Privacy Policy

1. About us and this policy

WeTalk.ai Limited is a New Zealand company (company number 9386891). Our registered office is 120 School Road South, RD 2, Mosgiel 9092.

We build AI tools for New Zealand businesses, including Jenny, an AI receptionist that answers the phone for physiotherapy and allied health clinics.

This policy covers Jenny, our website, our demo line, and how we deal with the clinics and businesses we work with. Where a business has its own agreement with us, that agreement also sets out how we handle its information.

It explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and what you can do about it. We follow the Privacy Act 2020 and, where health information is involved, the Health Information Privacy Code 2020.

The information we hold about you depends on how you have dealt with us:

Sections 6 to 11 apply to everyone.

Questions or requests: our Privacy Officer is Hamish Faulks. Email admin@wetalkai.co.nz and put "Privacy" in the subject line, so it reaches him straight away.

2. If you rang a clinic and spoke to Jenny

Who is responsible for your information

The clinic you called. We answer the phone on the clinic's behalf and handle your information as its agent. We do not use it for any purpose of our own.

What Jenny tells you

At the start of every call, Jenny tells you that she is an AI receptionist and that the call may be recorded.

What we collect

• your name
• your phone number, which your phone network passes on automatically when you call
• your date of birth
• your email address, if you give it
• the reason for your call, including any injury or health concern you mention
• your booking preferences, such as a day, time, service or practitioner

You don't have to give any of this. Without your name and contact details Jenny can't make a booking for you, but you can always contact the clinic another way.

We don't ask for NHI numbers, ACC claim numbers, medical records, clinical notes or payment details.

How we use it

We use your information to book, change or cancel your appointment, or to pass a message to the clinic. We also review call recordings and transcripts to check Jenny handled your call properly and to fix anything she got wrong for that clinic.

We never use your information for marketing. We never use it to train AI models, or to develop our products more generally. We don't use your voice to identify you.

Where it goes

Your booking details go straight into the clinic's own booking system while you are on the call. The clinic keeps its own record of your appointment under its own privacy policy.

To run the call, your information passes through the technology providers listed in section 6. They handle it only to provide our service, not for their own purposes.

How long we keep it

Deletion is automatic. We keep no other copy of your information.

Our phone carrier also keeps basic call records, such as the numbers involved and the time and length of the call, for its own billing and legal obligations, as any phone company does.

Children and young people

Children and young people sometimes call clinics. Their information is handled in exactly the same way and with the same protections. Parents and caregivers should know that calls may be answered by AI and that what is said is passed to the clinic.

Seeing or correcting your information

Contact the clinic you called. It is responsible for your information and can deal with your request. We will help it find, correct or delete anything we still hold.

3. If you visit our website or send us an enquiry

No cookies, no tracking, no analytics. Our website doesn't use cookies or analytics tools, and we don't track your visit.

Fonts. Our pages use fonts supplied by Google. To load them, your browser connects to Google, which receives your IP address. We don't receive it.

Enquiry form. If you fill in the form on our website, we collect your name, phone number, email address, clinic name and the booking system your clinic uses. We use these details only to get back to you about our services. They are passed through our website host (Vercel) and our automation system (n8n) into the system we use to manage enquiries (ClickUp). If you leave the form blank we won't be able to reply.

Clinic search. When you type your clinic's name into the form, our server sends that text to Google's places service to find a match. Google does not receive your IP address for this search.

4. If you ring our demo line

Our demo line, 04 888 8266, lets you try Jenny for yourself. On this line we are responsible for your information, not a clinic.

As on every call, Jenny tells you at the start that she is an AI and that the call may be recorded. Demo calls are recorded, and recordings are permanently deleted within 30 days.

If you give Jenny your details during the call, we use them only to follow up with you about our services. They go into the system we use to manage enquiries (ClickUp).

5. If your clinic or business works with us, or is talking to us

What we hold. Contact details for the people we deal with, our correspondence, the agreements you sign, and billing records. To connect Jenny to your booking system we also hold the access details you give us, and use them only for that purpose.

Payments. Direct debit and payment details are held by our payment provider, Stripe. We don't hold card or bank account details ourselves. Our accounting records are kept in Xero for 7 years, as tax law requires.

How long we keep it. Client contact details are kept for as long as we work together.

Recorded meetings. We sometimes record meetings on Google Meet, which tells everyone when recording starts, and use an AI tool to write notes from the recording.

• We delete the video once the notes and transcript have been taken from it.
• If we work together, we keep the notes and transcript while we do, and delete them when the work ends.
• If you don't become a client, we delete them 12 months after we were last in meaningful contact.

6. Who we share information with, and where it is held

We don't sell personal information. We share it only with the providers below, who help us deliver our services, or where the law requires or allows us to.

Jenny, handling caller information

Running our business (no caller information)

Information held outside New Zealand

As the tables show, some of these providers are overseas. They handle information only to provide their service to us, under data-protection terms, and not for their own purposes. The one exception is the basic call records our phone carrier keeps for itself, described in section 2.

Where information is disclosed overseas, we only do so where we have reasonable grounds to believe it will be protected in a way comparable to New Zealand law, as Rule 12 of the Health Information Privacy Code 2020 and principle 12 of the Privacy Act 2020 require. In reaching that view we look at each provider's contractual commitments and security controls.

Our clients are told about changes to the providers that handle their information, as set out in their agreements with us.

7. How we protect information

• Multi-factor sign-in on every system that holds caller, health, financial or access information
• Full-disk encryption on every device our team uses
• Encrypted connections between the systems that handle caller information, and encryption by our providers where they store it. The phone call itself travels over the ordinary phone network, like any call to a clinic.
• Access limited to the people who need it for their work
• Documented procedures for responding to security incidents
• Security reviews at least every three months
• Independent penetration testing of our service within 12 months of our first client agreement
• Data-protection terms with our providers

8. If something goes wrong

If a privacy breach affects information we handle for a client, such as a clinic, we tell that client within 24 hours and help it take the steps the law requires, including telling the people affected and the Privacy Commissioner.

If a privacy breach affects information we hold ourselves, and it has caused or is likely to cause serious harm, we notify the Privacy Commissioner and the people affected as soon as we practicably can.

9. Seeing and correcting your information

You have the right to ask for the personal information held about you, and to ask for it to be corrected.

• If it came from a call to a clinic, ask the clinic (see section 2).
• For anything else, email admin@wetalkai.co.nz with "Privacy" in the subject line.

We may need to confirm who you are before we release anything. We will respond as soon as we reasonably can, and within 20 working days. If we decide not to correct something, you can ask us to attach a statement of the correction you asked for.

10. Complaints

If you are unhappy with how we have handled your information, contact our Privacy Officer, Hamish Faulks, at admin@wetalkai.co.nz. Putting "Privacy" in the subject line helps it reach him straight away, but we will deal with your complaint however it reaches us.

We will acknowledge your complaint in writing within 5 working days. Within 10 working days after that, we'll tell you whether we think the complaint is justified, or how much more time we need and why. When we have decided, we will explain our reasons and what we will do about it.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner:

• privacy.org.nz
• 0800 803 909
• enquiries@privacy.org.nz

11. Changes to this policy

We review this policy at least once a year, and whenever we change how we handle personal information. The version number and date at the foot of this page show when it was last updated, and every earlier version stays available at its own address. If a change significantly affects how we handle information for our clients, we will tell them.

Version 1 — 14 September 2026  ·  © 2026 WeTalk.ai Limited

Previous versions

Every version of this policy stays available at its own address, so you can always read the one that applied at the time.

• Version 1 — 14 September 2026 — current (this page)