Patient data & security
Last updated: 27 September 2026
Your patients’ calls and bookings are encrypted, visible only to your clinic, and never sold. Every caller is told the call is recorded. Here is exactly where the data lives and who can see it.
This page gathers what our Privacy Policy and Terms of Service already say, in one place. If they ever differ, those two documents govern.
Where your data lives
- Database & auth: Supabase, hosted in the AWS Mumbai region (ap-south-1, India).
- Payments: Razorpay (India), which has its own privacy policy.
- Hosting: Vercel serves the website; application data stays in the database above.
Encryption & access control
- Encryption in transit (TLS) and at rest.
- Row-level security is on for every table with no public access, so the database refuses any request that does not come from our own servers.
- Our servers check which clinic you are on every request, and only ever return that clinic’s own data.
- Access to production systems is limited to authorised personnel.
Call recording & consent
Every call your AI receptionist answers is recorded and transcribed. Your portal shows the transcript — exactly what was asked and what was promised, without you having to have been on the line; recordings stay on our voice server. That is disclosed to every caller, not hidden: before your receptionist asks how it can help, it tells the caller, in the language they are speaking, that the call is being recorded. That disclosure happens once, at the very start of the call, every time.
Retention
Call transcripts are deleted automatically 90 days after the call, and sooner on verified request. Call recordings are kept on our voice server for a limited rolling period and are not shown in your portal.
Who can see what
- Your patients’ data is visible to your clinic only, through your own portal.
- Every request is checked on our servers, and each clinic’s queries are scoped to that clinic alone.
- Only authorised personnel can access production systems, and only as needed to run and support the service.
Payments
Payments are processed by Razorpay. We never see or store your card or UPI credentials.
The laws we follow
Our practices are written to satisfy the IT Act 2000 / SPDI Rules 2011 in force today, and to align with the Digital Personal Data Protection Act, 2023 ahead of its enforcement — the same standard stated in our Privacy Policy. The clinical-safety rules that keep the AI receptionist inside a scheduling role (never diagnosis, never a prescription) are covered separately in our Terms of Service.
No certification claims
We do not hold, and do not claim, any third-party security certification today. We would rather say plainly what we actually do — as above — than display a badge we have not earned. If that changes, this page will say so.
Questions
Do you sell or share patient data?
No. Patient data processed on your clinic’s behalf is used for one purpose only — running your front desk: answering calls, booking, confirming and reminding. It is shared only with your clinic and the service providers that run the calls, all listed in our Privacy Policy, and is never sold or rented to anyone.
Is a call with my AI receptionist recorded?
Yes, every call is recorded and transcribed. Before your receptionist asks how it can help, it tells the caller — in the language they’re speaking — that the call is being recorded. That disclosure happens once, at the very start of every call.
Where is the data actually hosted?
Database & auth: Supabase, hosted in the AWS Mumbai region (ap-south-1, India). Payments: Razorpay (India). Hosting: Vercel serves the website; application data stays in the database above.
Can I ask for data to be corrected or deleted?
Yes. Write to our support address and we act within 7 working days — the same commitment and process set out in our Privacy Policy.
Do you hold any third-party security certification?
No. We do not hold, and do not claim, any third-party security certification today. If that ever changes, we will say so here — not before.
Anything else — write to support@docylis.com or use our contact page.