Privacy Policy

Purpose and Scope

Why This Policy Exists & Who It Applies To

This privacy policy explains how Aeva Limited ("Aeva", "we", "us", "our") collects, uses, shares, and protects personal data to:

• Maintain transparency about data handling practices
• Help individuals understand their privacy rights
• Comply with applicable privacy laws
• Build trust with medical clinic customers and their patients

This policy applies to:

• Customers: Medical clinics and their staff
• End Users: Patients and callers whose data is processed through our AI receptionist
• Online Users: Website visitors
• Partners: Business partners and vendors

Note: Aeva operates as a data processor on behalf of medical clinics who are the data controllers. Clinics maintain the primary relationship with patients and are responsible for obtaining appropriate consent.

Types of Personal Data Collected

Customer-Provided & Processed Data

Business Information

• Business name and clinic contact information
• Staff names and email addresses
• Cliniko or similar software API key or credential equivalent

Account Details

• Account credentials and user preferences
• Payment information for service purchases

Call Data (processed on behalf of customers)

• Call recordings and transcripts
• Patient names, phone numbers, dates of birth and appointment details

Automatically Collected Data

• Device information (type, operating system, browser)
• IP address and general location
• Usage analytics and log data for security and service improvement

Cookies and Similar Technologies

How We Use Cookies

Aeva uses cookies and similar technologies to operate our website and services, analyze usage, enhance security, and personalize your experience.

Types of Cookies

Managing Your Preferences

You can control cookies through your browser settings to block or delete cookies. Note that blocking essential cookies may impact service functionality.

We currently use a cookie consent banner for EU visitors in compliance with GDPR. Non-essential cookies are only used where permitted by applicable law without explicit consent.

For more information about managing cookies, visit www.allaboutcookies.org.

Purposes of Data Use

Service Delivery & Operations

• Providing and maintaining our AI receptionist service
• Account creation and management
• Processing transactions and payments via Stripe
• Handling and transcribing calls through our voice platform (Vapi) and speech-to-text providers
• Analysing call content using AI providers (Google, OpenAI, Anthropic)
• Storing call recordings and transcripts in Microsoft Azure (Australia)
• Sending appointment confirmations through ClickSend
• Ensuring platform security and preventing fraud
• Analyzing usage patterns to improve services
• Facilitating outbound calls to existing patients on behalf of Clinics for appointment-related communications (e.g., practitioner unavailability notifications, follow-up scheduling)

Communication & Legal Obligations

• Responding to inquiries and support requests through Intercom
• Sending service-related notifications and updates via Postmark
• Complying with applicable laws and regulations
• Enforcing our terms of service
• Sending marketing communications (with consent)

Legal Basis for Processing

Consent, Contract & Legitimate Interests

We process personal data only when we have a valid legal basis:

Collection Practices & Data Sharing

Notification & Consent Management

We inform customers about data collection through:

• Website notices and direct communication
• Registration and onboarding processes
• Subscription agreements

For end users (patients), medical clinics are responsible for obtaining appropriate consent.

Outbound Calling Consent: Before activating the Outbound Calling Service, Clinics must acknowledge that they have appropriate patient consent and will comply with applicable regulations. This acknowledgement, including timestamp and the consenting user's details, is logged and retained for compliance purposes.

Privacy preferences can be managed via:

• Account settings
• Unsubscribe links in communications
• Direct contact with our privacy team at updates@aevaai.com

Internal Use & Third-Party Providers

Internal Access

• Limited to named authorised Aeva personnel (engineering and support staff) on a need-to-know basis
• Protected by access controls, confidentiality agreements, and multi-factor authentication

Service Providers

• Process data only for specified purposes under written contracts
• Must maintain appropriate security controls
• Key providers (purpose and location):
  • Microsoft Azure — storage of call recordings, transcripts and call logs (Australia)
  • Heroku (Salesforce) — application hosting and database (United States)
  • Vapi — voice platform for real-time call handling (does not store call content) (United States)
  • Twilio — phone numbers and call connectivity (United States)
  • Soniox; AssemblyAI (backup) — speech-to-text, via Vapi (United States)
  • ElevenLabs; Cartesia (backup) — receptionist voice (text-to-speech), via Vapi (United States)
  • Google (Gemini); OpenAI — AI models that run the conversation (United States)
  • Anthropic; OpenAI (backup) — post-call transcript analysis and call summaries (United States)
  • Cerebras — answering caller questions from the clinic's FAQs (United States)
  • ClickSend — SMS to patients (Australia)
  • Postmark — transactional email to clinics and patients (United States)
  • Stripe — subscription billing; deposits through the clinic's own connected Stripe account (United States)
  • SolarWinds (Papertrail) — application logs (United States)
  • Slack — internal operational notifications (United States)
  • Intercom — customer support (United States)
  • HubSpot; GoHighLevel — CRM and onboarding (clinic contacts only) (United States)
  • Google Workspace — internal email and documents (United States)
• Cliniko, Splose, Nookal, PracSuite and other practice-management systems are the clinic's own systems. Aeva accesses them on the clinic's behalf using credentials the clinic provides; they are not Aeva sub-processors.

Cross-Border Transfers

• Call recordings, transcripts and call logs are stored in Australia, in Aeva's own Microsoft Azure storage (Australia East, Sydney). Our voice platform (Vapi) does not store them.
• Calls are processed in real time, and transcripts are analysed after the call, by AI and voice providers in the United States. Aeva's application database, hosted on Heroku in the United States, holds caller names, phone numbers, dates of birth, appointment details and call summaries.
• UK and EU personal data: transfers to Aeva in New Zealand are covered by adequacy decisions. Onward transfers to US providers rely on the EU–US Data Privacy Framework and its UK Extension (UK–US Data Bridge) where the provider is certified (for example Salesforce/Heroku); otherwise on Standard Contractual Clauses with the UK Addendum, or the UK IDTA, in the provider's data processing agreement.
• Australian personal information: overseas disclosures are made under APP 8. Recipients are contractually bound to protect the information, and Aeva remains accountable for their handling of it.
• New Zealand personal information: overseas disclosures meet IPP 12 through comparable safeguards in our providers' contracts.

Outbound Calling Data

The Outbound Calling Service uses existing patient data from the Clinic's connected practice management system (e.g., Cliniko) to facilitate calls. This includes:

• Patient name and phone number
• Appointment history and practitioner associations
• Call recordings and transcripts (processed identically to inbound calls)

No additional personal data categories are collected for outbound calling beyond what is already processed for the inbound reception service. Clinics select which patients to contact; Aeva processes this data solely on the Clinic's instructions as data processor.

If a patient requests during an outbound call not to be contacted again, this is recorded and communicated to the Clinic. Clinics are responsible for maintaining opt-out records as the data controller.

Data Retention & Individual Rights

Retention Periods

• Call Recordings, Transcripts, Call Logs and Patient-Related Data: Kept while the subscription is active. Deleted within 60 days of cancellation, or earlier at the clinic's request (one-off or on a recurring schedule).
• Account Records (clinic name, staff user logins, settings and billing history): Kept after cancellation so the account can be reactivated and to meet legal and tax obligations, and deleted on request. Account records contain no patient data.
• Transaction Records: As required for tax compliance
• Website Logs: 90 days
• Outbound Campaign Data: Campaign configurations and call logs retained for the duration of the active account; deleted within 60 days of cancellation along with other call data
• Clinic Consent Records: Records of Clinic acknowledgements for Outbound Calling activation are retained for the duration of the service relationship plus 7 years for compliance purposes

Your Rights & How to Exercise Them

You have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion when no longer needed
• Receive your data in a portable format
• Object to certain processing activities
• Withdraw consent previously given

For Medical Clinic Customers: Exercise rights through your Aeva account or by contacting us.

For Patients/End Users: Contact your medical clinic directly as the data controller.

For Patients Receiving Outbound Calls: If you no longer wish to receive calls from a Clinic using our service, please inform the Clinic directly or request during the call not to be contacted again. The Clinic, as data controller, is responsible for maintaining and honouring opt-out requests.

Contact us at updates@aevaai.com or through www.aevaai.com/privacy-policy to exercise these rights. We aim to respond within 30 days.

Complaints & Security

Complaint Handling

Submit privacy concerns to updates@aevaai.com with detailed information. We'll acknowledge within 2 business days and aim to resolve within 30 days.

If unsatisfied, you may contact your local data protection authority:

• New Zealand: Office of the Privacy Commissioner
• Australia: Office of the Australian Information Commissioner
• United Kingdom: Information Commissioner's Office (ICO)

Security Measures

We protect personal data through:

• Encrypted database storage via Heroku
• AES-256 encryption of stored practice-management API credentials
• Encryption of data in transit (TLS/HTTPS)
• Encryption of call recordings and transcripts at rest in Microsoft Azure
• Multi-factor authentication on all services
• Rate limiting at the application level
• Regular code reviews and security testing
• Documented incident response procedures
• Annual security awareness training

Policy Updates & Contact Information

We regularly review this policy and will notify users of material changes at least 30 days before implementation. Minor changes will be posted on our website.

For questions about this policy, contact: updates@aevaai.com