Privacy Policy
Last updated: 17 October 2026, version 1.0
This policy explains how Andrés Martínez Gómez, trading as Frontdesk Agents, Avda. de la Fama, 19, 30008 Murcia, Spain ("Frontdesk Agents", "we", "us") handles personal data on our website and when we provide our AI front-desk service to clinics. Contact: hello@frontdeskagentshq.com.
1. Who is responsible
- Website visitors, demo users, leads and client contacts: we are the controller: Andrés Martínez Gómez, trading as Frontdesk Agents, Avda. de la Fama, 19, 30008 Murcia, Spain; hello@frontdeskagentshq.com.
- Clinic patients and callers: the clinic is the controller, and we act as its processor under a Data Processing Agreement (GDPR Art. 28). Patients should contact their clinic first to exercise their rights; we will help the clinic.
2. Website visitors
When you visit frontdeskagentshq.com, our hosting and security provider processes technical data (IP address, browser and device information, requested pages, timestamps) to deliver the site and protect it against abuse. Legal basis: our legitimate interest in operating a secure website (GDPR Art. 6(1)(f)). These logs are kept only as long as needed for security and operation.
3. The browser voice demo
Our website offers a voice demo of an AI receptionist for a fictional clinic, used in your browser. - The demo receptionist is an AI assistant and says so at the start of the call. Calls last at most 5 minutes. - No audio recording is made. A text transcript is created so the AI can respond. It is shown live in your browser. Our voice provider (Vapi, United States) keeps the transcript with the call record under its standard retention settings, and may use call content in de-identified form to improve its service. - If you make a demo booking, the name and phone number you give are stored in our demo database to show the booking flow. Please use a fake name and number, and don't share health information or other sensitive details. - To prevent abuse, we keep your IP address (grouped by network) and call timestamps to limit demo calls per day, and may use a bot check. - Legal basis: our legitimate interest in showing how our product works and preventing abuse (GDPR Art. 6(1)(f)). - Retention: demo bookings and abuse-prevention records are deleted automatically within 30 days.
4. Leads, enquiries and client contacts
If you email us, call us, start checkout or become a client, we process your name, email, phone number, clinic name, your messages, account details and billing data. Card payments are handled by our payment processor (Stripe); we don't store full card numbers. We send service emails (for example onboarding, renewal reminders and notices) through an email service provider.
| Purpose | Legal basis |
|---|---|
| Respond to enquiries and demo requests | Steps prior to a contract / legitimate interests |
| Provide and bill the service, send service emails | Contract |
| B2B marketing emails | Legitimate interests, or consent where the law requires it; you can opt out at any time |
| Security, fraud prevention, legal compliance | Legitimate interests / legal obligation |
5. Clinic patients and callers (we act as processor)
When a clinic uses our service, we process, on the clinic's instructions: caller name, phone number, requested service and appointment date/time, plus the call audio, transcripts and messages in which these are exchanged. Our agent is designed to refuse to collect health details (symptoms, medical history, reason for visit) and does not ask for date of birth. Because a booking with a clinic can still reveal health-related information, we protect all patient data as potentially special-category (health) data.
Our agents identify themselves as AI assistants at the start of each call or chat. Calls may be recorded and transcribed for booking accuracy, quality and the clinic's records, with a disclosure at call start and consent where legally required; clinics configure retention. We do not use clinic patient data to train AI models. Our language-model provider for the clinic service, Google Cloud Vertex AI, does not use customer data to train its models under Google Cloud's terms. Our voice provider, Vapi, may use call content in de-identified form (not identifying the clinic or caller) to improve its own service. No decisions with legal or similarly significant effects are made solely by automated means; clinical decisions remain with clinic staff.
6. Cookies
We use only strictly necessary cookies and similar technologies needed to run and secure the website (for example a bot-protection check). We use no analytics, advertising or tracking cookies. If we add any such tools, we will ask for your consent first and update this policy.
7. Service providers
We share data with service providers only as needed: - Cloudflare, Inc.: website hosting, demo server and database, security and bot protection, and secure routing of our service traffic (global network). - Vapi Inc. (United States): voice AI for the demo and for clinic calls (telephony, transcription, voice processing). For the browser demo, Vapi uses OpenAI (United States) as the AI model. - Hetzner Online GmbH: hosting of our service servers in Germany or Finland. - Google Cloud (Vertex AI): AI language model for the clinic service, in Google's EU multi-region. - Meta (WhatsApp Business Platform): WhatsApp messaging for clinics that use it. - Google Calendar and/or Cal.com: appointment scheduling, depending on the clinic's setup. - Stripe: payments and billing of our clinic customers (never patient data). - Our email service provider: service emails to clients and leads.
We don't sell personal data. The full list of subprocessors for clinic data is in Annex 2 of our Data Processing Agreement.
8. International transfers
Some providers process data outside the European Economic Area, in particular Vapi and OpenAI in the United States, Meta (including in the United States) and Cloudflare's global network. Our team may also access data from outside the EEA. In each case we rely on an adequacy decision, the EU Standard Contractual Clauses (with the UK Addendum where relevant) or the EU-US Data Privacy Framework where the recipient is certified, plus appropriate safeguards.
9. Retention
Enquiry and lead data: up to 24 months after last contact. Client account data: the contract term plus the period required by law; billing records as required by tax law. Demo data: see section 3. Patient data (clinic instructions can shorten these): call recordings and transcripts 90 days; conversation logs 12 months; all patient data deleted or returned within 30 days after the contract ends.
10. Security
Encryption in transit and at rest, access controls, least-privilege access, logging and vendor due diligence. We notify affected clinics of personal data breaches without undue delay, and within 72 hours at most.
11. Your rights
Under the GDPR (and the UK GDPR where it applies) you can request access, rectification, erasure, restriction or portability of your data, object to processing (including direct marketing at any time), and withdraw consent. Email hello@frontdeskagentshq.com. You can also complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority. Patients: please contact your clinic.
12. Children
Our website is not directed to children. Patient data concerning minors is processed only on the clinic's instructions.
13. Changes
We will post updates on this page and notify clients of material changes.
Questions: hello@frontdeskagentshq.com · Terms · Pilot agreement · Refund · Privacy · DPA · Imprint