Privacy policy

VoclyAI is a company registered in Dubai, United Arab Emirates, with its office at The Plaza By Radisson Blu Hotel, Dubai.

Questions about this policy or about personal data can be sent to info@voclyai.com or to +971 54 507 3413 (call or WhatsApp).

This policy covers personal data processed through every channel the platform operates for a client: voice calls (inbound and outbound), WhatsApp, Instagram, TikTok, website chat, email, SMS. It also covers the client portal (the dashboard, shared inbox, knowledge base and reporting), call recordings and transcripts where enabled, and this website.

The platform is offered only to licensed healthcare providers. It is an administrative communication tool. It is not a medical device and is not used for diagnosis, treatment or clinical triage.

For patient communication data, the healthcare provider that uses VoclyAI (the "client") is the data controller. VoclyAI is the data processor and acts only on the client's documented instructions, as set out in the Data Processing Agreement (DPA) and the Health Business Associate Agreement (HBAA).

For business contact details of client staff, website visitors and people who send us an enquiry, VoclyAI is the controller.

Account and business data

Names, work email addresses, phone numbers and roles of client staff; clinic and branch details; billing and contract information.

Patient communication data (processed for the client)

• Caller or sender name, phone number, social media handle or email address
• Message content on WhatsApp, Instagram, TikTok, website chat, email and SMS
• Call recordings and transcripts, only where the client has enabled them in writing
• Conversation summaries, intents, outcomes, tags and internal staff notes
• Appointment details such as requested service, doctor, branch, date and time
• Insurance network or card details where the patient shares them for an administrative purpose
• Voicemails and their transcriptions

Technical and usage data

Log data, device and browser information, IP addresses, audit events in the portal and service performance data.

Website and enquiry data

Details you submit through our forms (name, clinic, work email, phone or WhatsApp, services of interest, current clinic system, message). Our forms ask for business details only. Please do not submit patient information through the website.

• To provide the services the client has configured: answering calls and messages, booking or capturing appointment requests, reminders and recalls, routing and handover to staff
• To operate the shared inbox, the patient timeline and reporting for the client's team
• To keep the platform secure, monitored and auditable
• To bill the client and manage the contract
• To answer enquiries and send information a business contact has requested
• To meet legal and regulatory obligations

We process patient communication data only for the purposes the client instructs. We do not decide on our own why or how patient data is used.

• We never sell personal data.
• We never use patient data for advertising.
• We never use client or patient data to train AI models without the client's explicit written authorisation.

We may use aggregated, fully anonymised service data, from which no person or client can be identified, to maintain and improve the platform.

Patient communication data is hosted and processed in the United Arab Emirates. Health information is not transferred outside the UAE without the client's prior written authorisation and an appropriate legal basis, consistent with Federal Law No. 2 of 2019 on the use of information and communication technology in health fields.

Retention periods for recordings, transcripts, messages and summaries follow the client's configuration and its own regulatory obligations. Where storage is not enabled for a data type, it is processed in real time and not retained.

• On termination, the client has 30 days to export its data.
• After that period, data is deleted from active systems.
• Backups are deleted within 90 days of deletion from active systems.
• We confirm deletion in writing on request.

Data is encrypted at rest and in transit. Access is role-based and limited to what each person needs. Every access and change in the portal is written to an audit log. Systems are monitored for unusual activity.

Clients control which of their systems the platform may access and with which scopes. Access can be withdrawn by the client at any time.

Further detail is available in our documentation pack, which clients and prospective clients can request from info@voclyai.com.

We share personal data only with:

• Hosting and infrastructure providers that process data on our behalf under written agreements
• Telecom and messaging providers needed to deliver calls and messages, including TDRA-licensed telecom partners in the UAE
• Integrations the client has authorised, such as its calendar, clinic system or CRM
• Competent authorities where the law requires it
• A successor entity in a merger or acquisition, under the same obligations

The list of subprocessors is available to clients on written request under a confidentiality agreement.

If we become aware of a personal data breach affecting client data, we notify the client without undue delay and within 72 hours. For high-risk breaches involving health information, or where DHA (NABIDH) or DoH (Malaffi) requirements apply, we notify the client within 24 hours. We support the client with the information it needs to notify regulators and affected individuals.

Under Federal Decree-Law No. 45 of 2021 on the protection of personal data, and other laws that may apply, individuals may have the right to be informed, to access their data, to correction, to deletion, to restriction and to object.

Patients should send requests to their healthcare provider, which is the controller. If a request reaches us, we pass it to the provider without delay and act only on the provider's written instruction.

Business contacts and website visitors can write to info@voclyai.com.

The platform and this website are not intended for people under 18. Where a client's patients include minors, their data is processed only under the client's authority and its own consent procedures.

This website uses cookies that are needed for it to work, and, where you agree, analytics cookies to understand how pages are used. You can decline non-essential cookies at any time. A list of the cookies in use is available from info@voclyai.com.

We will post changes on this page with a new version number and effective date. Material changes affecting clients are notified to them in advance.

This policy is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai.