How Automatus Labs collects, uses and protects personal data when you visit our website or use Automatus Assist.
This policy is from AUTOMATUSLABS LTD, trading as Automatus Labs (“we”, “us”). We are registered in England and Wales, company number 16794391, registered office 54 Barfield Avenue, London, England, N20 0DD.
Automatus Assist is our AI receptionist for UK businesses. It answers a business's phone, books appointments into its diary, sends confirmations and passes calls to the business's team when it should.
For anything about this policy or your data, email [email protected].
Personal data reaches us in two ways, and our role is different for each.
| Whose data | Examples | Our role |
|---|---|---|
| Our business clients and their staff | Names, work email and phone, login, settings, billing and usage records, support conversations | Controller: we decide how it is used |
| The customers and callers of those businesses | Names, phone numbers, emails, appointments, call transcripts and recordings, texts, emails, notes, tickets | Processor: we process it for the business, which is the controller |
| Visitors to our website | Enquiries sent through our contact form, basic server logs | Controller |
If you called or booked with a business that uses Automatus Assist, that business decides how your data is used. Please contact it first. If you write to us instead, we will pass your request on and help the business answer it.
Why: to set up and run the service (contract), to bill you (contract), to keep the service secure and improve it (legitimate interests), and to meet our legal duties, such as tax records (legal obligation).
Why: because the business has instructed us to, under our Terms of Service. We do not use this data for our own purposes, we do not build profiles from it, we do not sell it, and we do not use it to train AI models.
Automatus Assist uses artificial intelligence to understand callers and reply to them. Callers are told at the start of each call that they are speaking to an AI receptionist, and, when recording is on, that the call is recorded.
Some of our business clients are clinics, dental practices, opticians, pharmacies and vets. A short note or an appointment type can reveal something about a person's health, which is special category data under UK GDPR.
The business is responsible for having a lawful basis and a valid condition for that data. We process it only as the business instructs. Automatus Assist is not a medical record system, and businesses should keep clinical records in their own clinical systems.
Some of our providers process data outside the UK, mainly in the United States. Where they do, we rely on a lawful transfer mechanism, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified.
| Data | How long |
|---|---|
| Business account data | While the account is open, then deleted as described below |
| Call recordings | 30 days by default, or the period the business chooses |
| Call transcripts, texts, emails, appointments, customer records | While the business keeps its account, unless the business deletes them sooner |
| Website enquiries | Up to 2 years after our last contact, unless you become a client |
| Backups | Up to 30 days, then deleted automatically |
| Anonymised financial record of a closed account | 6 years, for tax and accounting. It holds only dates, amounts and types of charge, with nothing that identifies anyone |
Closing an account. When an account is closed it is suspended and scheduled for permanent deletion 30 days later, and the owner is emailed the date. Until then it can be restored on request. On that date the account, its users, records and recordings are permanently deleted and its phone number is released. Only the anonymised financial record above is kept. After that, deleted data cannot be recovered.
Under UK data protection law you can ask to access your personal data, correct it, delete it, restrict or object to how it is used, and receive a copy to take elsewhere. Where we rely on your consent, you can withdraw it at any time.
To make a request, email [email protected]. We may ask you to confirm who you are, and we will reply within one month. If your data is held because a business uses Automatus Assist, please ask that business; we will help it respond.
You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
We protect data with encrypted connections, hashed passwords, encrypted storage of provider credentials, separate data for each business, access controls with two-factor sign-in for our team, and logs of administrative access. No system is perfectly secure, so we cannot promise that data will never be compromised. If a breach affects your data, we will tell you and the regulator where the law requires it.
Automatus Assist is a tool for businesses and is not directed at children. If a business books an appointment for someone under 18, that business is responsible for any consent the law requires.
We will publish any changes on this page and update the date at the top. For important changes, we will also email our business clients before they take effect.
