.png)
Under UK GDPR, details a caller gives your clinic about their health, and even appointment details that reveal something about their health, can count as special category data, which needs extra care. Before an AI receptionist answers your clinic's phones, check what it records, where the data is stored, whether the provider signs a data processing agreement as your processor, and how it keeps treatment details out of texts. This is general information, not legal advice; the ICO's guidance is the place to check.
Sometimes. UK GDPR defines health data as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status". The ICO's guidance says this can include appointment details, reminders and invoices that tell you something about someone's health, giving the example that you could reasonably infer health data from a list of appointments at an osteopath clinic (ICO: what is special category data?).
For a clinic, that means a call where someone mentions a skin condition, a medication, a pregnancy or a treatment history can contain special category data, and so can the booking it produces. The ICO also notes that special category data is "framed broadly" and asks organisations to approach it carefully "even if you don't think it is particularly sensitive".
CallPad's security overview says CallPad operates under GDPR and UK GDPR requirements, that identifying information is stored in AWS data centres in Stockholm, Sweden (EU jurisdiction), that data in transit is encrypted with HTTPS/TLS and that access is controlled with role-based authentication and logging. CallPad's data processing agreement sets out CallPad as processor and the clinic as controller, with commitments on confidentiality, security, breach notification, help with data subject requests and deleting or returning data at the end of the service. It says any transfer outside the UK/EU only happens under appropriate safeguards.
CallPad keeps treatment details out of reminder and confirmation texts. When a caller asks a clinical question, CallPad can transfer the call to a team member or take a message, and your team gets an email saying what the caller wanted.
CallPad answers your phone 24/7, so enquiries that come in while you're treating or after hours are answered rather than sent to voicemail. It books, moves and cancels appointments in real time with the right practitioner on supported systems, including Cliniko and Phorest, books consultation appointment types, handles skin and laser patch tests, and can take a deposit on the call. Using Pabau? A CallPad integration with Pabau is in the works: join the waitlist to be first to know. For what your receptionist may say about prescription-only treatments, see UK aesthetics advertising rules for phone enquiries.
This article is general information, not legal advice. Check the ICO's guidance and speak to your adviser about your clinic.
It can be. The ICO says health data includes information that reveals something about a person's health, including some appointment details, reminders and invoices. A call where someone describes a condition or treatment history can contain special category data.
If it processes personal data on your clinic's behalf, it normally acts as your processor. Ask for its data processing agreement before you start, and check it with your adviser.
CallPad's security overview says identifying information is stored in AWS data centres in Stockholm, Sweden (EU jurisdiction), and that CallPad operates under GDPR and UK GDPR requirements.
No. CallPad keeps treatment details out of reminder and confirmation texts.
No. It's general information. Check the ICO's guidance and speak to your own adviser about your clinic's obligations.
Get a quote for your clinic, or hear CallPad answer a real salon call.
