The Health Insurance Portability and Accountability Act (including the Privacy Rule, Security Rule, Breach Notification Rule, and Health Information Technology for Economic and Clinical Health Act) (HIPAA), requires Covered Entities and Business Associates to take certain measures to protect health information that can identify an individual. It also provides certain rights to individuals. Zoho Voice does not collect, use, store, or maintain health information protected by HIPAA for its own purposes. However, Zoho Voice provides certain features to help its customers use Zoho Voice in a HIPAA compliant manner.

HIPAA requires covered entities to sign a Business Associate Agreement (BAA) with its business associates. You can request our BAA template by sending an email to legal@zohocorp.com.

Audit Logs     

Refer to the Retention Policy section for details on how long these logs are stored.

Note: The Audit log feature in Zoho Voice is currently under development and is not yet available for direct access. However, if required, audit logs can be provided to users upon request.

ePHI   

Call notes, recordings, voicemails, and messages are considered as ePHI as they may have health information in them, and they're encrypted. We don't consider any other data as ePHI.

In addition to this, the notes, recordings, voicemails, and messages are encrypted at Transit and Rest, making you the only one to view your data.

Retention Policy     

Zoho Voice retains your account data for as long as you actively use the service. Once you terminate your Zoho Voice account, your data will be removed from the active database during the next cleanup cycle, which occurs every 90 days. Additionally, data removed from the active database will be permanently deleted from backup systems after another 90-day period.

Below is a detailed breakdown of our data retention periods:

* Data remains available for 90 days after an organization or account is deleted. When an organization is deleted, all associated data is also deleted but retained for 90 days. If a user is deleted, their data is anonymized and remains accessible until the organization itself is deleted.

** When a user requests a data backup, Zoho Voice provides the data as a downloadable backup file. Deleted data cannot be added back to the user's Zoho Voice account.

For example, deleted call logs cannot be added back to the Logs module in Zoho Voice. It can be given only as a downloadable backup file.