Legal / Privacy
Privacy Policy
Dosscall AI (Pty) Ltd
Last updated: 17 October 2026
1. Introduction
Dosscall AI (Pty) Ltd (“Dosscall AI”, “we”, “us” or “our”) respects the privacy and protection of personal information.
This Privacy Policy explains how we collect, use, process, store, disclose and protect personal information when you visit our website, contact us, use our services or communicate with a medical practice that uses our AI receptionist systems.
Dosscall AI provides AI-powered receptionist and communication systems designed to assist private medical practices with patient enquiries, appointment-related communication and administrative tasks.
Our services may process personal information through telephone calls, call recordings, transcripts, WhatsApp conversations, appointment enquiries, contact forms and connected software platforms.
We aim to process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) of South Africa and other applicable data protection laws.
Please read this Policy together with any applicable service agreement, data processing agreement and notices provided by the medical practice you contact.
2. Company and contact information
Registered company name: Dosscall AI (Pty) Ltd
Company registration number: 2026/570415/07
Website: https://dosscallai.com/
Email: info@dosscallai.com
Telephone: 067 315 0635
POPIA Information Officer registration number: 2026-062991
You may contact us using the details above for privacy enquiries, requests to access or correct personal information, data deletion requests, complaints or questions about this Policy.
3. Our role in processing personal information
Our role depends on the type of information and the service involved.
3.1 Personal information relating to our own business
When we collect information through our website, receive business enquiries, communicate with prospective customers or administer our own business relationships, Dosscall AI determines the purposes and means of the relevant processing, subject to applicable law.
In these circumstances, Dosscall AI acts in the capacity appropriate to that processing, including as a responsible party under POPIA where applicable.
3.2 Patient information processed for medical practices
When a medical practice engages Dosscall AI to provide AI receptionist or communication services, Dosscall AI acts as an Operator under POPIA when processing patient personal information on behalf of that practice.
The medical practice generally determines the purposes for which patient information is collected and the information required for its operations. The practice is therefore ordinarily the responsible party for that patient information.
Dosscall AI processes patient information on the practice's behalf, in accordance with the agreed services, documented instructions, applicable data processing agreement and applicable law.
We do not independently determine the medical purposes for which a practice collects patient information.
If you are a patient and wish to exercise a right concerning your medical or appointment information, you may contact the medical practice directly. You may also contact Dosscall AI at info@dosscallai.com, and we will help direct your request to the appropriate party where necessary.
4. Personal information we may collect or process
The information processed depends on how you interact with us and the services configured for the relevant medical practice.
4.1 Website visitors
When you visit our website, we may collect:
- Information submitted through contact forms, including your name, email address, telephone number and message.
- Technical information such as IP address, browser type, device information, pages visited and general usage data, where collected by the website or its analytics tools.
- Information collected through cookies, analytics technologies and advertising pixels, subject to the tools deployed and your applicable consent or preferences.
- Information you voluntarily provide when communicating with us.
4.2 Business customers and prospective customers
We may process business contact details, names, job titles, company details, email addresses, telephone numbers, communications, service requirements, contract information, billing information and account-related information needed to establish and manage our business relationship.
4.3 Patients and callers
Depending on the medical practice's documented requirements and the interaction, our systems may process:
- Full name.
- Telephone number.
- Email address, where provided or required.
- Appointment enquiries and scheduling information.
- Call recordings and call transcripts.
- WhatsApp messages and related conversation details.
- Other information specifically requested by the medical practice and necessary for its documented purposes.
Information beyond a patient's full name, telephone number and email address depends on the individual practice's documented requirements and service configuration.
Where a practice instructs us to process information relating to health, symptoms, treatment or other sensitive matters, that information will be handled subject to the applicable data protection requirements and the practice's instructions.
Please avoid providing unnecessary sensitive information through communication channels unless it is relevant to your enquiry and the medical practice has requested or authorised its collection.
4.4 Call recordings and transcripts
Our voice-call services record calls and generate or retain call transcripts as configured for the relevant service.
At the start of the call, callers are informed that they are interacting with AI and that the call is being recorded.
Recordings and transcripts may contain personal information shared during the call, including appointment details or other information relevant to the patient's enquiry.
These records may be processed to provide the service, maintain the conversation record, support appointment-related administration, investigate service issues and meet the medical practice's documented requirements.
Call recordings and transcripts are retained while the relevant medical practice remains a client, subject to the applicable agreement, the practice's instructions, legal obligations and any applicable deletion requirements. The end of a client relationship may trigger further retention or deletion actions under the relevant agreement and applicable law.
5. How we use personal information
We may process personal information for the following purposes, where applicable:
1. To provide and operate AI receptionist and communication services.
2. To respond to website enquiries and requests for demonstrations or information.
3. To facilitate patient enquiries and appointment-related communication on behalf of medical practices.
4. To process and manage calls, WhatsApp conversations, recordings and transcripts.
5. To maintain business relationships, administer contracts and provide customer support.
6. To configure and improve service workflows, investigate errors and troubleshoot technical issues.
7. To protect the security and integrity of our services and investigate suspected misuse.
8. To meet applicable legal, regulatory and contractual obligations.
9. To measure website performance and understand website usage through analytics.
10. To measure or support advertising activity through advertising pixels and related technologies, where deployed and permitted.
11. To establish, exercise or defend legal claims where necessary.
We will not intentionally use patient information for purposes unrelated to the medical practice's documented instructions or the agreed services unless another lawful basis permits or requires the processing.
6. Lawful processing and sensitive information
Personal information will be processed only where an applicable lawful basis exists under POPIA or other relevant law.
Depending on the circumstances, this may include consent, performance of a contract, compliance with a legal obligation, protection of legitimate interests recognised by law, or another applicable justification.
Medical and other sensitive personal information receives additional protection under applicable law. Its collection and processing must satisfy the relevant legal requirements, including the conditions applicable to special personal information.
The medical practice is responsible for determining and documenting the appropriate basis for collecting patient information and instructing Dosscall AI to process it. Dosscall AI will process that information in accordance with its Operator obligations and applicable instructions.
Where consent is required, it must be obtained through an appropriate process. Consent may not be assumed merely because a person communicates with an AI receptionist.
7. AI processing and automated interactions
Our services use AI technology to assist with communication and administrative workflows.
Depending on the configuration, an AI receptionist may interpret a person's enquiry, generate a response, capture relevant details, support appointment-related processes or transfer information to an authorised system.
AI-generated responses may be inaccurate or incomplete. AI services are not a substitute for professional medical assessment, diagnosis or treatment. Patients should contact an appropriately qualified healthcare professional for medical advice and urgent assistance.
Where an enquiry requires clinical judgement, falls outside the system's authorised scope or cannot be handled reliably, the service should follow the relevant practice's configured escalation or referral process.
The exact capabilities and escalation arrangements depend on the service configuration agreed with the medical practice.
8. AI model providers and model training
Dosscall AI may use an AI model provider to process prompts, messages, transcripts or other information needed to operate the service.
The applicable provider, model, account type and settings determine how submitted information is handled, including any retention, logging or model-training arrangements.
We do not represent that every AI provider or configuration automatically excludes model training or secondary use of submitted information. These arrangements must be verified for the specific provider and configuration used.
We aim to use appropriate provider arrangements and settings for the intended processing. Where required, we will work with the medical practice to establish suitable instructions and safeguards before processing patient information through an AI provider.
Medical practices should not instruct Dosscall AI to process information through a provider or configuration that is incompatible with the practice's legal obligations or agreed data protection requirements.
9. Service providers and third-party platforms
To deliver our services, Dosscall AI may use or integrate with third-party service providers. Confirmed or possible providers include:
- Twilio: telecommunications and messaging infrastructure.
- Meta WhatsApp / WhatsApp Business Platform: WhatsApp-based communications.
- Vapi: voice AI infrastructure, where used.
- n8n: workflow automation, where used.
- Google Workspace: business productivity and related services, where used.
- AI model provider or providers: AI processing, depending on the service configuration.
This list identifies providers that may be involved; it does not mean every provider is active in every deployment.
Depending on the service, additional systems may be used where agreed with the medical practice. The actual providers and data flows depend on the relevant service configuration and any applicable agreement.
Third-party providers may process information as service providers, subprocessors or independent parties, depending on their role and terms. Where a provider processes patient information on our behalf, we aim to ensure that appropriate contractual and data protection arrangements apply.
Third-party services are also subject to their own terms, privacy notices and technical practices. We cannot make blanket guarantees about their independent systems or policies.
10. Sharing and disclosure of personal information
We do not sell patient personal information.
We may disclose or make personal information available where necessary to:
- The medical practice for which the information is processed.
- Authorised service providers and subprocessors involved in delivering the service.
- Employees, contractors or authorised persons who require access for legitimate business or service purposes, subject to applicable confidentiality obligations.
- Regulators, law enforcement authorities, courts or other parties where disclosure is required or permitted by law.
- Relevant parties where necessary to establish, exercise or defend legal claims.
We aim to limit disclosures to information relevant to the purpose for which it is shared.
Where we process patient information as an Operator, disclosure and access are subject to the medical practice's documented instructions, applicable agreements and legal requirements.
11. International transfers
Some service providers may store or process information in countries outside South Africa. Whether this occurs depends on the providers, infrastructure and configuration used for a particular service.
Where personal information is transferred outside South Africa, the transfer must comply with the applicable requirements of POPIA, including section 72 where relevant.
Depending on the circumstances, this may require an adequate level of protection, an applicable agreement or binding rules, consent where legally appropriate, or another permitted statutory condition.
We do not claim that all information remains in South Africa. The locations and safeguards applicable to a particular service should be confirmed with the relevant providers and reflected in the applicable contractual arrangements.
12. Retention of personal information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or processed, subject to applicable legal, contractual and operational requirements.
Different categories of information may have different retention periods.
For patient call recordings and transcripts processed on behalf of a medical practice, our current stated retention approach is to keep them while the practice remains a client. This is subject to the applicable service agreement, documented practice instructions, legal requirements and any valid deletion request.
The end of a client relationship does not necessarily mean that every copy is immediately erased. The handling of information after termination, including return, deletion and any limited retention required by law or an applicable agreement, will be governed by the relevant contractual arrangements and legal requirements.
Website enquiry information and business records may be retained for as long as necessary to respond to enquiries, manage business relationships, maintain records or meet legal obligations.
We do not state a universal fixed deletion period for every provider, backup or technical system. Where a specific retention period is required, it should be established through the applicable service configuration, provider terms and agreement.
13. Data security and confidentiality
We take the protection of personal information seriously and aim to apply appropriate safeguards in light of the nature of the information and the risks associated with processing it.
Our contractual approach includes confidentiality obligations, limiting the use of client information to agreed purposes and requiring appropriate data protection obligations from approved subprocessors where applicable.
Access to systems and information should be limited to authorised persons who require it for legitimate service or business purposes.
No method of electronic storage, transmission or processing can be guaranteed to be completely secure. We therefore cannot promise that unauthorised access, loss or disclosure will never occur.
The specific technical and organisational controls in place may depend on the service configuration and third-party infrastructure used. We do not claim that a particular encryption standard, certification, security audit or other technical control exists unless it has been independently confirmed.
14. Personal information security incidents
If we become aware of a security incident affecting personal information that we process, we will respond in accordance with applicable law and our contractual obligations.
Where we act as an Operator for a medical practice, we will notify the relevant practice of a known or suspected security incident affecting its data without undue delay, in accordance with the applicable agreement.
The responsible party remains responsible for its own statutory notification obligations, including notifications to the Information Regulator and affected data subjects where required by POPIA. We will provide reasonable cooperation as required by the applicable agreement and law.
15. Your privacy rights
Subject to applicable law, you may have the right to:
- Request access to personal information held about you.
- Request correction or updating of inaccurate, incomplete, misleading or outdated information.
- Request deletion or destruction of personal information where legally justified.
- Object to certain forms of processing where the law provides that right.
- Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
- Object to direct marketing where applicable.
- Submit a complaint to the relevant supervisory authority.
These rights are not absolute. Certain information may need to be retained where required by law, necessary for an applicable contractual purpose, or otherwise permitted by law.
For patient information processed on behalf of a medical practice, the practice will ordinarily determine how a request concerning its records should be handled. Dosscall AI will assist the practice as required by the applicable agreement and law.
16. How to request access, correction or deletion of personal information
You can submit a privacy or data deletion request directly to Dosscall AI. You do not need to locate a technical provider or contact Meta to start the request.
Send an email to info@dosscallai.com with the subject line:
Privacy Request / Personal Data Deletion
In your email, include:
- Your full name.
- The telephone number or email address associated with the relevant interaction, if applicable.
- The name of the medical practice involved, if applicable.
- The type of information or interaction concerned, such as a call recording, transcript, WhatsApp conversation, website enquiry or business account.
- Whether you are requesting access, correction, deletion or another privacy action.
- Any relevant date or approximate date of the interaction.
Do not send identity documents or additional sensitive medical information unless reasonably necessary. If identity verification is required, we will explain what information is needed and why.
How we handle your request
1. We will review the request and, where reasonably necessary, verify your identity or authority to act for the relevant person.
2. If the information relates to a medical practice and the practice is the responsible party, we will refer or coordinate the request with that practice where appropriate.
3. We will assess the request against applicable law, the relevant service agreement and any legal or contractual retention obligations.
4. Where deletion is appropriate and within our control, we will take reasonable steps to delete the relevant information or arrange for deletion through the applicable service provider.
5. Where information cannot lawfully be deleted, is not within our control, or must be retained for a permitted reason, we will explain the position to the extent reasonably possible.
6. Where appropriate, we will coordinate with relevant service providers or the responsible party regarding information they control.
A deletion request does not guarantee that all information will be erased immediately from every system, backup or independent third-party record. The outcome depends on the applicable law, the request, the systems involved and any valid retention requirement.
Requests concerning Meta or WhatsApp
If your personal information was processed through a WhatsApp interaction or another Meta-related service, you may use the same email address and subject line above to request deletion of personal information that Dosscall AI controls or processes on behalf of a practice.
Please identify the WhatsApp number or interaction and the relevant practice, if known. We will assess the request and coordinate with the relevant practice or service provider where necessary.
If the request concerns information held independently by Meta, WhatsApp or another third party, you may also need to exercise your rights directly with that provider. A request to Dosscall AI cannot guarantee deletion from independent systems that we do not control.
This process is intended to provide a clear, accessible route for privacy and deletion requests, including requests relating to information processed through our Meta-connected services.
17. Cookies, analytics and advertising technologies
Our website uses contact forms, analytics and advertising pixels or related technologies.
Depending on the tools deployed, these technologies may collect information such as device details, browser information, IP address, pages visited, interactions with the website, referral information and activity used to measure advertising performance.
Cookies and similar technologies may be used to:
- Support website functionality.
- Understand website traffic and usage.
- Measure the effectiveness of advertising.
- Help assess whether website visitors interact with our marketing.
- Improve website content and performance.
The specific analytics and advertising providers, cookie types, retention periods and data collected depend on the tools configured on the website.
Where consent is required by applicable law, we will seek the relevant consent before using non-essential cookies or similar technologies. You may also be able to manage cookies through your browser settings or any consent controls made available on the website. Blocking certain cookies may affect website functionality.
We do not claim that every analytics or advertising tool is active on every page or that every cookie has the same purpose.
18. Direct marketing and communications
We may use business contact information to respond to enquiries, provide requested information, communicate about our services or send business-related updates where permitted by law.
We will respect applicable direct marketing requirements, including consent and objection rights where relevant.
You may request that we stop sending optional marketing communications by emailing info@dosscallai.com. This will not prevent us from sending essential service, contractual or legal communications where appropriate.
Medical practices are responsible for ensuring that their own patient communications and marketing activities comply with applicable laws and the relevant platform rules.
19. Third-party websites and services
Our website or communications may contain links to third-party websites or services.
Those websites and services operate under their own privacy notices and terms. Dosscall AI does not control the privacy practices of independent third parties and is not responsible for their policies or activities.
We encourage you to read the relevant privacy notice before submitting personal information to a third-party service.
20. Children's personal information
Our services are intended to support medical practices and their administrative communication. In the course of a practice's operations, information relating to a child may be processed where appropriate and lawful.
Children's personal information is subject to the additional protections required by POPIA and other applicable law.
Where a service involves children's personal information, the responsible medical practice must determine the appropriate lawful basis, permissions and safeguards. Dosscall AI will process that information only within the scope of the agreed service, documented instructions and applicable legal requirements.
21. Complaints and the Information Regulator
If you have a concern about how Dosscall AI handles personal information, please contact us first at info@dosscallai.com so that we can review the concern.
You may also lodge a complaint with the South African Information Regulator where appropriate.
Information Regulator of South Africa
Website: https://inforegulator.org.za/
The Information Regulator's official website provides information about data protection rights and complaint procedures.
22. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, providers, processing activities, legal requirements or operational practices.
The latest version will be published on our website with its updated revision date. Where required by law, we will provide additional notice or obtain consent for material changes.
We encourage you to review this page periodically.
23. Contact us
For questions about this Privacy Policy, access requests, correction requests, deletion requests, objections or privacy complaints, contact:
Dosscall AI (Pty) Ltd
Company registration number: 2026/570415/07
POPIA Information Officer registration number: 2026-062991
Website: https://dosscallai.com/
Email: info@dosscallai.com
Telephone: 067 315 0635
For data access or deletion requests, use the email subject: “Privacy Request / Personal Data Deletion”.
We will review requests and respond in accordance with applicable law and the relevant service arrangements.