Summit AI Limited ("Summit AI", "Summit", "we", "us", or "our") is a New Zealand-registered company (NZBN: company no. 9429053256614). We are committed to protecting the privacy, security, and confidentiality of the information entrusted to us. This Privacy Policy outlines how we collect, use, store, and disclose data when providing our AI receptionist, scheduling, and workflow automation services to healthcare practices.

1. Legal Roles and Responsibilities

Under applicable privacy laws, including the New Zealand Privacy Act 2020 and the Australian Privacy Act 1988, legal responsibilities are divided between the clinic and Summit AI as follows:

• Healthcare Clinics (Data Controllers / Principal Agencies): The clinic determines the purposes and means of processing patient data. Clinics maintain the primary relationship with patients and are responsible for obtaining appropriate consent.

• Summit AI (Data Processor / Secondary Agency): We process patient and caller data strictly on behalf of, and under the documented instructions of, the Healthcare Clinic.

• Patients & Callers (Data Subjects): If you interact with a clinic's AI receptionist, your primary relationship is with the clinic. Summit AI acts solely as their technology provider.
  
  

2. Personal Data We Collect

We collect data directly from individuals, automatically during service use, and from connected practice systems.

• Account Data: Clinic name, staff names, email addresses, phone numbers, billing details, and API integration tokens. We collect this directly from the clinic during account registration and onboarding.

• Patient Data: Caller name, phone number, date of birth, appointment history, and scheduling requests. This information is provided directly by the caller or securely retrieved from the clinic's Practice Management System (PMS).

• Health Data: Appointment reasons, practitioner preferences, or clinical context. This is only collected if voluntarily disclosed by the caller during an interaction with the AI receptionist.

• Interaction Data: Audio recordings, speech-to-text transcripts, call duration, and timestamp metadata. This data is generated by Summit AI during the course of providing the service.

• Technical Data: IP addresses, browser types, device operating systems, mobile network data, latency logs, and error events. We automatically collect this data when users access our platform.
  
  

Anonymity and Pseudonymity: You can browse our public website without identifying yourself. However, for most of our services (including creating an account or interacting with the AI receptionist), it is not practicable for us to deal with you if you do not identify yourself, as we need to communicate with you and manage your account.

Government Identifiers: We do not adopt, use, or disclose government-related identifiers (such as Medicare numbers or IRD numbers) as our own account identifiers unless explicitly required by law.

3. Purposes and Legal Basis for Processing

We process personal data for specific operational purposes based on recognized legal grounds under the Australian Privacy Principles (APPs), UK/EU GDPR, and New Zealand Privacy Act 2020.

• Service Delivery: We process Account, Patient, Health, and Interaction data to provide our AI receptionist services, handle inbound and outbound calls, and synchronize bookings with your PMS. Our legal basis for this processing is the performance of our contract and adherence to the clinic's documented instructions.

• Account Management: We process Account data to set up clinic profiles, manage user permissions, and process subscription billing. Our legal basis for this processing is the performance of our contract.

• Customer Support: We process Account and Technical data to respond to clinic enquiries and troubleshoot platform issues. Our legal basis is the performance of our contract and our legitimate interest in maintaining service reliability.

• Security & Anti-Fraud: We process Technical and Account data to protect our infrastructure from unauthorized access, utilizing web application firewalls and automated rate-limiting. Our legal basis is our legitimate interest in securing our platform and compliance with legal security obligations.

  
  

4. AI Model Training & Data Masking

Because we process health information, we strictly enforce the following AI boundaries:

• Zero Model Training: Patient data including live voice streams, audio recordings, transcripts, and clinical context, is never used to train, fine-tune, or retrain Summit AI’s internal models or underlying third-party AI models (e.g., OpenAI, Anthropic).

• PII Redaction at Source: Before call transcripts are routed to downstream reporting tools or email webhooks, Patient Identifiable Information (PII) is automatically masked at the voice-engine level.

• Transient Processing: All AI reasoning occurs in-memory via enterprise APIs operating under Zero Data Retention (ZDR) agreements.

• Outbound AI Voice Communications: If activated by the Clinic, Summit AI processes patient contact details to execute automated outbound call workflows (e.g., appointment rescheduling or practitioner updates) solely on the Clinic's instructions. The Clinic, as the Data Controller, represents and warrants that it has obtained all necessary consents under applicable spam and privacy laws prior to initiating outbound communications. Opt-out requests received during calls are logged and transmitted to the Clinic.

5. Sub-Processors and International Transfers
To deliver our services, we utilize specialized, vetted sub-processors. We geographically isolate persistent patient data from our transient AI processing layers.

Core Application Infrastructure:

• Retell AI: Handles real-time voice execution and speech-to-text processing. This provider is located in the USA, and processing is strictly governed by our executed Data Processing Agreement (DPA), Standard Contractual Clauses (SCCs), and a signed HIPAA Business Associate Agreement (BAA) to ensure healthcare-grade data protections.

• OpenAI / Anthropic: Provides conversational logic and reasoning under Zero Data Retention agreements. These providers are located in the USA, relying on SCCs and the Data Privacy Framework (DPF).

• Twilio / Telnyx: Provides telephony, inbound/outbound SIP routing, and SMS services. Carrier-side call recording is explicitly disabled on these platforms, ensuring voice media streams pass directly to our security-enforced processing layers. Infrastructure spans Australia and the USA, governed by SCCs and the Data Privacy Framework (DPF).

• Make (Celonis, Inc.): Manages workflow orchestration, automated API triggers, and PMS integration syncing. Processing is strictly governed by our executed Data Processing Agreement (DPA), utilizing the EU-U.S. Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs - Module 2: Controller to Processor), and the UK International Data Transfer Addendum. Scenario execution logs are automatically deleted on a rolling 30-day cycle.

• Chatdash: Provides analytics and reporting utilizing redacted transcripts. Hosted in the USA, transfers rely on SCCs and the DPF.

Operational & Administrative Sub-Processors:

• Airwallex: Manages subscription billing, invoicing, and payment processing. Hosted in Australia and the USA, governed by SCCs.

• HubSpot: Acts as our Customer Relationship Management (CRM) system for clinic onboarding. It strictly houses clinic business contact information, never patient health data. Hosted in the USA, governed by the DPF.

• Google Workspace: Provides internal operational email and administrative documentation storage for Summit AI staff. Hosted in the USA, governed by the DPF.

• Slack: Facilitates internal operational notifications and system alerts. Hosted in the USA, governed by the DPF.

Note on Practice Management Systems (PMS): Integrations with practice management software (e.g., Cliniko, Nookal, Gensolve) utilize API credentials or integration tokens provided directly by the Clinic. These platforms represent the Clinic's own primary systems and are not sub-processors of Summit AI.

6. Cookies and Analytics

We prioritize visitor privacy and data minimization across our web properties.

• Essential & Security Cookies: We use strictly necessary cookies and local storage tokens to enable core platform functionality, security firewalls, load balancing, and secure account session management for clinic users. These cannot be disabled in our systems. (Retention: Session to 13 months)

• No Third-Party Ad Pixels: We do not deploy cross-site advertising cookies, behavioral tracking pixels (e.g., Meta Pixel or LinkedIn Insight Tag), or third-party marketing scripts on our website.

• Privacy-Preserving Telemetry: We may collect aggregated, non-identifiable technical performance metrics (such as page latency, error logs, and browser types) to ensure server stability. This telemetry does not track individual visitors across unassociated third-party websites.
  
  

For detailed information on how we handle website technologies, please review our standalone Cookie Policy.

7. Data Retention and Security

We implement strict data lifecycle policies and AES-256 encryption at rest (TLS 1.3 in transit) to minimize risk.

• Audio Recordings: Automatically hard deleted 30 days post-call.

• Speech Transcripts: Hard deleted via automated database purges 30 days post-call.

• Workflow Logs (Make): Automatically overwritten or purged on a 30-day rolling cycle.

• Technical / Web Logs: Automatically deleted after 90 days.

• Clinic Account Data: Permanently erased within 30 days following the cancellation of an active subscription.
  
  

Data Breach Notification: If we become aware of a privacy breach that causes, or is likely to cause, serious harm, we will notify the affected clinic immediately (within 24 hours). This ensures the clinic can fulfill its obligations to notify patients and the relevant Privacy Commissioner or supervisory authority. We will provide full details of the breach and take immediate steps to contain it.

8. Jurisdiction-Specific Provisions & Legal Rights
We provide specific disclosures and honor individual privacy rights under local regulations in our core operating jurisdictions.

8.1 Australia (Privacy Act 1988 & APPs)

• Legal Framework: Summit AI acts as a Service Provider handling data solely on the documented instructions of the Clinic (the APP Entity).

• Cross-Border Disclosures (APP 8): Disclosures to sub-processors in the US are governed by APP 8.2(a). We utilize binding DPAs to ensure health information is protected to a standard substantially similar to the APPs.

• Access & Correction (APP 12 & 13): You have the right to request access to and correction of your personal information. We aim to process requests within 30 days.
  
  

8.2 New Zealand (Privacy Act 2020 & HIPC)

• Legal Framework: Summit AI acts as a Secondary Agency under Sections 11 and 12 of the Privacy Act 2020 and the Health Information Privacy Code (HIPC).

• Overseas Disclosures (IPP 12 / HIPC Rule 12): Transfers outside New Zealand satisfy IPP 12 through comparable contractual safeguards. Our processing does not constitute a separate "disclosure" by the clinic.

• Access & Correction (IPP 6 & 7): You have the right to access and correct personal information we hold about you. We aim to process requests within 20 working days.

8.3 United Kingdom & European Union (GDPR)

• Legal Framework: Summit AI operates strictly as a Data Processor under UK/EU GDPR Article 28.

• International Transfers: Transfers to sub-processors in the US rely on the UK Extension to the EU-US Data Privacy Framework (DPF), the UK IDTA, or SCCs.
  
  

9. Patient Inquiries & Children's Privacy

Patient Rights & Forwarding Protocol: Because Summit AI acts as a Data Processor / Secondary Agency, we cannot directly fulfill patient requests to access, correct, or delete health records or call audio. If a patient contacts Summit AI directly, we will forward the request to the relevant Healthcare Clinic within 5 business days. We provide technical tooling for clinics to execute data rights and will fulfill verified clinic instructions within 5 business days.

Children's Privacy: We do not knowingly collect personal information from individuals under 18 for our account and service delivery purposes. Any information processed about child patients is done solely on the clinic's instructions, is necessary for appointment scheduling, and is governed by the clinic's policies on consent and parental authority.

10. Contact Information

If you have any questions, concerns, or wish to review our comprehensive Data Processing Addendum (DPA), please contact our Privacy Officer:

• Name: Rubin Saini (CEO / Privacy Officer)

• Email: contact@usesummitai.com

We acknowledge all privacy enquiries within 2 business days and aim to resolve matters within 20 working days. If you remain unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority:

• New Zealand: Office of the Privacy Commissioner (OPC), www.privacy.org.nz

• Australia: Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au

• United Kingdom: Information Commissioner’s Office (ICO), www.ico.org.uk