Privacy Policy

1. Privacy Policy

Voicely answers phone calls for healthcare clinics in Australia, and this policy outlines our ongoing obligations to you in respect of how we manage your Personal Information.

When you call a clinic that uses Voicely, our automated system answers the call and can book, check, reschedule or cancel appointments for you in the clinic's practice-management system. We handle your information on behalf of the clinic you called. The clinic remains your health-service provider and is responsible for your patient record. The clinic has its own privacy policy, which explains how it handles your information.

We have adopted the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (the Privacy Act). The APPs govern the way in which we collect, use, disclose, store, secure and dispose of your Personal Information.

A copy of the Australian Privacy Principles may be obtained from the website of the Office of the Australian Information Commissioner at www.oaic.gov.au.

2. What is Personal Information and why do we collect it?

Personal Information is information or an opinion that identifies an individual. Examples of the Personal Information we collect include names, phone numbers, email addresses, and the content of the calls we answer.

We collect Personal Information in five ways.

When you call a clinic that uses Voicely, we collect:

• Your voice: the live audio of the call.
• A recording and written transcript of the call (see section 5).
• The phone number you are calling from (caller ID), where it is not withheld.
• Details you provide during the call: such as your name, when you'd like an appointment, the reason for a cancellation, and (if you choose to give it) an email address.
• Details retrieved from your clinic's booking system to serve your request: such as your existing patient record, date of birth, and upcoming appointment times.
• Anything health-related you choose to say: such as mentioning an injury when booking. The AI does not ask for clinical details and does not give medical advice. In an emergency, hang up and call 000.

When you try the live demonstration on our website, we collect the audio of that call and a recording of it, anything you say during it, your IP address and the page you came from, and — if you build the demonstration from your own clinic's website — the address of that site. The demonstration runs on Google Cloud in the United States; nothing you book, move or cancel on it reaches a real clinic or a real patient record.

When you contact us through the booking or enquiry forms at voicely.au, we collect your name, your email address, and whatever you choose to tell us about your clinic or your question. These submissions reach us as email. They are not stored on the website itself.

When clinic staff sign in to the Voicely portal, our service sets a session cookie so they stay signed in. It does nothing but hold the sign-in session. We do not use analytics, advertising or tracking cookies anywhere on our website.

When we contact clinics about Voicely, we use what clinics publish online to curate personalised demo and email each clinic their sample call. The page that plays the call records whether it was opened and how far it was played. It sets no cookies and stores nothing that identifies the listener. Reply "no" to any of these emails and we will not contact you again.

We collect this Personal Information for the primary purpose of providing our services. That means answering and conducting the call, confirming who you are against the clinic's patient records, booking, checking, rescheduling or cancelling appointments in the clinic's booking system, keeping a record of the call for quality assurance, dispute resolution and record-keeping, and keeping the service secure, monitored and working.

Where you have contacted us through our website, we use your details to respond to your enquiry, including following up if we do not hear back from you. Your Personal Information is never sold, and, apart from the live demonstration on our website, we do not allow it to be used to train AI models.

When we collect Personal Information we will, where appropriate and where possible, explain to you why we are collecting the information and how we plan to use it.

3. Sensitive Information

Sensitive Information is defined in the Privacy Act to include information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

Because you may mention health matters on a call, some of what we handle is Health Information, which is a kind of Sensitive Information under the Privacy Act.

Sensitive Information will be used by us only:

• for the primary purpose for which it was obtained;
• for a secondary purpose that is directly related to the primary purpose;
• with your consent, or where required or authorised by law.

We do not use Sensitive Information for marketing, and we do not disclose it to anyone outside the recipients listed in section 7.

4. Automated (AI) processing

Calls are handled by an automated artificial-intelligence system. There is no human listening to your call while it happens. The AI:

• performs administrative tasks only (appointment booking and related questions); it is not a medical device and does not provide clinical advice or triage;
• may automatically recognise you as an existing patient from the number you call on, and will confirm your identity with you before making any change;
• can only act on the clinic's appointment book, and it confirms every booking, change or cancellation with you before making it.

The speech and language processing is performed by Google's Gemini model via Google Cloud's Vertex AI platform. The website demonstration may use Google's Gemini API instead (see section 7).

To recognise returning patients, our system holds a temporary in-memory index of the clinic's patient names and phone numbers, sourced from the clinic's booking system. This is used solely to match an incoming caller ID to an existing patient record and is never written to disk.

5. Call recording, transcripts and retention

Calls to the AI receptionist are recorded and transcribed. On a clinic's line you are told this at the start of every call; on the website demonstration it is shown on screen.

• Recordings and transcripts are encrypted at rest (AES-256-GCM) and stored on servers physically located in Sydney, Australia.
• They are automatically deleted after 30 days (unless the clinic has configured a different period, or we are required to retain them by law).
• Access is restricted to authorised personnel, and playback through the clinic portal is logged.
• Appointment details the AI enters into the clinic's booking system become part of your patient record held by the clinic, and are kept by the clinic in accordance with health-records law. The short-lived call recording is a quality-assurance record, not your health record.

When any other Personal Information we hold is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify it, unless we are required by law to keep it.

If you prefer not to be recorded or not to speak with an AI:

• Where Voicely answers a clinic's after-hours calls, you can instead call the clinic back during its staffed opening hours, or use the clinic's online booking if it offers one.
• Where Voicely answers a clinic's calls during opening hours, you can ask at any time to be connected to the clinic's reception staff.

6. Third Parties

Where reasonable and practicable to do so, we will collect your Personal Information only from you. In some circumstances we are given information about you by a third party.

The main case is the clinic you called. To serve your request on a call we retrieve your existing patient record, date of birth and upcoming appointment times from the clinic's practice-management system, and we hold a temporary index of the clinic's patient names and phone numbers so that we can recognise you when you ring (see section 4).

Where we receive information about you in this way, we take reasonable steps to ensure that you are made aware of it. Those steps include this policy and the collection notices we supply to clinics for their own websites and booking confirmations.

We do not guarantee the website links or privacy policies of authorised third parties.

7. Disclosure of Personal Information, including overseas

Your Personal Information may be disclosed in a number of circumstances, including the following:

• to the service providers listed below, so that we can provide the service;
• to third parties where you consent to the use or disclosure; and
• where required or authorised by law.

To provide the service we disclose information to the following service providers. Some are located in, or accessible from, the United States of America.

We take reasonable steps to ensure these providers handle your information consistently with the Australian Privacy Principles. Those steps include executed data-processing agreements with Google, Twilio and Fly.io, encryption, and the no-training and no-caching commitments above. We do not disclose your information to anyone else unless required or authorised by law.

8. Security of Personal Information

Your Personal Information is stored in a manner that reasonably protects it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our controls include:

• Encryption in transit (TLS) for all connections, and AES-256-GCM encryption at rest for recordings and transcripts.
• Operational logs are stripped of Personal Information. Spoken content never appears in them.
• Access controls and least-privilege service accounts; network-level filtering of who can reach our phone systems.
• An audit log of portal sign-ins and recording playback, and of decryptions run through our support tooling.
• Automatic deletion of call artifacts after the retention period.

9. Data breaches

We comply with the Notifiable Data Breaches scheme. If a data breach involving your Personal Information is likely to result in serious harm, we will notify you and the OAIC as required by law.

10. Access to your Personal Information

You may access the Personal Information we hold about you, and update or correct it, subject to certain exceptions. Where to ask depends on what you want:

• Your patient record and appointments: contact your clinic directly. The clinic owns and manages your health record.
• Call recordings or transcripts held by Voicely: email contact@voicely.au.

Voicely will not charge any fee for your access request, but may charge an administrative fee for providing a copy of your Personal Information. To protect your Personal Information we may require identification from you before releasing what you have asked for, and we will respond within a reasonable period.

11. Maintaining the Quality of your Personal Information

It is important to us that your Personal Information is up to date. We will take reasonable steps to make sure that your Personal Information is accurate, complete and up-to-date.

The AI works from what it hears, so it reads back the details of any booking, change or cancellation and confirms them with you before it goes ahead. If you find that the information we hold is not up to date or is inaccurate, please tell us as soon as practicable so that we can correct our records.

12. Children and calling on someone's behalf

A parent, guardian or carer may use the service on behalf of a child or another person in their care, and the same protections in this policy apply. The clinic's own consent processes govern the underlying patient record.

13. For clinics using Voicely

This policy describes Voicely's handling of call data. Clinics using Voicely remain responsible for their own privacy obligations, including maintaining their own privacy policy that references their use of Voicely (including the overseas disclosures in section 7), and providing collection notices at their booking touchpoints. Voicely provides suggested wording on request.

14. Policy Updates

This policy may change from time to time. The current version, with its effective date, is available on this page.

15. Privacy Policy Complaints and Enquiries

If you have any queries or complaints about our Privacy Policy, please contact us at:

Arash Heidari trading as Voicely
ABN 97 890 048 856
contact@voicely.au
+61 411 131 939

We will investigate and respond.

Questions? contact@voicely.au