Encryption
call-2214.transcripta7f3 9c1e 44b0 e2d8 ••••
At restIn transit
Encryption
Data is encrypted at rest and in transit.
Trust Center · Data & security
UAE hosted. Encrypted, access-controlled, auditable.
All health information is stored and processed in the UAE. Here is what each component processes, who controls it, and how it is protected.
Settings · Data locationActive
RegionUnited Arab EmiratesIn country
- HostingUnited Arab Emirates
- Cross-border transferOnly with written authorisation
- EncryptionAt rest and in transit
- AccessRole-based, least privilege
- AuditEvery access and change logged
Health information stays in the UAE
All health information is stored and processed in the UAE. There is no cross-border transfer without the client's written authorisation.
The clinicData controller
- Decides what is processed
- Sets retention and deletion
- Receives patient requests
Documented
instructions
instructions
VoclyAIData processor
- Processes only on instruction
- Bound by the DPA and HBAA
- Hosts in the UAE
What each component processes
| Component | Data processed | Retention | Roles |
|---|---|---|---|
| Voice agents | Caller number and name, call audio while live, transcripts and summaries where enabled, call outcome | Per client configuration; recordings only on written instruction | Clinic: controller · VoclyAI: processor |
| Shared inbox | Messages on WhatsApp, Instagram, TikTok, web chat, email and SMS, attachments, internal notes, assignments | Per client configuration | Clinic: controller · VoclyAI: processor |
| Client portal | Staff accounts and roles, knowledge base content, settings, audit events | For the contract term, then deleted per the agreements | Clinic: controller · VoclyAI: processor |
| Recordings | Call audio and voicemails, only where the client enables recording | Per client configuration; deletable by the client | Clinic: controller · VoclyAI: processor |
Voice agentsUAE hosted
- Data processed
- Caller number and name, call audio while live, transcripts and summaries where enabled, call outcome
- Retention
- Per client configuration; recordings only on written instruction
- Roles
- Clinic: controller · VoclyAI: processor
Shared inboxUAE hosted
- Data processed
- Messages on WhatsApp, Instagram, TikTok, web chat, email and SMS, attachments, internal notes, assignments
- Retention
- Per client configuration
- Roles
- Clinic: controller · VoclyAI: processor
Client portalUAE hosted
- Data processed
- Staff accounts and roles, knowledge base content, settings, audit events
- Retention
- For the contract term, then deleted per the agreements
- Roles
- Clinic: controller · VoclyAI: processor
RecordingsUAE hosted
- Data processed
- Call audio and voicemails, only where the client enables recording
- Retention
- Per client configuration; deletable by the client
- Roles
- Clinic: controller · VoclyAI: processor
On termination the clinic has 30 days to export its data. Data is then deleted from active systems, and backups within 90 days. Deletion is confirmed in writing on request. Where storage is not enabled for a data type, it is processed in real time and not retained.
Encryption, access, audit and monitoring
Breach notification
72 hours
Maximum time to notify the clinic of a personal data breach.
High-risk healthcare breaches
24 hours
For high-risk breaches of health information, or where DHA (NABIDH) or DoH (Malaffi) requirements apply.
Your data, your control
Client-controlled access. No training, no selling.
You decide which systems VoclyAI can reach and with which scopes. Your data is used to serve your patients and nothing else.
- Client-controlled API scopes, withdrawable at any time
- No training on client data without written authorisation
- No selling of data, no advertising use
- Subprocessor list on request, under NDA
For IT, legal and the medical director
Request the documentation pack
Business details only. We send the pack within one working day and answer the reviewer's questions directly.
- Security and data-handling overview
- Data map per component, with controller and processor roles
- Health Business Associate Agreement (HBAA) template
- Data Processing Agreement (DPA) template
- AI transparency statement and safety rules
- Subprocessor list, under NDA
7 days · no IT disruption
Start with a 7-day pilot.
Seven nights on your after-hours line. No IT disruption, and an ROI audit at the end.
- Period
- 7 days
- Pilot
- After-Hours
- Covers
- Nights, weekends, holidays
- Ends with
- ROI audit
voclyai / pilot-plan.md
# 7-day pilot period period: 7 days pilot: After-Hours # voice: nights, weekends, holidays timeline: day 0 setup no IT project day 1-7 live AI disclosed on every call day 8 roi audit answered · captured · recovered rules: disclosure, human on request, 998, no medical advice