Privacy Policy

Privacy Policy

How we handle personal information when you call a dental clinic that uses our phone assistant, call one of our demo lines, or contact us about our services. The parts about clinic calls describe how the service works once a clinic goes live with it.

Last updated: 12 November 2026

1. Who we are

Easehand Automations is a business being set up by Billal Mohamad, based in Sydney, NSW ("we", "us"). Until the company is registered, services are offered by Billal Mohamad. We provide an automated phone assistant ("the Agent") to dental clinics. The Agent answers calls for a clinic after hours and, if the clinic uses this option, during opening hours when the clinic's team is busy or doesn't answer. It takes booking requests and messages, answers basic questions with the clinic's approved answers, and makes a short written summary for the clinic's team.

We provide the Agent under the clinic's name. When you call a clinic that uses the Agent, it answers as that clinic's AI assistant, so you may not hear our name. The clinic's privacy policy tells you that it uses a service provider for its phone assistant. This policy explains how we, as that provider, handle your information.

We comply with the Privacy Act 1988 and the Australian Privacy Principles, and with the NSW Health Records and Information Privacy Act 2002, in how we handle your information.

When we handle patient information, we do so on behalf of the clinic you called. The clinic remains responsible for your dental care and your clinical records. The clinic's own privacy policy also applies. Please read it too.

2. What information we collect

Depending on the service the clinic uses, we may collect:

• Contact and identity details: name, phone number, email, whether you're a new or existing patient. (We don't ask for your date of birth at present.)
• Booking details: appointment type requested, preferred times, dentist preference.
• The reason for your call, in brief: for example "toothache" or "broken filling". This can be health information, which is sensitive information under the Privacy Act. We ask only for what the clinic's team needs to deal with your booking request or message. The clinic's team confirms any booking with you.
• Call summaries (summaries only): we do not audio-record calls or keep a full transcript. The Agent listens live to help you, and we keep a short written summary of your request for the clinic (for example name, number and reason for the call). We tell you this at the start of the call. If you'd rather we didn't keep a note, say so and we'll take only your name and number for a callback. The summary can still be health information, which is sensitive information.
• Demo calls: if you call a demo line we've built to show a clinic how the Agent works, we don't record the call and we don't keep a full transcript. Any call data (including any short note) is deleted when the demo is taken down (within 14 days at most). Please don't share real patient details on a demo line.
• Messages: we don't send or receive text messages (SMS) at present.
• Technical information: call times, call length, phone number calling.
• Clinic staff details: names and work contact details of clinic staff we deal with.
• Business contacts: if you contact us about our services, your name, your clinic and your contact details. We use them only to reply to you and to arrange your demo or audit. We do not add you to a marketing list. Please do not send us patient details. Our email provider stores your message in Australia. It may be processed or accessed outside Australia, for example for spam filtering or support.

You can choose not to give some details, or to ask for the clinic to call you back instead. If you don't want to give your name, the Agent may not be able to pass on a booking request for you, but it can take a message.

3. How we collect it

• From you, when you call a clinic that uses the Agent.
• From the clinic, for example its opening hours, appointment types and on-call details. We don't access the clinic's practice management software.
• Automatically, from the phone systems that carry the call.
• From you, when you email us about our services.

How we hold it. We hold information electronically. Our main database is in Sydney, Australia. Our email (Microsoft 365) stores data at rest in Australia. See sections 5 to 7.

4. Why we collect, use and share it

We use your information only to provide the clinic's front-desk services, which means:

• answering your call and understanding what you need;
• passing messages and call summaries to the clinic, and sending an urgent alert to the clinic's front desk during opening hours, or its on-call contact after hours, under the clinic's emergency protocol. Our emails to the clinic carry no patient details (not in the subject, the preview or the body), only a secure link that expires after 24 hours. The link opens our staff portal, and only a named staff user of that clinic can read the summary after logging in;
• passing your booking request or message to the clinic's team in a short written summary. The clinic's team contacts you to confirm any booking. We don't book directly into the clinic's software, and we don't send text messages. We do not make outbound AI calls or send marketing or recall messages;
• checking quality and safety (for example, reviewing a sample of call summaries, and live monitoring where needed, to make sure the Agent never gives clinical advice and handles urgent calls correctly);
• keeping the service secure and fixing problems.

We do not sell your information. We do not use it for our own marketing. If clinics later ask us to send text messages, we'll update this policy first. If they ask for marketing or recall messages, we'll do so only where the clinic has the consent the Spam Act requires, with the clinic identified and a working unsubscribe, and we'll update this policy first. We switch off use of your information for AI training in our voice AI provider's settings before handling any real patient data. ElevenLabs uses self-serve customer data for training unless the customer opts out, and the opt-out covers future training only. ElevenLabs says its contracts bar its third-party model providers from training on customer content.

5. Who we share it with

• The clinic you contacted.
• Our service providers who help us run the Agent ("sub-processors"), under contracts that limit what they can do with your information:
  • ElevenLabs (Conversational AI): speech recognition, voice and conversation handling (live processing). We configure agents for summaries only (Zero Retention Mode if available, otherwise no voice recording and no retention), so call audio and full transcripts are not kept. Details needed for the short summary and any tool calls may still be processed in the United States. ElevenLabs has no Australian region.
  • AI language models called by ElevenLabs: third-party models (for example Google Gemini, OpenAI or Anthropic Claude) or models hosted by ElevenLabs. The ElevenLabs-hosted models run in the US or the chosen enterprise region. At present the default model is Google Gemini, with other models as backups. These providers may process data in the United States and other countries where they operate. We have not yet confirmed every country.
  • Twilio, Inc.: Australian phone numbers and calls (voice only; we don't send texts). Voice can be processed in Sydney if routed through Twilio's AU1 region.
  • Microsoft 365 (Microsoft Corporation): email that sends call summary notices and urgent alerts to the clinic's nominated addresses (the emails carry a link only, no patient details), and our own mailbox. Our mailbox data is stored in Australia. It may be processed or accessed outside Australia, for example for spam filtering or support.
  • Supabase: our database, Sydney, Australia (AWS ap-southeast-2). Core data stays in Sydney. Named clinic staff read each summary in our staff portal after logging in. The email to the clinic has no patient details and a link that expires after 24 hours. Edge Functions are pinned to Sydney, and the storage cache may be served globally.
  • Cloudflare: a health check of our systems. It carries no personal information.
• Others where the law requires or allows it, for example emergency services if someone's life or safety is at serious risk, or a court order.

6. Overseas disclosure

Our main database is in Sydney. Personal information, including health information in call summaries (and content processed live during the call), is likely to be disclosed to recipients in the United States: ElevenLabs (voice AI live processing) and the ElevenLabs-hosted AI models. Call content processed live is also sent to third-party AI model providers, which may process it in the United States and other countries where they operate. Some of our other providers, or their subcontractors, may also process or access data outside Australia, for example in the European Union (service logs) and Singapore (support). We have not yet confirmed every country. We will update this policy when we know more. Twilio voice stays in Sydney when routed through AU1, but content passed to ElevenLabs for live processing leaves Australia regardless. We do not store call audio or full transcripts.

Before we disclose personal information to an overseas recipient we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles, generally through a binding contract. Some overseas providers may be required by the law of their country to disclose information to authorities there. If that happens outside Australia, it isn't a breach of the Australian Privacy Principles. For real patient calls we use only providers with whom we have a negotiated contract. That contract covers health information, bans training on your information, keeps no call content, and requires deletion and breach notice. We remain accountable under the Privacy Act for how those overseas providers handle your information. Under the NSW Health Records and Information Privacy Act 2002 (Health Privacy Principle 14), we transfer health information to a recipient outside NSW only if a contract binds the recipient to principles substantially similar to the Health Privacy Principles, or another ground in HPP 14 applies.

7. How we keep it secure

• Access only for staff and contractors who need it, with individual logins. Every login that can reach real call data must use multi-factor authentication.
• Encryption in transit. Our database and email providers also encrypt data at rest.
• Each clinic's data kept separate.
• Logs of who accessed what (including every staff portal access and refused access), kept for the life of the clinic's contract and then deleted with the clinic's other data.
• Clinic staff read call summaries only in our staff portal, after logging in as a named user of that clinic. Multi-factor authentication (authenticator app) is required by default; otherwise a strong password, with lockout after 5 failed tries. Each link covers one summary and one clinic, expires after 24 hours and can be cancelled. We log every access and every refused access, review the log monthly, and keep it for the life of the clinic's contract. When a clinic tells us a staff member has left, we remove their account within 1 business day (Sydney). A wrong-person or suspicious access is handled under our data breach response plan.
• A data breach response plan. If a breach is likely to cause serious harm, the clinic and/or we will notify affected people and the OAIC as the Notifiable Data Breaches scheme requires.

8. How long we keep it

• Summaries only:
  • Call audio: not kept.
  • Full transcripts: not kept.
  • Call summaries: for as long as we provide services to the clinic, then deleted.
• Booking records live in the clinic's own systems; the clinic's team makes them. Booking requests we hold are deleted with the summaries.
• We hold no access credentials for the clinic's practice software.
• When a clinic stops using our service, we return and/or delete its data as agreed with the clinic.
• The clinic's own clinical records are kept by the clinic, not us.

9. Automated decisions

The Agent is a computer program that we run for the clinic you called. It uses some of your personal information to make, or help make, decisions that could affect your access to dental care. We tell you about this so you can ask questions or ask a person instead.

Personal information the Agent uses

• your name and phone number;
• whether you're a new or existing patient;
• the type of appointment you ask for and your preferred times;
• a short description of your reason for calling, and any words you use about an urgent problem. This can be health information.

Decisions the Agent makes by itself

• what to note in your booking request (for example the kind of appointment and times that suit you) before passing it to the clinic's team, who decide and confirm the booking. The Agent doesn't book, move or cancel appointments itself;
• whether to pass your request to the team or take a callback message, using fixed rules set by the clinic;
• if you use words on the clinic's dentist-approved emergency list, telling you to hang up and call triple zero (000), and sending an urgent alert to the clinic's front desk (opening hours) or on-call contact (after hours).

Decisions the Agent helps with, but a person at the clinic makes

• whether and when you're seen, and any clinical decision. The Agent passes your request to the clinic in a short note, and the clinic's staff and dentists decide.

What the Agent never does: it never assesses or scores your symptoms, never gives medical or dental advice, and never refuses you a booking without offering a staff callback.

Your options: at any time you can say "I'd like to speak to a person", and the team will call you back. To ask about or challenge a decision the Agent made, contact the clinic or our Privacy Officer (section 13).

We don't publish details that are commercially confidential, such as our prompts.

10. Accessing or correcting your information

You can ask for access to, or correction of, information we hold about you. Because we act for the clinic, we'll usually work with the clinic to respond, and you can also ask the clinic directly.

Contact: Privacy Officer, Billal Mohamad, admin@easehand.com.

We'll respond within 30 days. There's no charge to ask.

11. Complaints

If you think we've mishandled your information:

1. Tell us in writing (contact details above). We'll acknowledge within 5 business days and aim to respond within 30 days.
2. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au or 1300 363 992.
3. Because we handle health information in NSW, you may also complain to the NSW Privacy Commissioner (Information and Privacy Commission NSW) under the Health Records and Information Privacy Act 2002.

You can also contact the clinic you called.

12. Changes to this policy

We'll update this policy when our practices change and show the date at the top.

13. Contact

Privacy Officer, Billal Mohamad · admin@easehand.com

Easehand Automations is a business being set up by Billal Mohamad. Until the company is registered, services are offered by Billal Mohamad.