Privacy & Security
Caller trust comes first
A call to an office can include a name, a birthday, an account or policy number, an insurance plan and the reason for calling. Here's how we handle that information, in plain language.
The short version
- BAA required for every tool. Before go-live, calls for every office will run only on a voice platform that has signed a Business Associate Agreement with us. Any other tool that touches health information must sign one too.
- BAA for healthcare offices. If your office is covered by HIPAA (medical, dental, chiropractic, therapy and similar practices), we sign a BAA with you before any patient call goes live.
- Encryption required. We require our voice platform to encrypt calls and records in transit and at rest.
- Redaction required. Personal details will be automatically removed from call transcripts.
- Minimal. We collect only what's needed to book or return a call, and keep it only as long as your office needs it.
- No card numbers by voice. Payments only go through secure hosted payment links or card readers, with your office as the merchant.
- Disclosed. Every caller will hear, at the start, that the call is recorded and that they're speaking with an AI assistant.
HIPAA-minded by design
When the assistant handles protected health information for a healthcare office, we act as that office's business associate. Before any office goes live, we will have written privacy and security policies in place, complete a risk assessment and train everyone who can see call data. We limit access to named people and require two-factor sign-in. Every office's calls get these same safeguards.
Recording consent, state by state
Some states, including California, require everyone on a call to agree to recording. We follow each state's call-recording consent rules: our greeting will say the call is recorded before anything else, in the caller's language, and a caller who says no is given your office number and the call ends. For California healthcare offices, we also respect California's medical-privacy law (CMIA).
No professional advice
The assistant sticks to scheduling, office questions and routing. It doesn't give medical, dental, legal, financial or other professional advice, which keeps callers safe and leaves those conversations to your team.
Retention you choose
You pick how long recordings and transcripts are kept. We suggest the shortest period that works for your team, and delete records after that.
No marketing use
Caller information is used only to serve your office. It isn't sold, used for advertising, or used to contact anyone for marketing. We don't train our own AI models on your calls.
Texts with consent
We follow federal rules for automated calls and texts. The missed-call text-back is one helpful reply with no promotions. Confirmations, reminders and text-to-pay messages go only to customers who agreed, and "STOP" always works.
What we won't claim
There's no official "HIPAA certification" for products or vendors, so we don't claim one. What we do: sign a BAA with healthcare offices, require BAAs from our vendors before go-live, follow HIPAA-minded practices for every office, and stay open about how everything works.
If something ever goes wrong, we'll tell you promptly and follow the notice steps in our agreement with your office.
Want our BAA template, a list of the vendors that handle call data, or a security summary for your compliance file? Ask us and we'll send them.
This page describes our practices. It isn't legal advice; please talk with your own advisor about your office's privacy obligations (including HIPAA, if it applies to you). See also our Privacy Policy.
Try it free for 14 days
Founding offices get a free 14-day after-hours pilot. We set everything up, there's no contract, and your founding price stays locked for 12 months.