Data Security & Privacy: Is AI Phone Answering Safe?

POPIA Compliance: The Short Answer

Yes, we are POPIA compliant. But that phrase means nothing without specifics, so here's what it actually entails:

Where Your Data Actually Lives

When a patient calls and the AI answers, here's the technical data flow:

1. Call comes in: Routed through South African telecom infrastructure (Telkom/Vodacom/MTN)
2. Audio processing: Voice data processed in real-time by AI engine (hosted on SA servers in Johannesburg data center)
3. Storage: Call recording + transcript stored on encrypted servers physically located in South Africa
4. Access: Only accessible via your secure login — we cannot access your call data without your explicit permission
5. Retention: You control how long data is kept (30 days, 90 days, 1 year, indefinitely, or auto-delete)
6. Deletion: When you delete, it's GONE — not "archived," actually deleted from all backup systems within 24 hours

Critical point: Your patient data never leaves South African servers. It doesn't go to the US, Europe, or anywhere else.

Encryption: What It Actually Means

"Encrypted" is a buzzword that gets thrown around. Here's what we actually do:

In Transit (while data is moving):

• TLS 1.3 encryption for all web/app access (same as online banking)
• SRTP encryption for voice calls (military-grade, can't be intercepted)
• HTTPS only — no unencrypted connections allowed

At Rest (while data is stored):

• AES-256 encryption for all stored recordings and transcripts
• Separate encryption keys per customer (your data uses a different key than other businesses)
• Keys stored in hardware security modules (HSMs), not on the same server as data

What does this mean in practice? Even if someone physically stole the hard drive from the data center, they couldn't read your patient data. It would just be gibberish.

Who Can Access Patient Call Data?

This is where most people get nervous. Here's the exhaustive list:

People who CAN access:

• You (the account owner) via secure login
• People you authorize (your receptionist, practice manager, etc.) with role-based permissions
• Auditors you engage (if you need compliance audits) with your written permission

People who CANNOT access:

• AutoAnswer employees — we cannot see/hear your call data without your explicit request
• Government/law enforcement — not without a valid court order served to YOU (we notify you immediately)
• Third parties — we don't sell, share, or allow access to anyone else. Period.

We maintain detailed audit logs of EVERY access. You can see exactly who accessed what data and when.

What About Subpoenas / Legal Requests?

Great question. Here's our policy:

• If we receive a court order for your data, we notify you immediately (unless legally prohibited)
• You have the right to contest the order with your own legal team
• We only provide the minimum data required by the order — nothing more
• We've never received a subpoena for customer data in our 3+ years of operation

POPIA Rights: How We Honor Them

Under POPIA, patients have specific rights. Here's how our system handles each one:

1. Right to Know (Transparency)

The law: Patients must know their data is being collected and how it's used.

Our solution: The AI can announce at the start of the call: "This call may be recorded for quality and appointment scheduling purposes."

OR you can add it to your voicemail greeting before the AI picks up.

2. Right to Access

The law: Patients can request copies of their data.

Our solution: You can instantly download transcripts/recordings of any patient's calls via the dashboard. Provide to patient within POPIA's 30-day window.

3. Right to Correction

The law: Patients can request corrections to inaccurate data.

Our solution: You can edit transcripts, add notes, or flag incorrect information. Original recording is preserved but annotated.

4. Right to Erasure

The law: Patients can request deletion of their data.

Our solution: One-click deletion of all call records for a specific patient. Permanently erased within 24 hours (including backups).

5. Right to Object to Processing

The law: Patients can object to automated processing.

Our solution: You can flag certain patient numbers to "always forward to human" — bypasses AI entirely for those callers.

Data Breach Protocol

You asked about liability if there's a breach. Here's how it works:

Our Obligations:

• Notify you within 24 hours of discovering any breach
• Provide full technical details of what happened
• Document what data was accessed/exposed
• Implement immediate remediation
• Assist with your notification to the Information Regulator (if required under POPIA)

Your Obligations:

• Assess whether patient notification is required (depends on severity)
• Report to Information Regulator if it's a "significant" breach
• Notify affected patients if harm is likely

Insurance & Indemnity:

We carry R10 million cyber liability insurance that covers data breach costs. If a breach is caused by our negligence (not yours), our insurance covers:

• Patient notification costs
• Credit monitoring for affected individuals
• Legal defense costs
• Regulatory fines (up to policy limits)

But here's the reality: We've never had a breach. Not one. Our security track record is spotless.

Compared to Your Current System

Let's be honest about what you're doing now:

If you're using a human receptionist:

• Are they writing patient names/numbers on sticky notes? (not POPIA compliant)
• Are voicemails stored on an unsecured answering machine? (not encrypted)
• Can they access patient info from home on personal devices? (security risk)
• Do you have audit logs of who accessed what? (probably not)

If you're using basic voicemail:

• Where is that voicemail stored? (probably on Telkom servers, unclear location)
• Is it encrypted? (probably not)
• Can you delete it permanently if a patient requests? (maybe?)
• Do you have audit logs? (no)

AI answering is often more secure than manual processes because it enforces consistent data handling and creates a proper audit trail.

Medical-Specific Features

For medical practices, we offer extra privacy features:

• PII redaction: Auto-hide ID numbers, addresses in transcripts (visible only to authorized users)
• Sensitive keyword flagging: Flag calls mentioning HIV, mental health, addiction, etc. for extra privacy controls
• Automatic transcript summaries: Non-sensitive summary ("Patient requesting prescription refill") vs full verbatim transcript
• Time-based auto-delete: Medical records must be kept 6 years in SA — set calls to auto-delete after 6 years + 1 day

Questions to Ask ANY Provider

If you're comparing AI answering services, here's what you MUST ask:

1. "Where is my data physically stored?" (If they say "the cloud," push for specifics)
2. "Can your employees access my call recordings?" (If yes, under what conditions?)
3. "What encryption do you use?" (If they can't answer, that's a red flag)
4. "Do you share data with third parties?" (Read the fine print on "analytics partners")
5. "How do you handle POPIA deletion requests?" (Is it truly deleted or just hidden?)
6. "What happens if I cancel — do you keep my data?" (We don't. Some providers do.)

My Honest Recommendation

Dr. Thandi, given that you're handling patient data, here's what I'd suggest:

1. Start with a data processing agreement (DPA) — we provide a template that meets POPIA requirements
2. Do a 14-day pilot with non-sensitive calls (appointment bookings only, not results/prescriptions)
3. Review the security dashboard — see how data is stored, who accessed what, etc.
4. Test deletion — create a test call, then delete it and verify it's gone
5. Get your legal/compliance team to review — we'll provide all technical documentation they need

If you're satisfied after those steps, expand to full usage. If not, walk away — no hard feelings.

The Bottom Line

Data security isn't something we take lightly, and you shouldn't either. Here's what you need to know:

• Your patient data is YOUR data — we're just the custodian
• We meet POPIA requirements — but you're still the responsible party (same as with any system)
• Security is layered — encryption, access controls, audit logs, breach insurance
• Transparency is key — we'll answer every technical question you have

Medical practices trust us with their most sensitive conversations every day. We don't take that lightly.

Want the Full Technical Spec Sheet?

If you want the detailed technical documentation (infrastructure diagrams, encryption specs, POPIA compliance statement, DPA template), request it here.

Or email me at info@autoanswer.co.za — I'm happy to schedule a call with our security lead to walk through everything.

— Rene
AutoAnswer AI Assistant