Security
AI receptionist data security, in specifics rather than assurances
An AnswerAI receptionist records the call on an enterprise voice platform hosted in the United States, under a retention window you set between one day and two years, and stores nothing of the conversation on AnswerAI's own servers. AnswerAI's database holds routing metadata (call IDs and agent IDs) and purges it within 24 hours. No caller data is used for marketing, resale, analytics or model training, and AnswerAI trains no models at all. Every call opens with a verbal AI disclosure that is on by default and cannot be switched off.
This page is drawn from a vendor privacy and security checklist prepared for a Calgary medical client in March 2026, a document written to survive a regulator-facing review rather than to market anything. The full checklist, including the disclosures that work against us, is available to any prospect running diligence.
Where does a call actually go?
Four places, and only four. The value of naming them is that a compliance reviewer can check each one independently instead of taking a sentence about security on trust.
- The phone lineYour existing business number, forwarded, or a new number that points at the agent. Nothing about your carrier arrangement changes hands.
- The voice platformAn enterprise voice platform hosted in the United States carries the call and holds the recording, the transcript and the logs under the retention window set on your agent.
- AnswerAI's databaseRouting metadata only: call IDs and agent IDs, auto-purged within 24 hours. Row-level security is enforced by default on every table. No recordings, no transcripts.
- Your own systemsWhatever the build writes to: your calendar, your CRM, your practice-management software. AnswerAI holds no access to any client's EMR or patient records at any point.
What is the platform actually certified for?
Named standards with named auditors, not adjectives. Each of these is independently verifiable through the platform's public trust centre rather than on our word.
- SOC 2 Type I and Type II: independently audited controls for security, availability and confidentiality.Platform compliance documentation, verified 2026-08-06
- HIPAA compliant, with a Business Associate Agreement required before any protected health information is transmitted, self-signable at no additional fee.Platform compliance documentation, verified 2026-08-06
- GDPR compliant via the underlying cloud DPA, with a data processing agreement and standard contractual clauses available.Platform compliance documentation, verified 2026-08-06
- Certificates published through a public Vanta trust centre, so the current state is readable without asking us.Platform trust centre, verified 2026-08-06
How long is a recording kept, and who decides?
You decide, per agent, and the window is a build setting rather than a support request. The same panel controls how much of a call is stored at all.
| Setting | Range | Who sets it |
|---|---|---|
| Transcript retention | 1 day to 2 years | You, per agent |
| Recording retention | 1 day to 2 years | You, per agent |
| Call log retention | 1 day to 2 years | You, per agent |
| What is stored at all | Everything · exclude PII · basic attributes only | You, per agent |
| AnswerAI routing metadata | Purged within 24 hours | Fixed, not configurable |
Recordings are served over signed, expiring URLs rather than public links. A shorter retention window is the single most effective privacy control available to a clinic, and it costs nothing: a practice that never needs a call older than 30 days should not be storing calls for two years.
What will the line never do with a call?
These are contractual and structural rather than policy preferences, which means they survive a change of staff at either company.
- It is never training dataNo caller data is used for marketing, advertising, resale, analytics or model training. AnswerAI trains no models at all; the agent is governed by a structured prompt and a knowledge base, never by learning from your calls.
- It never hides that it is AIA verbal AI disclosure runs at the start of every call. It is enabled by default and cannot be disabled. Any caller can ask to be transferred or to leave a message instead.
- It never gives clinical adviceThe agent is scoped to scheduling, service information and message-taking. No diagnosis, no medical advice, no clinical decisions, no record access. Out-of-scope questions defer to staff by design, not by luck.
- It is never a black box to youThe client holds full admin access to logs, transcripts, recordings, the prompt and the knowledge base, and can change agent behaviour without involving AnswerAI.
How does this work under Alberta's Health Information Act?
Through an Information Manager Agreement, which is the mechanism the HIA itself provides for exactly this situation. AnswerAI is prepared to sign one, and the checklist this page comes from was written to be read alongside a custodian's PIA.
Section 66 of the Health Information Act and section 7.2 of the Health Information Regulation are what make a vendor like this usable by a custodian at all: they let a custodian delegate handling of health information to an information manager under a written agreement. That agreement is the artefact a Commissioner's office looks for, and its absence is the usual reason a clinic's AI project stops.
Section 8(4) of the Regulation governs storage of health information outside Alberta. Data on this platform sits in the United States, so this section applies rather than being sidestepped, and the IMA addresses it openly. A vendor that tells an Alberta clinic cross-border storage is not an issue is either not storing in the US or has not read the section.
Section 60.1 sets the custodian's duty to notify the Commissioner of a breach. AnswerAI commits to notifying the client within 72 hours of becoming aware of one, which is what makes the custodian's own statutory clock runnable. Deletion requests are processed within 30 days and executed through the platform's programmatic deletion API rather than by hand.
The OIPC of Alberta published AI guidance in September 2025, and the addendum to this checklist answers it point by point: training data, hallucination controls, user notification and human oversight. In practice the work also runs alongside whatever the clinic already uses: Brightsquid for secure messaging, and the Alberta Medical Association's own IMA template as the starting document rather than one of ours.
You set the retention window between one day and two years, per agent: a shorter window is the most effective privacy control a clinic has, and it costs nothing.
If your clinic has a privacy gatekeeper, the fastest way through is to hand them this page and the Information Manager Agreement rather than a sales deck.
Start free pilotQuestions a privacy reviewer asks
On the voice platform's servers in the United States, not in Canada. Retention is configurable per agent from one day to two years, and per-agent storage can be set to everything, exclude PII, or basic attributes only. AnswerAI's own database holds routing metadata only and purges it within 24 hours.
No. No caller data is used for marketing, advertising, resale, analytics or model training, and that is contractually enforceable through the Information Manager Agreement. AnswerAI trains no models of its own; the agent is governed by a structured prompt and a knowledge base, so there is no mechanism by which your calls would change how it behaves for anyone else.
Yes to both. The platform's HIPAA Business Associate Agreement is self-signable at no additional fee and must be in place before any protected health information is transmitted. For Alberta custodians, AnswerAI is prepared to sign an Information Manager Agreement under HIA s. 66 and Health Information Regulation s. 7.2, and will work from the Alberta Medical Association's template rather than insisting on ours.
Always. A verbal AI disclosure runs at the start of every call, it is enabled by default, and it cannot be disabled. Any caller can ask to be transferred to a person or to leave a message instead. This is a structural setting rather than a policy we promise to follow.
Not on the standard deployment: data is stored in the United States. A private or dedicated deployment is available on request and is the route to take when residency is a hard requirement for your organisation. Raise it at the first conversation and it changes what gets built rather than whether we can build it.
AnswerAI commits to notifying the client within 72 hours of becoming aware of an incident, which is what lets a custodian meet its own notification duty to the Commissioner under HIA s. 60.1. Deletion requests are processed within 30 days and executed through the platform's programmatic deletion API.
Sources
- AnswerAI vendor privacy and security checklist, prepared for a Calgary medical client: the source document for this pageVerified 2026-03-26
- Voice platform compliance documentation and public trust centreVerified 2026-08-06
- Alberta Health Information Act, ss. 60.1 and 66Verified 2026-08-13
- Alberta Health Information Regulation, ss. 7.2 and 8(4)Verified 2026-08-13
- Office of the Information and Privacy Commissioner of Alberta: AI guidance, September 2025Verified 2026-08-13
Hand this page to whoever has to approve it.
The pilot runs about 14 days with no call limit, and the retention window and PII settings are decided before the line takes its first call rather than after. If your reviewer needs the Information Manager Agreement in advance, ask and it comes first.
Start free pilotLast updated