AI assistant add-on

1. What this is

This add-on is part of the Data Processing Agreement between you, the clinic (the controller), and Apavai Ltd, trading as Clinic Membership (the processor). It applies only when you accept it and turn the AI assistant on. Version 2026-11-05.

You remain the controller for your patients. We process their data only on your instructions, including this add-on and your use of the assistant.

2. What the assistant does

• Twilio connects the phone call. We do not record the call, and the call setup does not ask Twilio to store a recording.
• Deepgram, in the EU, turns speech into text and speaks the reply. Model training is turned off. The audio is not kept after the request.
• The text goes to OpenAI in the United States so the assistant can reply and use the diary. OpenAI does not train on it. OpenAI may keep that text for up to 30 days to check for abuse. We do not keep a recording.
• From the patient file we send the first name only. A date of birth or postcode used to check who is calling is checked on our servers and is not sent to OpenAI.
• If the caller says their full name, email, or a treatment, those words can be in the text, because that is what they said.
• A booking, move, or cancellation is saved on the patient record, in the same way a receptionist would enter it.
• We keep a short note of a call or chat: the time, how long a call lasted, the patient’s name once known, the number the call came from when we have it, and what happened. That can be a booking, a change, a cancellation, a question we could not answer, or a message the patient asked us to pass to the clinic. The name and number stay on the clinic’s activity list so the clinic can see who called and ring back. Only the first name is sent to OpenAI. If the patient asks us to pass a message, we email the clinic what was said on that call or chat. We do not keep that conversation after it is sent.

3. Health data

A treatment name or a visit, together with a person’s name, can be data concerning health. You confirm that you have a lawful basis, and a condition for using health data, before you turn the assistant on. The assistant does not give medical advice, and a booking is made only after the caller agrees.

4. Providers and transfers

You authorise Twilio, Deepgram, and OpenAI as sub-processors for this assistant only. Deepgram processes in the EU. OpenAI processes in the United States under the UK Addendum to the standard contractual clauses in OpenAI’s data processing terms. Twilio connects the call and does not keep a recording for us. Other providers in the main agreement are unchanged. We will tell you before we add or replace a provider, and you can object.

5. What you tell patients

You will publish a sentence in your own privacy notice so patients can read how the assistant handles their words. Paste that sentence from the assistant setup screen, and keep the impact assessment with your clinic records.

6. Turning it off

When you turn the assistant off, we stop using it for new calls and chats. Bookings already saved on the patient record stay until you delete them under the main agreement.