Privacy Policy

1. Introduction

ViveoAI Ltd ("ViveoAI", "we", "us", or "our") provides AI receptionist and conversational voice services to dental and healthcare practices in the United Kingdom and Ireland.

This Privacy Policy explains how we collect, use, store, and protect personal data when:

• You visit our website (viveoai.com)
• You contact us or book a demo
• A clinic uses our AI receptionist service

We are committed to processing personal data in accordance with:

• UK GDPR
• EU GDPR (where applicable)
• UK Data Protection Act 2018

2. Our Role: Controller vs Processor

A. When We Act as Controller

ViveoAI acts as the Data Controller for:

• Website visitors
• Demo bookings
• Sales enquiries
• Marketing communications

In these cases, we determine the purpose and means of processing.

B. When We Act as Processor

When providing AI receptionist services to clinics:

• The dental clinic is the Data Controller
• ViveoAI acts as a Data Processor
• We process patient/caller data strictly under the clinic's instructions

If you are a patient of a clinic using ViveoAI, the clinic is responsible for your data.

3. Personal Data We Collect

A. Website & Enquiry Data (Controller Data)

We may collect:

• Name
• Email address
• Phone number
• Practice/organisation name
• Message content
• Demo scheduling details
• IP address and device/browser information
• Website usage data (via analytics tools, if enabled)
• Cookies and similar technologies

B. AI Receptionist Service Data (Processor Data)

Depending on the clinic's configuration and caller interaction, this may include:

• Caller phone number
• Call metadata (date, time, duration)
• Call audio recordings
• Call transcripts
• Appointment-related information
• Information voluntarily provided during calls

This may include health-related information where a caller chooses to provide it.

We process this data solely to provide the contracted receptionist service.

4. Legal Bases for Processing (Controller Data)

We rely on the following lawful bases:

• Contract / pre-contract steps - Responding to demo requests or enquiries
• Legitimate interests - Operating and improving our website and services
• Consent - Where required for marketing communications or non-essential cookies
• Legal obligations - Where required by law

When acting as a Processor, we rely on the clinic's lawful basis.

5. How We Use Personal Data

We use personal data to:

• Provide AI receptionist services
• Respond to enquiries
• Deliver product demonstrations
• Maintain and improve service performance
• Ensure system security and integrity
• Comply with legal obligations

We do not sell personal data.

6. Sub-Processors and Service Providers

To deliver our services, we use carefully selected third-party providers who process data on our behalf, including providers of:

• AI voice processing and transcription services
• Telephony and communications infrastructure
• Cloud hosting and dashboard infrastructure
• Website analytics and performance monitoring

All sub-processors operate under written Data Processing Agreements and are required to implement appropriate technical and organisational safeguards.

A current list of sub-processors is available upon request.

7. International Data Transfers

Some service providers (including AI voice processing providers) may process personal data outside the UK or EEA, including in the United States.

Where international transfers occur, we rely on appropriate safeguards, including:

• UK Addendum to the EU Standard Contractual Clauses
• EU Standard Contractual Clauses
• Other lawful transfer mechanisms recognised under applicable data protection laws

8. Data Retention

We retain personal data only for as long as necessary.

Unless otherwise agreed with a clinic:

• Call recordings: 30-90 days
• Call transcripts: retained for the duration of the client contract unless deleted earlier
• Call metadata/logs: up to 12 months
• Website enquiries: up to 24 months
• System backups: retained for limited rolling periods

Data is deleted or anonymised when no longer required, subject to legal obligations.

9. Security Measures

We implement appropriate technical and organisational measures, including:

• Encryption in transit
• Access controls and role-based permissions
• Secure cloud hosting
• Monitoring and logging
• Incident response procedures

Access to call recordings and transcripts is restricted to authorised users only.

10. Data Subject Rights

If You Contact ViveoAI Directly

You may request:

• Access to your data
• Correction of inaccurate data
• Deletion (where applicable)
• Restriction of processing
• Data portability
• Objection to processing

Requests should be sent to: info@viveoai.com

We will respond within one month.

If You Are a Patient of a Clinic Using ViveoAI

The clinic is the Data Controller. You should contact the clinic directly.

We will assist the clinic in responding to lawful requests.

11. Data Breach Notification

In the event of a personal data breach affecting Controller data, we will notify relevant authorities and affected individuals where required by law.

When acting as a Processor, we notify the clinic without undue delay in accordance with our contractual obligations.

12. Cookies

Our website uses essential cookies for functionality.

Where analytics or marketing cookies are enabled, we obtain consent where required by UK law (PECR).

You may manage cookie preferences through your browser or cookie banner settings.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised effective date.

14. Contact

For questions about this Privacy Policy or our data practices:

Email: info@viveoai.com

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your relevant supervisory authority.