Security
Security and data protection
Patient calls contain personal and health data. This page sets out who is responsible for that data, where it goes and how long it is kept.
Who is responsible
Your practice is the controller of patient data. ClinicAll, operated by EXIGE SARL in Luxembourg, processes call data on your behalf and only to run the assistant and your dashboard.
A data processing agreement (Art. 28 GDPR) is available on request before you commit.
Callers know it is an assistant
The assistant introduces itself as the practice’s voice assistant at the start of every call. It gives no medical advice and follows the urgency rules your practice defines.
What is processed during a call
- The caller’s phone number
- The audio of the call and its transcript
- Details the caller gives for a booking, such as name, date of birth and reason for the appointment
- The appointment written to your practice software
How long it is kept
At the voice AI platform, recordings and transcripts are deleted after a retention period set per practice. At our production practice it is 7 days.
Your dashboard keeps a call log with the caller’s number, a summary and the transcript, so your team can follow up on requests. We delete it at your practice’s request.
Appointments and patient records created in your practice software are kept under your practice’s own rules.
Sub-processors
These providers process call data for ClinicAll. Locations and safeguards are taken from each provider’s own data processing terms.
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| ElevenLabs | Voice AI: speech recognition, language model and voice | United States (default hosting) | Standard Contractual Clauses and EU-U.S. Data Privacy Framework |
| Telnyx | Telephony: phone numbers, call routing and call audio | United States (primary processing) | Standard Contractual Clauses and EU-U.S. Data Privacy Framework |
| Hetzner Online | Hosting of the practice dashboard and call log | Germany (Nuremberg) | Processing in the EU |
| Cloudflare | Website hosting, network security and secure access to the dashboard | Global network | Standard Contractual Clauses and EU-U.S. Data Privacy Framework |
Your practice software vendor processes your appointments under its own contract with your practice. ElevenLabs uses its own sub-processors, listed in its terms.
How access is protected
- The dashboard is served over HTTPS and protected by a login.
- The assistant connects to your practice software over HTTPS.
Data requests
For a copy of our data processing agreement, a patient data request or any security question, write to us. Patients should contact their practice first; we help the practice answer.
[email protected]