Privacy Policy

MediVoice AI ("we", "us", "our") is committed to protecting the privacy of our clients (clinics and hospitals) and their patients. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our AI voice agent platform ("Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

We collect the following types of information:

**Account Information:** When a clinic registers, we collect the name, email address, phone number, clinic name, and billing information of the authorized administrator.

**Patient Communication Data:** Our AI records and transcribes phone calls between patients and the AI system. This includes caller phone numbers, call recordings (where permitted by local law), call transcripts, appointment details, and any information volunteered by the patient during the call.

**Usage Data:** We collect data on how the Service is accessed and used, including log data, device information, and dashboard interaction data.

**Payment Information:** Payment is processed through Razorpay. We do not store full credit card numbers on our servers.

We use collected information to:

• Provide, operate, and maintain the Service • Process appointments, reminders, and patient communications on behalf of clinics • Improve and personalize the AI voice agent's accuracy and performance • Send transactional and administrative communications to clinic administrators • Comply with legal obligations and enforce our Terms of Service • Detect and prevent fraud or misuse

We do not sell, trade, or rent your personal information or patient data to third parties.

All data is stored on India-based servers. We implement industry-standard security measures including:

• Encryption in transit (TLS 1.3) • Encryption at rest (AES-256) • Role-based access controls with audit logs • Regular security assessments • HIPAA-ready architecture for healthcare compliance

While we implement safeguards, no system is 100% secure. We encourage clinics to use strong passwords and restrict dashboard access to authorized personnel.

MediVoice AI processes patient data as a data processor on behalf of clinics (who are the data controllers). Clinics are responsible for obtaining appropriate patient consent for AI-mediated communications as required by applicable law. We will process patient data only as instructed by the clinic and as described in this policy. We sign Data Processing Agreements (DPAs) with Enterprise clients.

Call recordings are retained for 90 days by default (configurable per clinic). Appointment and patient records are retained for the duration of the client's subscription. On account termination, all data is permanently deleted within 30 days. Clients may request an export of their data at any time.

We use the following third-party services in delivering the Service:

• Supabase (database hosting) • Twilio / Exotel (telephony) • Razorpay (payment processing) • Sarvam AI (Indian language speech processing) • OpenRouter (AI language models)

Each service is governed by its own privacy policy. We ensure data sharing agreements are in place for all sub-processors.

Clinic administrators have the right to:

• Access all data stored about their clinic and patients • Correct inaccurate data • Delete data at any time from the dashboard • Export data in standard formats • Opt out of non-essential communications

To exercise these rights, contact us at privacy@medivoice.ai.

We may update this Privacy Policy from time to time. We will notify clinic administrators of material changes via email at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For privacy-related questions, data requests, or to report a concern:

Email: privacy@medivoice.ai Address: MediVoice AI, Bengaluru, Karnataka, India