Privacy Policy

1. About us and this policy

WeTalk.ai Limited is a New Zealand company (company number 9386891). Our registered office is 120 School Road South, RD 2, Mosgiel 9092.

We provide AI receptionist services, inbound and separately agreed outbound calling, and administrative business automations for New Zealand health businesses. These services support clinic communications, information handling and operational workflows. The functions supplied to a clinic are agreed with that clinic and operate only where enabled.

This policy covers those services, our website and demonstration line, enquiries, clinic setup and our business dealings. The Privacy Act 2020 and, where applicable, the Health Information Privacy Code 2020 govern the information. Clinic staff and contact details can be personal information even when no patient information is involved.

Our Privacy Officer and complaints contact is Hamish Faulks: admin@wetalkai.co.nz or our registered office. Putting “Privacy” in the subject helps, but is not required.

For patient services we ordinarily process information solely on the clinic’s behalf as its agent under section 11 of the Privacy Act. The clinic determines the service purposes and is normally the first contact for patient requests. Our own statutory duties still apply where required. We separately handle business contacts, contracts, billing, website and demo enquiries for our business purposes.

Client agreements contain binding instructions and protections. This policy does not replace a clinic’s patient notice, obtain patient consent for it or change a signed contract.

2. Information handled for health businesses

Information and sources

Depending on the agreed service, we handle the information needed to carry out the clinic’s authorised administration. This may include names, contact details, dates of birth and patient-matching details; bookings, practitioner details and messages; relevant health information, correspondence, documents and attachments; call recordings and transcripts; and necessary follow-up and quality-assurance records.

A service may also need information from existing clinic records or other authorised providers, including relevant clinical documents and existing NHI or ACC identifiers where necessary and lawfully available. We limit each service to the information needed for its agreed lawful purpose. Ordinary inbound Jenny does not ask for clinical documents, NHI or ACC identifiers, or payment details. We do not use voice characteristics to identify or verify a person.

Information may come from you, an authorised representative, the clinic, its systems or another provider where lawful for the agreed service. Telephone networks also supply call details.

Purposes and limits

We carry out agreed administrative instructions, including handling calls and messages, helping with bookings, authorised follow-up, processing and transferring necessary information, updating clinic systems and completing business workflows. Necessary quality assurance checks and corrects the service supplied to that clinic.

These services do not provide clinical advice, diagnosis, treatment, clinical triage or emergency response. The clinic retains clinical responsibilities. Uncertain matches, failed delivery and matters needing clinical judgement require appropriate staff review.

We do not use patient information for our own marketing, AI model training or unrelated product development. Ownership of code does not permit reuse of patient information. A business marketing permission does not authorise publication of identifiable patient information.

Notices and choices

At the start of every inbound call Jenny identifies herself as an AI assistant and says the call may be recorded for quality assurance. Separately agreed outbound calling requires clinic/AI identification, the applicable recording notice and identity checks before sensitive details are discussed.

The clinic’s patient notice must cover its collection, purposes, intended recipients, agency details, access/correction rights and other required matters. Indirect collection requires assessment of the applicable notification rules and exceptions. This website policy alone does not complete those steps.

You may decline to provide information. Without necessary identity, contact or booking details an action may not be possible; contact the clinic for another way to deal with it. An existing patient relationship does not give unlimited permission for promotional contact.

Delivery and retention

Information is delivered to the clinic’s practice system to the extent the agreed integration supports it. Failed or unsupported delivery needs staff follow-up. A completed call does not prove the clinic received its required record.

These are the contractual limits for our ordinary inbound Jenny copies, subject to legal preservation:

Across our agreed services, we automatically delete patient information from WeTalk-controlled email accounts on a rolling 365-day basis. The purge runs daily so that patient-service emails and their attachments are not retained for more than 365 days from the date and time each message was first sent or received by WeTalk, subject to the specific legal preservation duties below. This includes recoverable deleted-item folders. We delete information earlier when it is no longer lawfully needed or a shorter agreed limit applies. Copying, forwarding within WeTalk or ending a service does not restart the clock. The clinic controls its own received copies.

A separate outbound or automation service requires an agreed data-handling schedule before patient processing. It identifies each necessary copy, purpose, system and expiry period/trigger. The shared email purge applies to patient information in our email accounts for those services too; a service may require earlier deletion. Jenny’s other periods do not automatically apply to another service. Working information is kept only as needed for the agreed processing, verified delivery and bounded retry period. Any separate QA or support record needs a necessary purpose and a defined limited period. The period is assessed against that purpose and legal duties; the clinic or our Privacy Officer can explain the retention applying to the particular service.

A legal duty or binding order may require a particular item to be preserved, including while an access request is dealt with. Restrict such items and delete them when the duty ends unless another duty applies. Ending a service does not restart expiry.

The clinic controls its received copies and clinical records. Applicable health-record retention and transfer duties must be met before working copies are deleted. A QA limit does not authorise destruction of a required patient record.

Deletion from systems available to us and a provider’s completion of deletion from restricted residual systems are different stages. Provider copies may complete deletion under applicable binding terms and law; they must not remain available for ordinary use or restoration to extend retention. We do not promise immediate disappearance of every copy held by every person.

Children and representatives

Children’s information requires appropriate care and fair collection. A parent or caregiver does not automatically have unrestricted access to every record. Identity, authority and applicable disclosure rules are checked before release.

3. Website and enquiries

The website’s current configuration uses no advertising trackers or analytics tools. Hosting/security still process technical request information, such as IP addresses and logs; no analytics does not mean no technical processing.

Google Fonts connects your browser to Google. Our enquiry forms collect your name, clinic or organisation, contact details and reason for contacting us, with service or booking-system details where requested. We use this information to respond and manage the enquiry in our customer-management system. Where a clinic-name search is offered, it sends the search text through our server to Google’s places service.

Do not put patient or sensitive health information in these business-enquiry features. Without necessary contact details we may be unable to reply.

4. Demonstration line

Our demo line, 04 888 8266, lets people try Jenny. We are responsible for demo and business-enquiry information.

The AI/recording greeting applies. Demo recordings have a 30-day limit. Contact details you supply may be used to respond about our services and recorded in our customer-management system. Use fictional examples, not another person’s patient information.

5. Business dealings

We handle business contacts, correspondence, agreements, billing records and information needed to configure/support services. Credentials are restricted to authorised service use and excluded from ordinary AI chat/coding tools.

We use Anthropic’s Claude and OpenAI’s ChatGPT/Codex as business AI services: business information only; no patient data or access credentials. Permitted information includes business correspondence and agreements. Approved patient-service AI processing is assessed separately.

We sometimes record meetings with Google Meet and use its AI notes/transcripts. Participants are notified when recording starts. Our retention rule is to delete raw recordings after necessary notes/transcripts are extracted; keep necessary client notes/transcripts for the engagement; and keep general prospect notes/transcripts for no more than 12 months after last meaningful contact, subject to a specific legal retention duty. The more specific clinic-setup rule below applies to setup-related records, including its welcome-call transcript.

For process discovery, we instruct clients to remove patient details from recordings, screenshots and samples, and check screenshots and transcripts before putting them into business AI/development tools. We delete raw process recordings after extracting the necessary screenshots and transcripts. We retain the necessary redacted process material to build, check and support the agreed service during the client relationship, then delete it when that purpose or relationship ends, subject to a specific legal preservation duty. Keeping our code does not permit keeping embedded patient information, credentials or client-supplied documents. Identifiable health information needs a separately assessed lawful service purpose, approved systems and retention instructions.

Clinic setup and AI assistance

Our clinic-setup service collects the main contact's name, role, email and mobile; organisation, clinic and website details; booking systems; how the clinic heard about us; and the authorised colleagues invited to help. Setup answers include business phone routing, hours, clinician names and roles, appointment and ACC booking rules, cancellation policies, safety/escalation instructions and which practice-system accounts the service needs to connect. We also handle authorised staff notes, sign-in/access records and the setup timeline. Do not submit patient information, passwords or practice-system API keys through these forms, uploads, dictation or chats. Separate secure arrangements apply to access needed for an agreed service.

We use the clinic's public website, uploaded business files, dictated text, AI-interviewer answers and welcome-call transcript/notes to prepare and check the setup, answer questions and prepare the call brief, suggested Jenny configuration, delivery pack and setup timeline. Necessary personal information may be supplied by the clinic or a colleague rather than directly by you. We provide the required direct or indirect collection information, subject to applicable exceptions. Providing optional material is voluntary; missing necessary contact or setup details can prevent us completing the setup. An invitation or privacy acknowledgement does not itself sign a service agreement or give marketing permission.

Anthropic's Claude API assists with website reading, extracting setup information, suggested answers, the interviewer and briefs. Check and correct AI suggestions before they are approved for the service. If browser dictation is enabled, the browser's speech-recognition provider processes microphone audio to produce text; this can involve online processing, including Google for Chrome. It is separate from Google Meet/Gemini processing. You can type instead. Do not dictate patient information or access credentials.

Setup records and private uploaded files use our Supabase project in Sydney, with authorised clinic access and restricted WeTalk staff access. Our Sydney worker performs the setup jobs. Vercel serves the website/setup pages and handles necessary technical request information; public pages must not contain clinic records. Resend delivers our setup emails. Emails may include invitations, access codes, reminders, answers and delivery briefs. You can stop setup reminders using their stop link or by contacting us. Other invited clinic users and authorised delivery personnel can receive the information needed for their role. The providers and overseas safeguards below apply; the Sydney project does not mean every provider copy or access stays in Australia.

We keep necessary clinic-setup records, uploads, chats, extracted text, welcome-call transcripts and briefs to prepare and support the agreed service. We delete setup information when it is no longer needed for those purposes or the necessary wind-down, including when setup does not proceed or the client relationship ends. We remove information that is no longer needed during an active relationship too. Limited recovery copies are restricted from ordinary use and kept only for the short period needed to recover an accidental deletion, then erased. Access is revoked promptly when no longer authorised; sign-in codes retain their shorter security expiry. General business enquiries and required agreement, accounting and tax records have their separate lawful purposes and periods; they are not retained as a hidden copy of the setup. Patient information received by mistake is restricted and assessed for appropriate removal or other lawful handling; the client-relationship period is not permission to retain it as ordinary setup material.

The setup cleanup covers answers, files, dictated text, interviewer chats, transcripts, briefs and delivery packs, staff contact details, email copies containing access codes or answers, contact notes and setup sign-in records under our control. We remove held practice-system access when it is no longer authorised. We may retain the main contact's name and email, a minimal relationship record, agreements and financial records only for their separate lawful business or recordkeeping purposes, with access and retention limited accordingly. Our setup deletion reports and logs record dates, record types and counts, without file names, email identifiers or record contents. We do not routinely provide a setup export before cleanup; this does not restrict statutory access/correction rights, agreed delivery obligations or any mandatory transfer of required records. Provider residual systems, specific preservation duties and recipients' own copies remain subject to the separate limits described in this policy.

Business records are retained for lawful relationship, contract, accounting and other recordkeeping purposes. Tax records are kept for at least seven years after the relevant income year. Exact supplied Terms are retained as the relevant agreement requires. Other information is deleted when its lawful purpose ends.

Stripe handles payment details; Xero holds accounting records. We do not store payment-card details ourselves. Necessary billing and payment-status records remain separate.

6. Providers and overseas handling

We do not sell personal information. Necessary recipients include the clinic, authorised personnel and providers, and others where law permits or requires.

This does not authorise patient information in business-only systems. Additional automation providers, integrations and countries must be assessed/documented before use; public information is updated where needed to explain actual handling.

Providers' actual terms, selected products and settings determine their own retention and processing. An API request is not necessarily deleted immediately, and a project region does not cover every support, log or content-delivery location. We do not describe browser speech processing as covered by a Google Workspace agreement merely because both involve Google.

Authorised WeTalk personnel also access patient information from Australia. A work email does not make remote access NZ-based.

Section 11 governs processing solely on our or the clinic’s behalf. We assess actual purposes, binding terms, enabled settings, access and retention. A platform setting does not prove a downstream model’s safeguards. Independent purposes, including Twilio’s own carrier records, require separate assessment.

An overseas disclosure requires a lawful disclosure basis and compliance with HIPC Rule 12 or Privacy Act principle 12 as applicable. We must establish reasonable grounds for relevant safeguards; a client signature or certification alone is insufficient. Provider-change notices follow each client’s actual agreement.

7. Safeguards

Service requirements include appropriate access restrictions, multi-factor authentication on systems holding patient, credential or financial information, full-disk encryption on staff computers, encrypted connections between service systems and documented incident handling. We do not represent ordinary telephone-network transmission as end-to-end encrypted by WeTalk.

Safeguards require proportionate supplier checks, monitoring and security review/testing.

8. Incidents

We notify and assist clinics under the applicable agreement and our legal duties. Our Terms require written notice within 24 hours of awareness of a Security Incident.

Where a breach is notifiable because it has caused or is likely to cause serious harm, the responsible agency must notify the Privacy Commissioner and affected people as soon as practicable, subject to the Act. Contractual contact/acknowledgement periods do not postpone statutory action. We meet our own duties where applicable.

9. Access and correction

You may ask whether information is held about you, request access and seek correction. Contact the clinic first for its patient-service information; we assist and route requests appropriately. For business enquiries, clinic-setup and other records we handle for our own purposes, contact our Privacy Officer directly. You may also contact our Privacy Officer about a patient-service request.

Identity/authority checks may be needed. We respond as soon as reasonably practicable within the statutory period, generally 20 working days for the decision, with lawful extensions or transfers notified where applicable. If a correction is not made, you can seek attachment of a statement of the correction requested.

Deletion requests are assessed against lawful purposes and record/preservation duties; there is no unconditional promise to erase every record on request.

10. Complaints

Contact Hamish Faulks at admin@wetalkai.co.nz or our registered office. We deal with complaints however they reach us.

For HIPC complaints, we acknowledge in writing within five working days unless already resolved to your satisfaction, explain relevant procedures and document the complaint/response. Within ten working days after acknowledgement we decide whether it is justified or determine the additional time needed. If that additional time exceeds 20 working days we explain the delay and reasons. As soon as practicable after deciding we explain our reasons, proposed action and available review routes.

You may complain to the [Office of the Privacy Commissioner](https://www.privacy.org.nz/).

11. Changes

We review the policy when relevant services, law or information handling change. Each published version is dated and preserved at its own address. Updating a policy does not itself amend a signed agreement or replace required notice to a client or individual.

Version 3 — 31 October 2026  ·  © 2026 WeTalk.ai Limited

Previous versions

Earlier versions of this policy are no longer published on this website. If you need a copy of an earlier version, email admin@wetalkai.co.nz and we will send it to you.

• Version 3 — 31 October 2026 — current (this page)