Our commitment
We handle conversations with your patients, your customers and your users. We publish these commitments because you should be able to hold us to them, and because a commitment nobody can check is not a commitment — it is a slogan.
The six commitments
Not what sounds good, but what you can hold us to if we fail.
We process the minimum the flow needs and document it before the first call: what is collected, on what legal basis, for how long, and who can access it. We sign a DPA as processor with every customer. If a flow involves special categories of data, it is assessed separately and in writing.
Encryption in transit and at rest, role-based access control and an audit trail for every operation on personal data. Our team’s access to customer data is named, time-limited and logged.
We do not clone real people’s voices without explicit consent, and we do not use voice to impersonate a specific human identity. The agent identifies itself as automated where appropriate: deceiving the caller damages your relationship with them, not ours.
If the system fails, calls fall back to your existing number. Automating must never mean losing your phone line. The failover is tested during the trial phase, not on the day it is needed.
You can review what the agent does, on what instructions, and what it decided on each call. No black box: the script is yours, you approve it before production and you have it in writing.
Service levels are agreed in writing and reviewed with you against the metric we set at the start, not against a vanity dashboard.
Your data
This is usually buried in small print. We put it here because it is the first question any data lead asks, and because the answer is short.
If we ever wanted to use your call data to improve models, it would need your explicit, written and revocable authorisation. By default, it does not happen.
Read the privacy policySpecific commitments
With the person on the line
Your customer has signed nothing with us. They are still the person talking to the agent, and there are things we will not do to them.
The agent says what it is where appropriate, and always when asked directly. It does not maintain the fiction of being a person.
We agree an attempt limit with you, and a request not to be called again is honoured immediately and permanently.
If the caller asks for a person, the call is transferred or a callback is scheduled. They are not sent round in circles.
It repeats information, slows down when it detects difficulty, and does not assume the caller knows your terminology.
A clinical urgency, a complaint or a distressed person are not cases to automate. There, the agent yields.
If your organisation enables recording, notice is given as the law requires. We publish the clause we apply.
What data and compliance leads ask us.
In the European Union. Where a sub-processor sits outside the EEA, we declare it in the DPA with Chapter V safeguards and notify you before adding it, not after.
Only staff assigned to your project, with named, time-limited and logged access. There are no shared logins or generic accounts, and access is withdrawn when the work closes.
Yes, on the terms set in the DPA. We provide the information needed to demonstrate compliance with Article 28 GDPR and cooperate with audits we agree.
We notify you without undue delay, with the information you need to meet your own notification obligations. The procedure and timescales are set out in the DPA.
No. It can use your company name and present itself as its assistant, but it does not adopt a specific employee’s identity or claim to be human when asked.
We would rather argue about a commitment now than break it later. Write to us and we will go through it with your legal or compliance team.
