Privacy policy

1. Who is responsible

Trading entity: ClinicVoice, operated by Aleo Li, an independent contractor trading as ClinicVoice.

Email for data privacy and legal notices: [email protected].

Operating location: remote / digital service delivery. A postal address is available upon written request for verified legal and regulatory enquiries via the same email address. You do not need a postal address to submit a data rights request by email.

ClinicVoice is the data controller for website enquiries, public demonstration calls and our own business administration. When we handle patient calls on a clinic’s behalf, the clinic normally acts as controller and ClinicVoice acts as processor under a separate data processing agreement. Contact your clinic about patient records; we assist the clinic with requests concerning data we process for it.

2. What we collect and why

Website visits

Our hosting and content-delivery providers receive technical information such as IP address, browser information, requested resources and access times to serve the website and protect it from abuse. We do not install Google Analytics, Meta Pixel or advertising trackers on this site. See our Cookie notice.

When you choose to speak to Alice

Starting a call requests microphone access through your browser. Your audio is sent to Vapi and the configured speech and AI providers so Alice can understand and answer. Demo calls are recorded and transcribed; records can include what you say, Alice’s responses, call identifiers, timestamps, duration and technical diagnostics.

We use these records to provide the demonstration, investigate problems and review its quality. The demo is a fictional practice: do not provide real patient information, health details, financial information or other sensitive data. If you accidentally disclose such information, contact us so we can arrange appropriate deletion.

You can end the call at any time. Browser microphone permission is separate from data protection rights and may remain saved according to your browser settings; you can revoke it in your browser. Ending a call does not itself delete its recording.

Business correspondence

If you email us, we receive the contact details, practice information and message you choose to send. We use these to answer questions, prepare proposals, deliver agreed services, handle cancellations and refunds, and keep necessary business records. Email links open your own email application; this website does not silently submit a contact form.

Lawful bases

We rely on legitimate interests to operate a secure website, provide and improve a requested demonstration, and respond to business contacts, balanced against individuals’ rights. Where you personally enter a contract with us, we also process information as necessary to take steps you request before that contract and perform it. Legal obligations apply to records we must retain for tax, accounting or other applicable requirements.

We do not request health information in the public demo or use it to make decisions about care. Production processing of patient information requires the clinic’s documented instructions and appropriate legal bases, including a condition for special-category data where applicable. Browser microphone permission is not, by itself, an Article 9 condition for processing health data.

3. Who helps provide the service

Information is shared with providers only as relevant to the function you use. Our service arrangements include:

• Cloudflare: website hosting, delivery and security.
• Vapi: voice-call orchestration, call records and supporting infrastructure. The current demo uses Soniox for speech transcription, OpenAI for AI responses and ElevenLabs for generated speech. Vapi also uses infrastructure and real-time communication providers to carry calls.
• Zoho Mail: business email and correspondence.
• Google Fonts: delivery of the Inter font, which sends Google technical request information such as IP address and browser details when a page loads.
• jsDelivr: delivery of the Vapi browser software after you choose to start a call; it receives technical request information.

Production clinic configurations can use different approved providers, documented in the clinic’s data processing agreement. These providers are not all direct sub-processors in every context: roles depend on the service and relevant contract.

Provider information: Cloudflare privacy, Vapi privacy, Zoho privacy, and Google Fonts privacy information. Contact us for the provider details applicable to your proposed clinic setup.

International processing

Some providers process information outside the UK, including in the United States. We do not promise UK-only or EU-only storage. Applicable transfer arrangements must be documented with the relevant providers; depending on the recipient and circumstances, these may use UK adequacy regulations or appropriate contractual safeguards, such as the UK IDTA or the UK Addendum to the EU Standard Contractual Clauses.

Encryption protects information in transit but does not replace a lawful international-transfer mechanism. Contact us for details of the arrangements and copies of relevant safeguards for your data. Production transfer arrangements are confirmed before a clinic goes live.

4. How long information is kept

Demo recordings and transcripts: ClinicVoice’s retention policy is a maximum of 30 days for quality assurance and demonstration purposes, with deletion from our demo records by the end of that period. This is our retention commitment; deletion is managed by ClinicVoice rather than promised as an automatic website function.

Provider security records, billing metadata and backup cycles may be governed by separate retention requirements. They are distinct from the demo recordings and transcripts covered by the 30-day policy. Contact us about the handling of a particular call or a request for earlier deletion.

Enquiries and business records: we keep correspondence while it is needed to deal with your enquiry or service relationship, then only as necessary for applicable recordkeeping obligations or the establishment, exercise or defence of legal claims. We review these records and remove information no longer needed.

Clinic patient calls: retention, return and deletion are defined by the clinic’s instructions and data processing agreement, rather than the public demo’s retention period.

5. Your choices and rights

Depending on the circumstances, you may ask for access to your personal information, correction, erasure, restriction or portability, and object to processing based on legitimate interests. If a particular use relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Email [email protected]. If your request concerns a demo call, an approximate date and time helps us locate it. Do not send sensitive patient details or identity documents unless we explain why they are necessary through an appropriate channel. We may need proportionate verification to protect your information.

We normally respond within one month, subject to applicable rules on identity verification and extensions for complex requests. You can also complain to the UK Information Commissioner’s Office (ICO) or the relevant supervisory authority where you live.

We do not use the public demo to make solely automated decisions with legal or similarly significant effects about you. It does not make real bookings or decisions about treatment.

6. Security and changes

Access to service information is limited to the people and providers who need it for the stated purposes. We use HTTPS for this website and review security and data-handling requirements during clinic onboarding. No internet service can promise absolute security.

We update this notice when the service or relevant practices change. The date above identifies this version. Contact Aleo with any question about this notice before sharing information you are concerned about.