Nuance Privacy Statement
You may download a copy of our Privacy Statement here(pdf. Open a new window).
Nuance Privacy Statement
This Privacy Statement (“Statement”) describes the personal data that Nuance collects, how we use it, and when we share it, as we interact with you, deliver our products and services, and conduct our business operations.
This Statement applies to Nuance Communications, Inc., its affiliates and any wholly owned subsidiaries worldwide, referred to in this Statement as “Nuance.” When we refer to Nuance products, we mean all Nuance products and services.
For the purposes of applicable data privacy legislation, the Nuance affiliate or subsidiary responsible for the collection and use of your personal data is either the affiliate or subsidiary with which you contract or engage, or the affiliate or subsidiary located in the country in which you reside. If you wish to confirm the identity of the responsible Nuance affiliate, you may contact us by completing the Privacy Request(Open a new window) webform.
What Personal Data Do We Collect?
Nuance collects personal data when we deliver our products, conduct marketing, and run our business operations. The personal data we collect varies based upon whether the data is collected (i) through our websites or applications, including www.nuance.com(Open a new window), shop.nuance.com(Open a new window), www1.nuancepowershare.com(Open a new window), www.nuancecommunity.force.com(Open a new window), and www.mix.nuance.com(Open a new window) (“Sites”) or (ii) through our products and services, including but not limited to our software, support services, voice recognition technology, and medical information products (“Products”).
We may collect personal data directly in the following situations:
- When you purchase, download, or register Nuance software, or use Nuance software support services, we may collect contact information such as your name, email address, physical address, telephone number, and financial and payment details, together with information on the Nuance Products you buy, download, or register.
- If you engage with Nuance for marketing purposes, such as by expressing interest in Nuance Products through a web form, participating in a promotion, or attending a Nuance or other marketing event, we will collect the information you submit to us, such as your contact details (including name, email address, phone number, organization and job title) and the Nuance Products that interest you.
- We may also collect other electronic data from your use of our Sites automatically. This data may include your IP address, date/time stamp, data about your interaction with our Sites and data collected from our use of cookies and similar tracking tools.
Through our Products, we may collect personal data directly in the following situations:
- When you use Nuance voice recognition technology, whether by using Nuance’s own Products or by using third party products that employ Nuance voice recognition technology, we may capture your voice and the words that you speak into the product.
- When you use Nuance biometric technology, we may capture, store, and/or use a voiceprint of your voice, or behavioral information, such as your choice of words, your patterns of speech or writing, or how you use your keyboard, computer mouse, or other devices, for the purpose of confirming your identity or detecting potentially fraudulent or malicious activity.
- If you use a Nuance medical information sharing Product, such as PowerShare, we will collect the personal data, healthcare information, and healthcare images you submit.
- We may also collect other electronic data derived from your use of our Products. This data may include your IP address, usage data, and data showing your registration, installation and use of Nuance software Products. Except for IP address and unique device identifiers, we generally collect this data on an aggregate and non‑identifying basis.
Nuance may collect personal data indirectly in certain situations, in particular:
- We provide medical voice recognition, medical imaging, transcription, and clinical documentation Products to hospitals and medical providers. To deliver these Products, we may collect patient data both directly from our healthcare customers as well as from vendors serving our healthcare customers such as individual doctors, imaging and laboratory service providers, and electronic health record service providers. This patient data may include name, address, gender, birthdate, medical record number, diagnosis, image, and treatment information. Where consent is required for the collection and use of medical information, Nuance will obtain consent if we interact directly with patients. However, if we are processing personal data on behalf of a third party that has direct patient access, it will be the third party’s responsibility to obtain the consent.
- We provide voice recognition, text input, and communications products to corporate customers, and we may collect personal data processed in those products, including voice recordings, text, names, phone numbers, or sensitive data such as credit card numbers, or unique identifier numbers issued on a government document commonly used to identify a person's identity.
- We provide biometric authentication products to corporate customers, and we may collect, store, and/or use personal data processed in those products, including voiceprints, information regarding fingerprints, and information regarding behavior, for the purpose of confirming your identity or detecting potentially fraudulent or malicious activity.
- We obtain contact information, including name, email address, phone number, organization, and job title, from our resellers and distributors, from public sources, and from third‑party mailing lists.
Cookies
Nuance and its partners use cookies and similar tracking tools to distinguish you from other users as described in our Cookie statement. You can control the use of cookies at the individual browser level, but if you choose to disable cookies, it may limit your use of certain features or functions on our website or service.
Why We Use Personal Data
We collect, process, use and store your personal information for the following business and commercial purposes in accordance with our legitimate business interests and legal requirements or with your consent where required:
- to provide you with information in response to your requests;
- to maintain the accuracy of the information we collect;
- to help us develop new Products or features that meet your needs;
- to manage language preferences and connect you with your nearest account manager;
- to maintain contact data about you or a third party (such as, your employer);
- where necessary to protect or conduct our business and pursue our, or our affiliates’, legitimate business interests, which include the security of our systems and our operations and the exercise or defense of legal claims;
- to comply with privacy laws and other regulations such as to manage consent requirements;
- to give you a customized interactive experience;
- to measure interest in our various Products;
- to inform you about new Products or features and functionalities;
- to keep you up‑to‑date with latest product and solution offerings and other business related items from Nuance or third parties which may be of interest to you;
- to occasionally send you push notifications, which you may opt‑out of by turning them off at the device level through your settings.
Control Of Your Personal Data
You can change your preferences to opt out of marketing communications at any time by completing the Privacy Request(Open a new window) webform. Alternatively, please follow the opt‑out instructions in the relevant communication. If you opt out, we will retain your email address to confirm that we do not send you further communications.
If your personal data has been collected by Nuance to review a proposed reseller or distributor relationship, you may contact us by completing the Privacy Request(Open a new window) webform to request deletion of your data. We will respond to your request within a reasonable timeframe.
If you wish to access, correct, or request deletion of your Product Personal Data, you may contact us by completing the Privacy Request(Open a new window) webform. Nuance generally processes Product Personal Data on behalf of our healthcare, enterprise, and corporate customers. If you contact us, we may direct your inquiry to our customer on whose behalf the Product Personal Data is being processed. We will make reasonable efforts to delete your Product Personal Data upon your request within a reasonable timeframe. Nuance may refuse your request to access, request or delete Product Personal Data where entitled to do so under applicable law.
If you have submitted Product Personal Data to Nuance using your own user account which allows you to control your own data, you may delete the data you submitted by logging into your account and following the guidelines in the help system.
Location Of Processing and Cross‑Border Transfers
Nuance operates in many countries. We may transfer personal data across international borders and may process personal data to other Nuance affiliates, Nuance’s parent corporation, or other companies performing support functions on our behalf (each as described above ) in countries and jurisdictions other than the location of original collection, including in countries and jurisdictions that are not subject to an adequacy decision by the European Commission or your national legislator or regulator, and that may not provide for the same level of data protection as your jurisdiction. In such cases, we ensure that the recipient offers an adequate level of protection and security, for instance by entering into the appropriate agreements and, if required, standard contractual clauses or an alternative mechanism for the transfer of data as approved by the European Commission or other applicable regulators or legislators. Where required by applicable law, we will only share, transfer or store your personal data outside of your jurisdiction with your prior consent.
General Data Protection Regulation ("GDPR")
Nuance has a range of privacy and security controls across its organizations to ensure compliance with the General Data Protection Regulation (GDPR), including, but not limited to:
- GDPR‑compliant data protection agreements with all customers for whom Nuance Processes Personal Data;
- A PIA driven process to ensure that all products and services are built with Privacy By Design;
- An extensive, on‑going training program for its employees, with data privacy and protection education upon hiring and then again at least on an annual basis;
- State‑of‑the‑art technical and security measures, including data encryption at rest and in transit;
- Records of processing which include mapped storage and transfer of Personal Data throughout Nuance’s product‑lines;
- Appropriate access right limitations;
- Company‑wide systems for protecting Data Subject rights, ensuring that individual access/portability/right‑to‑be‑forgotten rights are respected; and
- Appointment of a Data Protection Officer.
Lawful bases for processing personal information (applies only in the European Economic Area)
We process personal information where one or more of the following conditions that are set out in the GDPR apply:
- Where it is necessary in order for us to conduct our business and pursue our, or our affiliates' legitimate interests for internal administrative purposes. In particular, we collect, use and store your personal information: (i) to communicate and manage our relationship with our customers; (ii) to allow our customers to use our Products; (iii) to develop new Products and to improve performance of our Products and software; (iv) to maintain contact data about you or a third party (such as, your employer); (v) to inform you of Products, marketing plan and other business related items which may be of interest to you; (vi) to ensure the security and proper performance of our systems and our operations, (vii) for accounting, billing and audit purposes and (viii) where appropriate, to establish, exercise or defend legal claims.
- Where it is required by applicable privacy laws, we will obtain your consent to: (i)send you direct marketing in relation to relevant Products that we provide; (ii)place cookies and use similar technologies in accordance with the ‘Cookies´section of this Statement and the information provided to you when those technologies are used;
- Where it is necessary in order for us to comply with our legal obligations, such as requirements to process requests by government or law enforcement authorities.
Transfers to third countries
Whenever Nuance transfers personal information beyond the country of origin, we will do so in accordance with applicable laws. In the context of its European operations, Nuance may transfer Personal Data abroad to other countries in the European Economic Area or to third countries. In reaction to the decision by the Court of Justice of the European Union issued on July 16th 2020, in its Case C‑311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (called “Schrems II case”) and in furtherance to the Recommendations 01/2020 issued by the European Data Protection Board on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, Nuance has evaluated the data transfers necessary for its multinational operations. Nuance will ensure that importers of any Personal Data offer an adequate level of protection, whether through an adequacy decision or appropriate safeguards under Article 46 of the GDPR.
To the extent Personal Data processed by Nuance would be transferred to a country, territory or sector outside the EEA that is not recognized by the European Commission as providing an ‘essentially equivalent´ level of protection to that which exists within the EU, Nuance will rely on EU Standard Contractual Clauses for transfers: (i) between Nuance affiliates, and (ii) to third parties. The EU Standard Contractual Clauses can be viewed on the European Commission’s website here. https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en(Open a new window). As per the guidance of the European Data Protection Board, Nuance has implemented programs to review such data transfers and to employ additional safeguards when appropriate for the data processing required by law and our customer contracts.
With respect to personal data received or transferred, Nuance and its U.S. Subsidiaries are subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Nuance complies with the EU-U.S. Data Privacy Framework (EU‑U.S. DPF), the UK Extension to the EU‑U.S. DPF, and the Swiss‑U.S. Data Privacy Framework (Swiss‑U.S. DPF) as set forth by the U.S. Department of Commerce. Nuance has certified to the U.S. Department of Commerce that it adheres to the EU‑U.S. Data Privacy Framework Principles (EU‑U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU‑U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU‑U.S. DPF. Nuance has certified to the U.S. Department of Commerce that it adheres to the Swiss‑U.S. Data Privacy Framework Principles (Swiss‑U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss‑U.S. DPF. In the context of an onward transfer, Nuance has responsibility for the processing of personal data it receives under the DPF and subsequently transfers to a third party acting as an agent on our behalf. Nuance remains liable under the DPF if our agent processes such personal information in a manner inconsistent with the DPF, unless Nuance can prove that we are not responsible for the event giving rise to the damage. If there is any conflict between the terms in this Statement and the EU‑U.S. DPF Principles and/or the Swiss‑U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit the U.S. Department of Commerce’s Data Privacy Framework website(Open a new window).
If you have a question or complaint related to participation by Nuance in the DPF Frameworks, we encourage you to contact us via our web form(Open a new window). For any complaints related to the DPF Frameworks that Nuance cannot resolve directly, we have chosen to co‑operate with the relevant EU Data Protection Authority, or a panel established by the European data protection authorities, for resolving disputes with EU individuals, the UK Information Commissioner (for UK individuals) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) for resolving disputes with Swiss individuals. Please contact us if you’d like us to direct you to your data protection authority contacts. As further explained in the DPF Principles, binding arbitration is available to address residual complaints not resolved by other means. Nuance is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).
Security and Retention
We follow generally accepted standards to protect the personal data submitted to us, both during transmission and once it is received. Information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using current PCI‑DSS standards. If Nuance has issued you a password, you are responsible for keeping the password confidential.
We store personal data to the extent necessary to provide Products to our customers. Generally, we retain personal data for as long as you remain an active customer or user of our Sites and Services and for 3 years afterwards, or otherwise as required for our business operations or by applicable laws. We will permanently destroy biometric data when the initial purpose for collecting or obtaining such data has been satisfied, or within 3 years of your last interaction with us, whichever occurs first. Different retention of personal data may be necessary under contractual terms with the data controller for whom we provide services, for fraud prevention, to identify technical problems, or to resolve legal proceedings.
We may retain non‑personally identifiable aggregate information beyond this time for research purposes and to help us improve and further develop our Products. You cannot be identified from aggregate information retained or used for these purposes. Where we process personal information for marketing or business analytic purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data so that we can respect your request in the future.
Children
If a Nuance customer puts Nuance voice recognition Product technology in a customer product or service that is likely to be accessed by children, Nuance may receive speech data from product users to provide voice recognition to the user. This is a function of how Nuance’s voice technology works. This means that if the user is under the age of 16, Nuance may receive personal data from children under the age of 16. It is the responsibility of the Nuance customer to obtain any consents required under applicable law, including under the Children’s Online Privacy Protection Act and relevant data protection laws, for the collection of such personal data.
Nuance does not sell services to children and, except as described in the preceding paragraph, Nuance does not knowingly collect personal data directly from children under the age of 16. Nuance has adopted a policy that Nuance will not provide hosted services to primarily child-directed websites and online services. No child under 16 should directly submit personal data to Nuance. If you become aware that a child under the age of 16 has submitted personal data to Nuance except as described in the preceding paragraph, please inform us by completing the Privacy Request (Open a new window) webform and we will promptly delete the data.
Your Rights
European Union, United Kingdom, and Switzerland residents rights
- ask for access to details of the personal data held by us about you, free of charge and to obtain a copy of your personal data;
- to request the rectification, restriction and in some circumstances erasure or restrict (stop any active processing) of your personal data held by us;
- to object to the processing of your data in some circumstances (in particular, where we do not have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing);
- to obtain the personal data you provide to us with your consent in a structured, machine readable format, and to ask us to share (port) this information to another controller;
- to complain to an EU data protection authority
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete data which we are required by law to keep or have compelling legitimate interests in keeping.
Contact us
You can exercise the rights listed above, or write to us with any complaints, at any time by contacting us, specifying the nature of your request, at:
Privacy Request (Open a new window)webform. Alternatively, you may contact us at privacy@nuance.com or by mail (Worldwide) at:
Chief Privacy Officer
Nuance Communications, Inc.
15 Wayside Road
Burlington MA 01803
USA
1-866-384-4277 (Issue Type is “Privacy”)
Data Protection Officer
Nuance Communications Ireland, Ltd
The Harcourt Building, 4th Floor
57B Harcourt Street
Dublin 2, D02 F721
IRELAND
If your request or concern is not satisfactorily resolved by us, you may approach your local data protection authority.
California Residents Rights
If you are a California resident, as defined in the California Code of Regulations, you have rights under the California Consumer Privacy Act of 2018 ("the CCPA") as amended by the California Privacy Rights Act of 2020 (“CPRA”). Below are the disclosures about your personal data and a description of your rights.
Categories of information we collect and disclose for a business purpose
We may collect the following categories of personal information, as defined in the CCPA, from you in connection with the products and services you have purchased from Nuance. In addition, during the past twelve months, we may have disclosed these categories of personal information for a business purpose:
- Identifiers, such as your real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, and other similar identifiers.
- Personal information categories listed in the California Customer Records provisions, including telephone number, and payment information, such as your credit card number.
- Healthcare Information
- Characteristics of protected classifications under California or federal law, such as your gender and age.
- Commercial information, such as the record of Nuance products or services purchased, obtained or considered.
- Internet or other electronic network activity information, such as session logs.
- Geolocation data (such as usage data from your performance metrics related to your use of the website)
- Audio, electronic, visual, or similar information, such as voice recording, voice prints, keystrokes and photos.
- Professional or employment‑related information.
- Inferences drawn from any of the above information to create a profile reflecting your preferences, characteristics, behavior, abilities, and aptitudes.
- In addition to the categories of sensitive data above, we may collect additional sensitive personal information as defined by the CPRA: social security number, driver’s license, state ID card, passport number, union membership, your account log‑in, password, credentials allowing access to an account, financial account, debit and credit card numbers, and contents of your email and/or text messages, precise geolocation data, and your information collected and analyzed concerning your health information.
According to California law, personal information does not include:
- Publicly available information from government records.
- De-identified or aggregated consumer information.
Other disclosures about your personal information
This Statement provides additional disclosures about your personal information as required by the CCPA and/or CPRA. Refer to the following sections to learn more about the sources of personal data we collect, the business or commercial purposes for which we use personal data, and the categories of third parties with whom we share personal data.
Your Rights and Choices
In addition to the above, the CCPA and CPRA provides you with specific rights regarding your personal information. This section describes your CCPA rights and explains how to exercise those rights.
Access to Specific Information and Data Portability Rights
You have the right to request, up to 2 times a year, that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:
- The categories of personal information we collected about you.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose for collecting that personal information.
- The categories of third parties with whom we share that personal information.
- The specific pieces of personal information we collected about you (also called a data portability request).
- If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
- sales, identifying the personal information categories that each category of recipient purchased; and
- disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
We do not provide these access and data portability rights for B2B personal information. You may send us a request to correct inaccurate personal information.
Deletion or Correction Request Rights
You have the right to request that we delete or correct your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) or correct, as applicable, your personal information from our records, unless an exception applies. We will use commercially reasonable efforts to correct inaccurate information upon your request.
We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
- Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Engage in public or peer‑reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
- Comply with a legal obligation.
- Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
We do not provide these deletion rights for B2B personal information.
Non‑discrimination
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:
- Deny you goods or services.
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of goods or services.
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA‑permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.
Limit Use and Disclosure of Sensitive Personal Information
You shall have the right to limit use and disclosures of your sensitive personal information to that use which is necessary to perform the services or deliver the goods, unless you subsequently provide consent for our use or disclosure of your sensitive personal information for additional purposes. Our collection and processing of sensitive personal information without the purpose of inferring characteristics about you is not subject to this right.
Exercising Your Rights
You may only make a verifiable consumer request for access or data portability twice within a 12‑month period. The verifiable consumer request must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. An authorized agent may make a request on your behalf if: (a) the agent is registered with the California Secretary of State to conduct business in California, has your written permission to submit the request, and verifies their identity in accordance with the verification process; or (b) you have provided the agent with power of attorney to act on your behalf. We will respond to your request within 45 calendar days, after proper verification, unless we need additional time, in which case we will let you know.
Making a verifiable consumer request does not require you to create an account with us.
We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
You can also exercise the rights listed above, or write to us with any complaints, at any time by contacting us, specifying the nature of your request, at:
Privacy Request webform. Alternatively, you may contact us at privacy@nuance.com or by mail (Worldwide) at:
Data Protection Officer or Chief Privacy Officer
Nuance Communications, Inc.
15 Wayside Road
Burlington MA 01803
USA
1-844-931-2038 (Issue Type is “Privacy”)
Please note that recent changes to the CCPA and other U.S. state data privacy laws were set to take effect in 2023; however, the rules implementing some of these laws have not yet been finalised. We are continuously working to better comply with these laws, and we will update our processes and disclosures as these implementing rules are finalised.
Nuance Employees and Contingent Workers
This Privacy Statement does not cover Nuance’s collection of personal data from employees and contingent workers, which is described in a separate HR Privacy Statement made available to Nuance personnel.
Notice At Collection
You have a right to receive notice of our practices at or before the point of collection. We may process your personal data for legitimate business purposes, including but not limited to:
- Your first and last name
- Your organization and job title
- Your email address
- Your phone number
- Identifiers, such as cookies, Internet Protocol address, and other similar identifiers.
Refer to the following sections to learn more about the business or commercial purposes for which we use your personal data, the categories of third parties with whom we share personal data and how to opt‑out, and information regarding our retention practices.
We never sell, share, or transfer your data to third parties for the third party’s own purposes.
Changes To This Privacy Statement
We may update this Privacy Statement from time to time by publishing an updated version on Nuance's Sites. Each updated version will include the date the statement was last updated. Please review the latest version of this Privacy Statement periodically to keep current with Nuance’s use of personal data. If we make material changes in the way Nuance uses or shares personal data, we will publish the updates on our Sites. Any such material changes will only apply to personal data collected after the revised Privacy Statement takes effect.
Updated: January 1, 2024.