Always honest with callers
Every call starts with your receptionist saying it's your virtual assistant. Anyone who wants a person gets a call back or is put through.
Security and data
Your callers' details,handled with care.
What happens to a call after your AI receptionist answers it: who processes it, how long it's kept, and what your receptionist will never do.
Encrypted in transit and at rest
Calls, transcripts and summaries travel over encrypted connections and are stored by providers that encrypt data at rest.
Kept for 90 days, then deleted
Recordings and transcripts are deleted after 90 days by default. You can ask for a shorter period, or for no recordings at all.
A data processing agreement
You stay in control of your callers' data. We act as your processor under a written agreement, in line with UK and EU GDPR.
Never sold, never used for ads
Call data is used only to run and improve your receptionist. It isn't sold, shared for marketing, or used to train public AI models.
Fails safe
If the AI service ever has an outage, calls fall back to your normal voicemail, so a caller is never left in silence.
Who processes a call
The providers behind every call.
We use established platforms, each with its own security programme. Ask us for the current list at any time.
| What it does | Provider | What it sees |
|---|---|---|
| Phone number and call routing | Twilio | Caller's number, call audio, text summaries sent to you |
| Voice agent platform | Vapi | Call audio, transcript, call log |
| Natural voice | ElevenLabs | Your receptionist's replies, as text to be spoken |
| Language model | OpenAI, through the voice platform | The conversation, to decide what to say next |
| Bookings and records | Your own calendar, CRM or Google Sheets | Booking details you choose to collect |
Some providers process data outside the UK or EEA. Where they do, they use safeguards such as standard contractual clauses.
Your receptionist will
- Say it's a virtual assistant at the start of the call
- Put urgent calls straight through to you, or take a message
- Collect only the details you ask for
- Tell callers to ring emergency services if someone is in danger
Your receptionist won't
- Take card or bank details over the phone
- Give medical, legal or financial advice
- Pretend to be a person
- Make promises outside the rules you set
Questions
Data, in plain English.
Who owns the call data?
You do. You're the data controller for your callers' data, and we process it on your behalf under a data processing agreement.
Can I get a copy of my data, or have it deleted?
Yes. Email us and we'll send an export or delete it. When a contract ends, we delete your call data within 30 days.
Are calls recorded?
Only if you want them to be. If recording is on, your receptionist tells callers at the start of the call. Many clients keep transcripts and summaries only.
Is it HIPAA compliant for US healthcare?
We don't currently sign HIPAA business associate agreements. US clinics can use it for booking and general enquiries without collecting health details; tell us your needs and we'll be straight with you about what fits.
Who at Vocavant can see my calls?
Only the person building and tuning your receptionist, and only to check quality and fix problems.
Need it in writing?
Ask for our data processing agreement.
We'll send it with your pilot, so you can check it with your team before anything goes live.