Scope and who we are
CalledInAI is a trading name of [Legal entity name], a company licensed in [Abu Dhabi mainland / free zone name], United Arab Emirates, under trade licence no. [licence number], with its registered address at [registered address] (“CalledInAI”, “we”, “us”, “our”).
We help aesthetic and medical clinics turn enquiries into booked, qualified consultations, using paid advertising, AI-assisted calling and messaging, lead qualification and calendar booking. This policy explains how we handle personal data when you visit our website, contact us, book a call, become a client, or enquire with one of our client clinics through a system we operate.
We operate from the UAE and work with clinics in the UAE and in other countries. This policy is written to meet the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”) and, where they apply to us, the EU and UK General Data Protection Regulations (“GDPR”), the California Consumer Privacy Act as amended (“CCPA”) and other comparable laws. Where a stricter local rule applies to you, we follow it.
Our role: controller or processor
We handle two different groups of people, and our legal role differs for each.
| Who | Our role | What that means |
|---|---|---|
| Clinic owners, staff and prospects — anyone who visits our site, books a call, or signs up as a client | Controller | We decide how this data is used, and this policy governs it directly. |
| Patients and enquirers — people who respond to a clinic’s ad, call or message a clinic, or are called by the AI receptionist on a clinic’s behalf | Processor (service provider) | The clinic is the controller. We process the data only on the clinic’s documented instructions under a data processing agreement. The clinic’s own privacy notice also applies. |
If you are a patient or enquirer and want to exercise your rights, you may contact the clinic directly or contact us and we will pass your request to the clinic promptly and help it respond.
Information we collect
From clinic owners and prospects
- Contact details — name, job title, clinic name, phone number, WhatsApp number, email address.
- Business information — treatments offered, locations, current marketing channels, monthly enquiry and consultation volumes, budget range and goals, including answers to the qualifying questions on our booking form.
- Account and billing data — billing contact, company and VAT/TRN details, invoices and payment status. Card details are handled by our payment processor; we do not store full card numbers.
- Access you grant us — permissions to your advertising accounts, calendar, CRM, phone numbers or messaging accounts so we can deliver the service.
- Communications — emails, messages and, with your consent, recordings or notes of sales and strategy calls.
From patients and enquirers (on behalf of clinics)
- Enquiry details — name, phone number, email address, preferred language, location or area.
- Qualification answers — the treatment or concern you are interested in, timing, budget range and preferred appointment times.
- Booking data — appointment date, time, clinic location, confirmation, reminder and attendance status.
- Call and message content — audio recordings, transcripts and message histories with the AI receptionist (see section 04).
- Ad interaction data — the campaign, form or ad you responded to, passed to us by the advertising platform or the clinic.
Collected automatically
- IP address, device and browser type, pages viewed, referring URL and timestamps.
- Cookie and pixel data where you have allowed it (see section 09).
- Technical call data such as phone number, call duration, time and delivery status.
AI calls, messages and recordings
Our clinics use an AI voice and messaging assistant to respond to enquiries, ask a few qualifying questions, answer general questions about the clinic, and book consultations.
- You will be told it is AI. The assistant identifies itself as an automated assistant at the start of a call or conversation. You can ask to speak with a member of the clinic team at any time.
- Recording and transcription. Calls may be recorded and transcribed for booking accuracy, quality and dispute resolution. You are told this at the start of the call. If you do not want the call recorded, you can say so and the clinic will contact you another way.
- No medical advice. The assistant does not diagnose, give medical advice or decide whether a treatment is suitable for you. Those decisions are made by the clinic’s licensed practitioners. In an emergency, call 998 (UAE) or your local emergency number.
- Automated decisions. The assistant may prioritise or route enquiries (for example, by preferred time or treatment interest). It does not make decisions that have legal or similarly significant effects on you, and a clinic staff member can always review the outcome.
- Opting out. Reply “STOP” to any message, or tell the assistant you don’t want further contact, and the clinic will stop contacting you through the system.
- Model training. We do not use patient or enquirer conversations to train general-purpose AI models, and we contractually prohibit our AI providers from doing so.
Health-related information
The fact that someone is interested in a particular treatment may reveal information about their health or appearance, which the law treats as sensitive data. We handle it with extra care:
- Our qualification flows are designed to collect only what is needed to book an appropriate consultation, not clinical history. Clinical details belong in the clinic’s own medical records.
- Where UAE health-data rules apply — including Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields and the requirements of the Department of Health – Abu Dhabi, the Dubai Health Authority or the Ministry of Health and Prevention — we follow the clinic’s instructions on hosting location and handling, and store such data in the UAE where required.
- For clients in the United States whose data is subject to HIPAA, we will sign a Business Associate Agreement before handling protected health information. For clients in the EU or UK, we process special-category data only on the clinic’s lawful basis, normally explicit consent collected at the point of enquiry.
- We never sell health-related information or use it for our own marketing.
How and why we use information
| Purpose | Legal basis |
|---|---|
| Respond to enquiries, run sales calls and onboard clinics | Steps before a contract; legitimate interests |
| Deliver the service: run ads, qualify enquiries, operate the AI receptionist, book and remind appointments, report results | Performance of contract (with clinics); clinic’s instructions and lawful basis (for patients) |
| Billing, accounting, VAT and record-keeping | Contract; legal obligation |
| Improve our scripts, systems and creative using aggregated, de-identified performance data | Legitimate interests |
| Send you news or educational content about our services | Consent (you can withdraw any time) |
| Security, fraud prevention, and enforcing our terms | Legitimate interests; legal obligation |
| Comply with laws, regulators and advertising-platform rules | Legal obligation |
Under the PDPL we process personal data with your consent or where another lawful ground applies, such as performing a contract, meeting a legal obligation or protecting vital interests. Where we rely on consent, you can withdraw it at any time without affecting processing that has already taken place.
International transfers
Some of our service providers are located outside the UAE (for example in the EU, UK or United States). When we transfer personal data across borders we use the safeguards required by the applicable law, such as:
- transfers permitted under Articles 22 and 23 of the PDPL, including to countries with adequate protection or under contractual safeguards, or with your consent where appropriate;
- the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum for data from the EU or UK;
- keeping data in the UAE where a clinic or UAE health-data rules require local storage.
You can ask us for more information about the safeguards that apply to your data.
Marketing communications
We send marketing emails or messages to clinic owners only with consent or where the law otherwise permits business-to-business contact, and every message includes a simple way to opt out. Calls and messages made on a clinic’s behalf follow the clinic’s consent records and applicable rules, including the UAE Telecommunications and Digital Government Regulatory Authority’s rules on unsolicited communications and WhatsApp’s business-messaging policies. We honour opt-outs promptly and keep do-not-contact lists.
Data retention
| Data | How long |
|---|---|
| Prospect and website enquiries | Up to 24 months after last contact, unless you become a client |
| Client contracts, invoices and accounting records | For the engagement plus 5 years, or longer if UAE tax or commercial law requires |
| Patient and enquirer data (calls, transcripts, bookings) | As instructed by the clinic. By default, deleted or returned within 90 days after the engagement ends |
| Call recordings | By default up to 12 months, unless the clinic instructs otherwise or a dispute requires longer |
| Aggregated, de-identified statistics | Indefinitely; they no longer identify anyone |
Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and receive a copy;
- Correct inaccurate or incomplete data;
- Delete your data, subject to legal retention requirements;
- Restrict or object to certain processing, including direct marketing and processing based on legitimate interests;
- Portability — receive data you gave us in a structured, machine-readable format;
- Withdraw consent at any time;
- Not be subject to a decision based solely on automated processing that significantly affects you, and ask for human review;
- For California residents: know what we collect, delete, correct, and opt out of any sale or sharing (we do neither), and not be discriminated against for using these rights.
To make a request, email [[email protected]]. We may need to verify your identity. We aim to respond within 30 days, or sooner where the law requires. If you are a patient or enquirer, we will forward your request to the relevant clinic and support its response.
Security and breaches
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access with least privilege, multi-factor authentication on admin accounts, logging of access to systems that hold enquiry data, and security review of our providers.
No system is completely secure. If a breach is likely to put your rights at risk, we will notify the affected clinic without undue delay and, as required, the UAE Data Office, other competent regulators and affected individuals.
Children
Our services are aimed at businesses and adults. We do not knowingly collect personal data from anyone under 18. Clinics must not use our systems to market to minors. If you believe a child’s data has reached us, contact us and we will delete it.
Changes to this policy
We may update this policy as our services or the law change, including when the PDPL Executive Regulations or new regulator guidance take effect. We will update the effective date above, and notify clients directly of material changes.
Contact and complaints
- Email: [[email protected]]
- Post: [Legal entity name], Attn: Data Protection, [registered address], Abu Dhabi, United Arab Emirates
- EU/UK representative (if appointed): [name and address, or remove this line]
If you are not satisfied with our response, you may complain to the UAE Data Office or, if you are in the EU or UK, to your local data protection authority (in the UK, the Information Commissioner’s Office). We would appreciate the chance to resolve your concern first.