Privacy Policy

1. Who We Are

Receptra AI provides AI-powered voice receptionist services for medical clinics in the UAE. Our service, Sara, handles inbound patient calls, books appointments, and transfers enquiries to clinical staff.

Receptra AI operates as a data processor on behalf of clinic clients (who are the primary data controllers for patient health records). In relation to enquiries from prospective clients and website visitors, Receptra AI acts as a data controller in its own right.

2. What Personal Data We Collect

2.1 Patient data (collected on behalf of clinic clients)

When Sara handles an inbound patient call, the following data may be collected:

• Full name
• Phone number (inbound caller ID and any number provided verbally)
• Preferred doctor or specialist
• Requested appointment date and time
• Reason for visit (which may include health information)
• Language preference

Health information disclosed voluntarily during a call (symptoms, conditions, medical history) is special category data under UAE PDPL Article 2 and is handled with additional safeguards — see Section 7.

2.2 Website visitor data

Standard web server logs may record your IP address, browser type, and pages visited. This data is anonymised and used only for security and performance monitoring. No personal profiling is carried out.

2.3 Prospective client and partner data

If you contact us via the website or email, we may collect your name, email address, phone number, company name, and the content of your enquiry.

2.4 Data we do not collect

• Payment card data (handled by third-party payment processors)
• Government ID or Emirates ID details
• Biometric data
• Data from children under 18 — Sara transfers calls involving minors to a human receptionist

3. How and Why We Use Your Data

We process personal data only for specified, explicit, and legitimate purposes under UAE PDPL Article 4.

We do not use your personal data for marketing or advertising without your explicit consent. We do not sell personal data to any third party.

4. Consent — How We Obtain It and Your Right to Withdraw

4.1 Verbal consent notice

At the start of every call, Sara delivers this notice before any personal data is collected:

By continuing the call after this notice, the patient provides affirmative consent to the call being recorded. Patients who do not wish to consent may end the call at any time before providing personal information.

4.2 Withdrawing consent

You may withdraw consent at any time by emailing maaz@receptra.co with the subject line "Consent Withdrawal Request". Upon receiving your request we will:

• Acknowledge receipt within 5 business days
• Permanently delete any call recording held for you
• Delete associated appointment data from our systems
• Notify the clinic so they can update their records
• Send written confirmation of deletion within 30 days

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Who We Share Your Data With

All processors are bound by Data Processing Agreements requiring them to process data only on our instructions and to maintain appropriate security standards.

We do not share personal data with any other third parties except where required by UAE law or a valid legal order from a competent authority.

6. International Data Transfers

Some processors are located outside the UAE. When personal data is transferred internationally, we ensure appropriate safeguards are in place in accordance with PDPL Articles 22–24.

For transfers to Retell AI (USA), a Transfer Impact Assessment is on file and a UAE PDPL Data Transfer Addendum has been submitted for signature, applying EU Standard Contractual Clauses by analogy. Retell AI holds SOC 2 Type 2 certification.

We have confirmed that Federal Law No. 2 of 2019 on ICT in Health applies to licensed health authorities and providers, not to technology vendors such as Receptra AI. A formal inquiry has been submitted to the Dubai Health Authority for confirmation.

7. Health Data

Health information voluntarily disclosed during a call is special category data under PDPL Article 2. We handle it with additional safeguards:

• Processed only to the extent needed to book the appointment or transfer the call
• Stored in Retell AI's HIPAA-eligible, SOC 2 Type 2 certified infrastructure
• Permanently deleted after 90 days
• Sara does not proactively solicit detailed health information
• The clinic is responsible for managing health records beyond call booking

8. How Long We Keep Your Data

9. Your Rights

Under the UAE PDPL you have the following rights. Send all requests to maaz@receptra.co. We respond within 30 days.

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion where data is no longer necessary or consent has been withdrawn
• Right to data portability — request your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — request restriction in certain circumstances
• Right to withdraw consent — see Section 4.2 for the withdrawal process

If you are not satisfied with our response, you may lodge a complaint with the UAE Data Office at uaedataoffice.ae.

10. Security

• All data in transit is encrypted using TLS 1.2 or higher
• Data at rest is encrypted by our processors (Retell AI AES-256; Google Workspace AES-256)
• Access to clinic configuration data and call records is restricted to authorised personnel only
• Retell AI is SOC 2 Type 2 certified
• In the event of a data breach, the UAE Data Office will be notified within 72 hours and affected individuals notified where the breach poses a high risk

11. Cookies

receptra.co is a static website. We do not use tracking cookies, advertising cookies, or third-party analytics that collect personal data. Standard server-side logs are retained for 90 days for security purposes and anonymised before that period expires.

12. Children's Data

Sara is not designed to collect personal data from individuals under 18. Where Sara identifies that a caller may be a minor, the call is transferred to a human receptionist. If a parent or guardian believes a child's data has been collected in error, please contact maaz@receptra.co for immediate deletion.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always published at receptra.co/privacy with the effective date clearly stated. For material changes that affect how we process your data, we will provide notice on our website at least 14 days before the change takes effect.

14. Contact Us

For questions about this policy, to exercise your rights, or to make a complaint: