How we handle your patients' data
Short version: we don't build our own systems to hold patient records. Every step runs on an established platform that signs the agreement healthcare requires. Bookings live in a Google Sheet that you own.
Last reviewed: 7 November 2026. Vendor terms change, so we re-check them before every new clinic goes live.
United States: HIPAA
For US practices we act as a Business Associate and sign a Business Associate Agreement (BAA) with you before any patient data is shared. Every platform in the chain also signs a BAA.
| Job | Platform | Agreement | Used by |
|---|---|---|---|
| Voice conversations and the clinic knowledge base | Retell AI | BAA, PII redaction on | Receptionist, Recovery Desk callbacks |
| Phone numbers, call forwarding, SMS | Twilio (HIPAA-eligible products only) | BAA | All three |
| Booking sheet and call log | Google Sheets in your Google Workspace | Google Workspace BAA, accepted by your admin on a paid plan | Receptionist, Missed Call Manager |
| Practice-software connection | NexHealth Synchronizer | BAA | Recovery Desk |
| Workflow automation | Keragon | BAA on paid plans | All three |
What we deliberately don't use for US patient data
- WhatsApp. Meta doesn't sign BAAs, so WhatsApp is off the table for US patients.
- General-purpose automation tools without a BAA (for example, Make or n8n Cloud). We use them only for non-patient work.
- Personal Gmail or free Google accounts. The booking sheet must sit in a paid Workspace with the BAA accepted.
India: Digital Personal Data Protection Act, 2023
Your clinic is the Data Fiduciary; we are a Data Processor acting on your instructions under a written data processing agreement. The DPDP Rules were notified on 13 November 2025 and come into force in phases, with most obligations expected from May 2027. We're building to them now.
| Job | How it's handled |
|---|---|
| Booking sheet and call log | A Google Sheet in your clinic's own Google account, shared with our team only while we work with you |
| Messaging | WhatsApp Business Platform through an official Meta Business Solution Provider, using Meta-approved templates only |
| Missed calls and virtual numbers | A licensed Indian cloud-telephony provider; SMS, where used, follows TRAI DLT registration |
| Voice AI | Voice AI platform with a knowledge base built only from documents you approve |
| Who we contact | Patients who gave your clinic their number. Opt-outs are honoured on the first request and kept on a suppression list. |
The local dashboard app
The front-desk dashboard runs on your clinic's computer and signs in with your clinic's Google account. It reads the booking sheet directly from Google, so patient data doesn't pass through Advaya's servers. Because it runs on your machine, keep that computer locked when unattended and use your operating system's disk encryption.
What goes in a message, and what never does
| We do say | We never say |
|---|---|
| "Hi Priya, Dr. Rao asked us to check in about your next visit at Smile Clinic. You can pick a time here: [link]" | Diagnoses, tooth numbers, procedure names, unpublished prices, insurance details, or anything that implies a condition |
| "Reply STOP and we won't message again." | Urgency or pressure ("your tooth may get worse") |
Shared responsibility, in plain terms
| Platforms cover | Advaya covers | Your clinic covers |
|---|---|---|
| Encryption, hosting security, their own audits and certifications, breach notification for their systems | Configuring workflows safely, least-privilege access, message content, opt-out handling, staff training, prompt incident notice | Patient contact consent, your privacy notice, signing the agreements, securing the front-desk computer, deciding who is contacted |
This page describes how we work. It isn't legal advice. For TCPA rules on US texts and calls, state call-recording consent, and your own DPDP obligations, check with your own counsel. We're happy to share our agreements with them.