Privacy Policy

1. Who This Policy Applies To

This policy applies to:

• Clinicians and healthcare professionals who use the EHealthVoice AI platform to manage patient communications and scheduling
• Healthcare practice administrators who manage organisational accounts
• Visitors to ehealthmed.ai and ehmed.ai

It does not apply to patients whose speech may be processed through the platform. Patients do not create accounts and no patient data is retained by EHealthMed. See Section 4 for details.

2. The Controller

The data controller responsible for your personal information is:

3. Information We Collect

3.1 Account Registration Data

When you create an account, we collect:

We do not collect your name, date of birth, phone number, or any demographic information unless you voluntarily provide it when contacting support.

3.2 Usage and Audit Logs

For security and compliance purposes, we maintain an audit log that records:

Audit logs do not contain any speech audio, transcribed text, or clinical notes. They record only metadata (when, who, which agent type) — never the content of any medical communication.

3.3 Device and Technical Data

When you use the platform, we may automatically receive:

• Device type and operating system version (for compatibility and crash reporting)
• Browser version and app version number
• General geographic region derived from IP address (country level only, not precise location)

We do not use device fingerprinting or persistent advertising identifiers.

4. What We Deliberately Do Not Collect or Store

This section is central to the design of EHealthVoice AI and is a core commitment to our users.

All speech audio, transcription output, and AI-generated responses are processed during an active voice session. When the session ends, real-time processing data is discarded. Call recordings and transcripts are stored only when explicitly enabled by the healthcare practice and are encrypted at rest.

This architecture means that EHealthVoice AI is designed to minimise Protected Health Information (PHI) exposure as defined under the HIPAA Privacy Rule (45 CFR §160.103). Where PHI handling is necessary for EHR integration, it is governed by Business Associate Agreements.

5. Third-Party Services

To deliver the voice AI and integration functionality, data may be transmitted to the following third-party processors during active sessions:

We are in the process of executing Business Associate Agreements (BAAs) with all applicable third-party processors as required under HIPAA. Enterprise customers requiring a BAA with EHealthMed Ltd should contact [email protected].

6. How We Use Your Information

We use the information we collect for the following purposes:

We do not sell your personal data to third parties. We do not use your data for advertising or behavioural profiling.

7. Data Retention

8. Data Security

We implement the following technical and organisational measures to protect your data:

No security system is infallible. In the event of a data breach that affects your personal information, we will notify affected users and relevant regulatory authorities within the timeframes required by applicable law.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

We will respond to all rights requests within 30 days. We may ask you to verify your identity before fulfilling a request.

10. Children's Privacy

The Service is intended for use by licensed healthcare professionals and is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it promptly.

11. International Data Transfers

EHealthMed's backend infrastructure is hosted in the United States. If you access the Service from outside the United States, your account data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards for transfers of personal data from the EEA or UK to the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered users by email at least 14 days before the change takes effect
• Where required by law, seek your consent before applying the change

Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.

13. Contact Us

For privacy-related enquiries, data subject rights requests, or to report a concern:

We aim to respond to all enquiries within 5 business days.

This Privacy Policy was last reviewed and approved on 13 March 2026.