Skip to content
For IT & compliance

Everything a reviewer asks, with the documents to request.

The architecture, what each component processes and where it is hosted, the access and audit model, retention and deletion. Then the documentation pack.

Request the documentation packOpen the Trust Center
Hosting · compliance
UAE HOSTEDDATA IN COUNTRYHIPAACOMPLIANTGDPRCOMPLIANT
  • DHADubai
  • DoHAbu Dhabi
  • MOHAPFederal
  • ADHICSStandard
Documentation packFor IT and legal
  • HBAA · Business Associate AgreementBefore go-live
  • DPA · Data Processing AgreementTemplate
  • Data flow · Data-flow diagram, per componentDiagram
  • Retention · Retention policyClinic-controlled
Request the pack
  • UAE hosted, component by component
  • Role-based access and audit logs
  • DPA, HBAA, transparency statement and security overview
Safety rules

Four rules no setting can switch off

  • AI disclosure on every interactionEvery call and chat opens by saying it is an AI assistant.
  • A human on request, with full contextAsk for a person and the handover carries the whole conversation.
  • 998 emergency protocol, always onA life-threatening situation gets 998 and a person, at once.
  • No medical advice, everIt books, routes and informs. Clinical questions go to your clinicians.
Open the Trust Center
Architecture

Components and where they are hosted

Each component, what it processes and how long it keeps it. The clinic controls retention.

  • Voice agentsUAE

    Call audio while the call is live; transcripts, summaries and recordings only if enabled

    Retention: Per client configuration

  • Vocly InboxUAE

    WhatsApp, SMS, web chat, email, portal messages, voicemail transcripts

    Retention: Per client configuration

  • Client portalUAE

    Call logs, conversation history, analytics, users and roles

    Retention: Per client configuration

  • Knowledge baseUAE

    Clinic business information: services, doctors, hours, insurance, SOPs

    Retention: Until the clinic removes it

  • IntegrationsUAE

    Only the scopes the clinic authorises on its own systems

    Retention: No retention when storage is not enabled

VoclyAI components, data processed, hosting region and retention
ComponentWhat it processesHostedRetention
Voice agentsCall audio while the call is live; transcripts, summaries and recordings only if enabledUAEPer client configuration
Vocly InboxWhatsApp, SMS, web chat, email, portal messages, voicemail transcriptsUAEPer client configuration
Client portalCall logs, conversation history, analytics, users and rolesUAEPer client configuration
Knowledge baseClinic business information: services, doctors, hours, insurance, SOPsUAEUntil the clinic removes it
IntegrationsOnly the scopes the clinic authorises on its own systemsUAENo retention when storage is not enabled
Data flow

One conversation, start to finish

  1. AI disclosure first

    01Patient contacts the clinic

    A call or message reaches the clinic's number or channel. The AI disclosure is the first thing the patient hears or reads.

  2. Knowledge base only

    02The agent answers

    It answers from the clinic's knowledge base and nothing else. No medical advice.

  3. Book · capture · transfer

    03Action

    Books into the calendar where a connector exists, or captures the verified request; transfers to a person on request; 998 for emergencies.

  4. Audit log

    04Record

    The conversation, summary and outcome are written to the patient timeline, visible by role, with every action in the audit log.

Controls

Access, audit, retention, deletion

  • Access model

    Role-based access per branch, team and function. Client-controlled API scopes on every integration.

  • Audit logs

    Every view, reply, takeover, export and setting change is logged with the user and the time.

  • Retention

    Set per client. Recordings and transcripts exist only where the clinic enables them in writing.

  • Deletion

    30 days to export on termination, then deletion from active systems; backups within 90 days; confirmation on request.

  • Encryption

    Encrypted at rest and in transit, with monitoring across the platform.

  • Agreements

    HBAA mandatory before every deployment; DPA available. Licensed healthcare providers only.

Documentation pack

Request the documents

Business details only. We send the pack by email.

  • Data processing agreement (DPA)
  • Health business associate agreement (HBAA)
  • AI transparency statement
  • Security overview
  • Compliance statement: DHA, DoH, MOHAP, ADHICS, HIPAA, GDPR

Business details only. Please do not include patient information.

FAQ

Questions reviewers ask

Who is the data controller?

The clinic is the controller. VoclyAI is the processor and acts only on the clinic's documented instructions.

Is patient data used to train models?

No, not without the clinic's explicit authorisation. Patient data is never sold or used for advertising.

What happens to data when we leave?

You have 30 days to export. Data is then deleted from active systems, backups within 90 days, and deletion is confirmed on request.

How fast are breaches notified?

Within 72 hours, and within 24 hours for high-risk healthcare breaches or where the regulator requires it.

Can we see the subprocessors?

Yes, on written request under a confidentiality agreement.
7 days · no IT disruption

Start with a 7-day pilot.

Seven nights on your after-hours line. No IT disruption, and an ROI audit at the end.

Start a 7-day pilotRequest a demo
Period
7 days
Pilot
After-Hours
Covers
Nights, weekends, holidays
Ends with
ROI audit