Encryption
call-2214.transcripta7f3 9c1e 44b0 e2d8 ••••
At restIn transit
Encrypted
At rest and in transit.
Trust Center
Rules a regulator and a patient can read.
One link for IT, legal and the medical director: the safety rules, where data lives, how it is protected, what is signed before go-live, and the frameworks VoclyAI complies with.
Trust summary
- DHA
- DoH
- MOHAP
- ADHICS
- AI disclosure on every interaction
- A human on request, with full context
- 998 emergency protocol, always on
- No medical advice, ever
Rules, not settings
These apply on every channel and cannot be turned off by a client.
UAE hosted
Patient communication data stays in the UAE
Health information is stored and processed in the UAE. It is not transferred abroad without your written authorisation.
- What is processed
- Calls, messages, transcripts and summaries you enable
- For how long
- Per your retention configuration
- Who controls deletion
- You, as the data controller
No cross-border transfer
Patient call or messageWhatsApp, phone, web chat, email
United Arab Emirates
UAE data centreStored and processed in country
Clinic portalTranscripts, summaries, audit log
Transfer abroadOnly with your written authorisation
- What is processed
- Calls, messages, transcripts and summaries you enable
- For how long
- Per your retention configuration
- Who controls deletion
- You, as the data controller
Protected, limited and logged
Signed before a single patient call
Compliant with DHA, DoH, MOHAP, ADHICS, HIPAA and GDPR
- DHADubaiHealth data hosted in the UAE, logged, with a 24-hour breach window under NABIDH.
- DoHAbu DhabiThe same handling for Abu Dhabi facilities, with the Malaffi 24-hour window.
- MOHAPFederalHealth information stays in the UAE unless the facility authorises otherwise.
- ADHICSStandardEncryption, role-based access, audit logs and incident response.
- HIPAAUnited StatesUS patients' data under HIPAA safeguards, with an HBAA in place.
- GDPREuropean UnionEU patients' data processed on the clinic's instructions, under a DPA.
Hosting · compliance
- DHADubai
- DoHAbu Dhabi
- MOHAPFederal
- ADHICSStandard
Documentation packFor IT and legal
- HBAA · Business Associate AgreementBefore go-live
- DPA · Data Processing AgreementTemplate
- Data flow · Data-flow diagram, per componentDiagram
- Retention · Retention policyClinic-controlled
Trust Center pages
AI safety & transparency
The rules with example scripts, Copilot guardrails, limitations and patient rights.
ReadData residency & security
The data map, encryption, access, audit and breach notification.
ReadCompliance
What each framework means for patient communication.
ReadLegal
Privacy policy, terms and the AI transparency statement.
ReadFor IT, legal and the medical director
Request the documentation pack
Business details only. We send the pack within one working day and answer the reviewer's questions directly.
- Security and data-handling overview
- Data map per component, with controller and processor roles
- Health Business Associate Agreement (HBAA) template
- Data Processing Agreement (DPA) template
- AI transparency statement and safety rules
- Subprocessor list, under NDA
Questions reviewers ask first
Where is our data hosted?
In the UAE. Health information is not transferred outside the UAE without your written authorisation.
What do we sign before go-live?
A Health Business Associate Agreement (HBAA), which is mandatory, a Data Processing Agreement (DPA) and the terms. Both agreements are part of the documentation pack.
Who can use VoclyAI?
Licensed healthcare providers only.
Do you train AI models on our data?
No, not without your explicit written authorisation. We never sell data and never use it for advertising.
7 days · no IT disruption
Start with a 7-day pilot.
Seven nights on your after-hours line. No IT disruption, and an ROI audit at the end.
- Period
- 7 days
- Pilot
- After-Hours
- Covers
- Nights, weekends, holidays
- Ends with
- ROI audit
voclyai / pilot-plan.md
# 7-day pilot period period: 7 days pilot: After-Hours # voice: nights, weekends, holidays timeline: day 0 setup no IT project day 1-7 live AI disclosed on every call day 8 roi audit answered · captured · recovered rules: disclosure, human on request, 998, no medical advice