Privacy Policy

1. Who We Are & Scope of this Policy

This Privacy Policy applies to the AMSh AI Receptionist platform, available at getamsh.com and associated subdomains, operated by TechyCodex (“AMSh”, “Company”, “we”, “us”, or “our”).

AMSh acts as a technology platform and virtual front-desk receptionist for medical clinics, dental practices, aesthetic centers, and professional service providers. In technical data protection terms:

• For Clinics & Business Owners: We act as a Data Controller regarding your account registration, billing data, and administrative credentials.
• For Patients & Callers: We act as a Data Processor (or Service Provider / Business Associate) on behalf of the subscriber clinic, which remains the primary Data Controller of patient medical and contact information.

2. Information We Collect

We collect only the minimum personal information required to book appointments, answer clinic questions, and coordinate patient care:

4. How We Use Collected Information

We process personal data for legitimate, specific, and transparent purposes:

• Answering Inbound Calls & Inquiries: Providing real-time, 24/7 front-desk voice answering for clinics, eliminating missed calls and answering patient questions about clinic hours and services.
• Booking & Managing Appointments: Checking practitioner availability, scheduling appointments on clinic calendars, and issuing booking confirmations.
• Emergency Guardrails: Deterministically detecting severe medical symptoms during calls to immediately instruct callers to dial local emergency services (112, 108, or 911).
• Quality Assurance & Auditing: Reviewing call transcripts to resolve booking discrepancies and improve speech recognition accuracy.
• Compliance with Legal & Health Regulations: Ensuring adherence to local healthcare privacy laws and regulatory recordkeeping.

5. Third-Party Service Providers & Sub-Processors

To deliver a low-latency, resilient voice and messaging platform, AMSh collaborates with vetted enterprise infrastructure providers under strict Data Processing Agreements (DPAs):

6. Data Security & Compliance Standards

We implement industry-standard administrative, physical, and technical safeguards:

• Encryption in Transit & at Rest: All web traffic and WebSocket streams use TLS 1.3 encryption. Persistent data in PostgreSQL and media files are encrypted with AES-256.
• Automatic PII Redaction: Sensitive identifiers like payment card numbers, bank credentials, and national ID patterns are automatically masked in logging pipelines.
• Tenant Isolation: Every clinic operates within an isolated database context; clinics cannot view or query patient data belonging to other clinics.
• HIPAA, GDPR & DPDP Alignment: Architecture built around principle of data minimization, auditability, and sovereign regional hosting.

8. Data Retention Policies

We retain personal data only for as long as necessary to fulfill the operational purposes described in this policy:

• Audio Call Recordings: Stored for 90 days by default, after which audio binaries are purged, unless the clinic administrator specifies a shorter retention cycle.
• Call Transcripts & Booking History: Retained for the duration of the clinic’s active subscription to provide historical context for returning patients, or until a deletion request is initiated.
• Access Logs: Server and API security access logs are retained for 180 days for diagnostic and cybersecurity threat prevention.

9. Children’s Privacy

AMSh does not knowingly solicit or collect personal information directly from individuals under the age of 18 without verifiable parental or guardian consent. When appointments are scheduled for pediatric patients, communications must be conducted by the child’s parent or legal guardian.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect modifications in our technology, regulatory mandates, or partner requirements. When changes are made, the revised date will be displayed at the top of this page. Substantive updates will be communicated to registered clinic administrators via email.