Security and your data
Your receptionist talks to your customers and patients, so their details need to be safe. Here's exactly how The AI Front Desk protects them, in plain English.
- UK company: Pathir Ltd, registered in England and Wales (16779893)
- Built for UK GDPR: you're the controller, we're your processor
How we protect data
- Encrypted in transit. Every page, call webhook and API request uses HTTPS, and browsers are told to only ever connect securely (HSTS).
- Connected logins encrypted at rest. Your Cliniko API key and Google Calendar access are encrypted in our database with a separate key.
- Passwords never stored. We keep only a salted scrypt hash, so nobody (including us) can see your password.
- Locked-down admin. Only the founder has admin access, through a private address and login that locks after repeated failed attempts.
- Accounts kept apart. Each business only ever sees its own conversations and customers, checked on our server for every request.
- Safe web pages. Security headers stop other sites framing The AI Front Desk or reading where you came from.
Clinics and patient data
- Identity check first. The receptionist checks date of birth (and name if the number isn't on file) before sharing or changing anything, enforced by our server, not just the AI.
- Live from Cliniko. Appointments are read from and written to your Cliniko account as they happen.
- Minimal copies. We keep a small index of patient phone numbers and names to greet callers. Never dates of birth or clinical notes.
- No clinical advice. The receptionist books, moves and cancels appointments and takes messages. It doesn't diagnose or advise.
Calls, recordings and retention
Calls are recorded and transcribed so you can review what was said and teach your receptionist. Texts and emails are kept the same way. We keep conversations while your account is open, so you can look back at them. When you delete your account, we delete your business data, conversations and customer records from The AI Front Desk.
AI and your data
The AI Front Desk doesn't use your data or your customers' data to train AI models. Our AI provider doesn't train on data sent through its business service. The receptionist only knows what's on your website, what you tell it, and the conversation in front of it.
Who we work with
We use a small number of established providers to run The AI Front Desk, under contracts that protect your data. Some operate outside the UK, with appropriate safeguards for international transfers. Customers can ask us for the full list of sub-processors.
- Cloud hosting: Running the AI Front Desk app and storing its data
- Telephony: Phone numbers, calls and text messages
- Voice: The receptionist's voice and call transcription
- AI processing: Understanding and replying to customers (no training on your data)
- Email: Sending and receiving email
- Payments: Billing for The AI Front Desk plans (we never see full card numbers)
- Your connected tools: Google Calendar or Cliniko, only if you connect them
If something goes wrong
If we ever find a security incident affecting your data, we'll tell you without undue delay, explain what happened and what we're doing about it, and help you meet your own obligations, including any report to the ICO.
Report a security issue
Found a vulnerability? Email johannis@pathir.com with the details. We'll reply quickly and won't take action against good-faith research.
Questions
Got a security questionnaire or questions about how we handle data? Email johannis@pathir.com. See also our privacy policy.
Questions
Is The AI Front Desk secure?
Yes. Everything travels over encrypted HTTPS, passwords are never stored (only scrypt hashes), the logins for services you connect (like Cliniko and Google Calendar) are encrypted in our database, and only the founder has admin access, behind a private address and login.
Who owns my customers' data?
You do. Under UK GDPR you're the controller and The AI Front Desk is your processor: we only use your customers' details to run your receptionist, and never sell them or use them for anything else.
Is patient data safe with the Cliniko integration?
The AI Front Desk reads appointments live from Cliniko and checks a caller's date of birth (and name if their number isn't on file) before sharing or changing anything. That check is enforced by our server, not left to the AI. We keep only a small index of patient phone numbers and names so the receptionist can greet people, never dates of birth or clinical notes.
Is my data used to train AI?
No. The AI Front Desk doesn't train AI on your data, and our AI provider doesn't train on data sent through its business service.
Where is my data stored?
With established cloud providers, some of them outside the UK, under contracts with safeguards for international transfers. Cliniko data stays in your own Cliniko account. Customers can ask us for the full list of sub-processors.
Can I delete my data?
Yes. Delete your account from Settings and we delete your business data, conversations and customer records from The AI Front Desk. Billing records are kept only as long as the law requires.
Try The AI Front Desk free for 1 week
No card needed. Enter your website and your AI receptionist is ready in about 5 minutes.
Want to hear it first? Ring 07476 991298. Our own AI receptionist answers.