users. This method is not recommended.

Access Control to Database◼

The database is based on MySQL and might contain PII or PHI in case the customer
chooses to do so.

◼

Access to the database is pre-configured during the installation phase to a default one
but can be replaced by another one known to the customer only. In that case, it is thecustomer’s responsibility to save the credentials and retrieve it when database support isneeded.

LTRT-28976

P a g e |5

AudioCodes Inc.

International Headquarters

Contact

200 Cottontail Lane Suite A101E
Somerset NJ 08873
Tel: +1-732-469-0880 Fax: +1-732-469-2298

1 Hayarden Street, Airport City, Lod 7019900
P.O. Box 255, Ben Gurion Airport, Israel 7019900
Tel: +972-3-976-4000 Fax: +972-3-976-4040

https://www.audiocodes.com/contact

Websitehttps://www.audiocodes.com

6.4Backup◼

6.5

Voca can set the backup for all server configurations. The data is scheduled at intervals
to the external storage. It is the customer’s responsibility to provide the secured
encrypted storage.

Segregation Control
The Voca system has several Web UI levels of users:◼

Super Admin: This user is used ONLY by AudioCodes to set licensing and features.

◼

Provider Admin: This user is used to configure and maintain, on behalf of a tenant
admin, the Voca server and Tenants (optional).

◼

Tenant Admin: This user is used to configure and maintain specific tenants.

◼

Analytic User: This user is used to view and generate reports global or per tenant.

7 Disposal Process
The Voca system can run on multiple platforms. If the platform is virtual (e.g., VMware) or
cloud (e.g., AWS), the disposal operation should be done on the virtual or cloud platforms
level and is out of the Voca product’s scope.
If the Voca server runs on a hardware server provided by AudioCodes, an administrator-level
user can perform a clean installation process operation on the Voca server, to remove any
personal information from the system before disposal.
This operation erases all data from the Voca server and returns it to its initial state, removing
all ‘personal data’ as defined in this document. Detailed information on how to clean install
the Voca server can be found in the Voca Installation Manual.

LTRT-28976

P a g e |6

AudioCodes Inc.

International Headquarters

Contact

200 Cottontail Lane Suite A101E
Somerset NJ 08873
Tel: +1-732-469-0880 Fax: +1-732-469-2298

1 Hayarden Street, Airport City, Lod 7019900
P.O. Box 255, Ben Gurion Airport, Israel 7019900
Tel: +972-3-976-4000 Fax: +972-3-976-4040

https://www.audiocodes.com/contact

Websitehttps://www.audiocodes.com