HIPAA-ready, BAA signed
We sign a Business Associate Agreement before any protected health information is processed. That covers the call recording, the transcript and every downstream tool that touches a conversation.
Security & compliance
Your callers say things they should not have to.
An AI receptionist for a dental or veterinary clinic handles symptoms, medical history and insurance details every single day. This page is what we do with all of it.
SOC 2
Type II controls in scope
BAA
Signed before any PHI
AES-256
Encryption at rest
4
Data residency regions
Controls
What is actually in place.
Not a list of logos. These are the specific controls that govern how a call recording or a transcript is handled.
SOC 2 Type II controls
Access management, change management, monitoring, capacity planning, incident response and recovery testing are in scope, with third-party penetration tests run at least annually.
Encrypted at rest and in transit
TLS on every leg of the call, AES-256 at rest for recordings and transcripts, with keys rotated on a schedule.
Retention you control
Recording and transcript retention is configurable per account, and deletion can be enforced automatically once the window closes.
Sub-processors published
Every third party with access to your data is listed with what it touches. Available under NDA in the trust portal, with the current public list available on request.
Regional data residency
Call legs can be pinned to a region — US, EU, Canada or India — so records stay where your regulator expects them.
Deployment
Four ways to run it, one that fits your procurement.
Most clinics are fine on managed cloud. Some hospital groups and DSOs are not, and should not have to be.
Managed cloud
StandardOur default. Fastest to deploy, continuously patched by us, with the full audit trail.
Region-pinned cloud
AvailableSame platform, with every call leg and storage bucket pinned to a region you nominate.
Private VPC
EnterpriseThe agent runs inside your cloud network. Nothing crosses the public internet on the audio path.
On-premise or air-gapped
EnterpriseFor clinics under procurement constraints that cannot permit any outbound connectivity.
Data lifecycle
What happens to a call after you hang up.
This is the part most vendors leave vague, so here it is plainly. Every answered call produces an audio recording and a transcript. Both are stored encrypted, both are attached to the caller’s record, and both are yours.
They are accessible to your team through the dashboard and through your CRM, exportable at any time in bulk, and deleted automatically once your retention window closes. If you set retention to 30 days, the recording is gone after 30 days whether or not anyone remembered to clean it up.
We do not use your client conversations to train shared models, we do not sell aggregate data, and your transcripts are not used for any other customer’s benefit.
- 1
Captured
Call audio and transcript are encrypted in transit and stored with the caller record.
- 2
Routed
Structured outcome — booked, escalated, qualified — is written to your CRM and practice system.
- 3
Reviewed
You control which fields are written back. Anything not written back stays in the dashboard only.
- 4
Retained
Held for the window you configure, with escalation and complaint calls held longer if you set it.
- 5
Deleted
Automatically, on schedule, across primary storage and backups. No manual clean-up required.
Multi-region
If you operate in more than one jurisdiction.
Each region runs its own regime. A group operating across India, the UK and the US needs the controls to hold in all three — so we pin processing rather than hoping it generalises.
India
DPDP Act 2023
- Express consent captured and recorded before processing
- TRAI DND registry checked before any outbound message
- Data held in-region for the deployment that nominates India
United Kingdom & EU
UK GDPR / GDPR
- EU data pinned to EU infrastructure on request
- Lawful basis documented per processing purpose
- Data processing agreement and sub-processor list available
United States & Canada
HIPAA · PIPEDA · state privacy law
- BAA signed before any protected health information
- State-level consent rules applied to outbound messaging
- Residency and retention configured per state requirement
If you are not sure which regime applies to a specific deployment, tell us where your practice operates and we will map it before contract, not after.
FAQ
The questions procurement actually asks.
Both, with the right paper behind it. We sign a BAA, run the platform under a HIPAA-aligned control set, and configure retention per account. You are still responsible for how your own organisation uses the output — the same as any vendor you engage.
Request the trust pack
SOC 2 report, penetration test summary, sub-processor list, sample BAA and retention configuration — released under NDA, usually same day.