Privacy Policy

(a) Definitions. “Personal Information” means information about an identifiable individual. “Client” means a business that uses our Services. “Caller” means an individual who speaks or interacts with a Voice Agent or other Service deployed by a Client. “Client Data” has the meaning in our Terms of Service. Other capitalized terms have the meanings in our Terms of Service.

(b) Two roles. This Policy covers two different situations:

1. Where Augova is accountable (“our own data”). We determine why and how we handle Personal Information of Website visitors, representatives of prospective and current Clients (account administrators, billing contacts), and people who contact us. This Policy applies in full to that information.
2. Where we act for a Client (“Client Data”). When a Client uses the Services with its own customers, patients or contacts, the Client decides why the Personal Information is collected and is the organization primarily accountable for it. We process that information on the Client’s behalf, as its service provider (and, for health information, as its agent or electronic service provider, as applicable), under our Terms of Service, the Data Processing Terms and, where applicable, a Health Information Addendum. We use it only to provide the Services to that Client, and not for our own marketing or to build profiles of Callers. Callers should read the Client’s privacy notice and may direct requests to the Client (see Section 9).

(a) Information provided to us (our own data)

• Account and contact details: name, business name, role, business email, phone number, billing address, account preferences.
• Onboarding information: information about your business, workflows and systems you ask us to connect, and the people authorized to approve actions.
• Billing information: payment details are collected and processed by our third-party payment processor. We may receive limited information such as the card brand, last four digits and billing contact.
• Communications: messages, support requests, feedback, survey responses, and meeting notes or recordings made with consent. We may track whether marketing emails are opened.

(b) Client Data processed for Clients

Depending on how a Client configures the Services, this can include:

• Audio data: recordings of Callers’ voices.
• Transcripts and text: speech-to-text transcriptions and chat or message text.
• Call metadata: caller phone number, call duration, timestamps, language, call routing and outcome.
• Information Callers provide or the Services extract: names, contact details, addresses, appointment dates and times, the reason for and intent of the call, and other information the Caller chooses to give.
• Documents and records that a Client loads into Document Intelligence or Process Automation, which may contain Personal Information about the Client’s customers, employees or others.
• Sensitive information. Our Services are not designed to collect Social Insurance Numbers, government ID numbers or full payment card numbers by voice. Where a Client is a health care provider, Callers may share personal health information, which we process only under a Health Information Addendum (Section 14) and other applicable terms as outlined throughout this Privacy Police, Terms of Service, and other contractual documents between you and Augova.

(c) Information collected automatically (Website)

• Device and usage information: IP address, browser type, operating system, pages viewed, referring pages, dates and times, and interactions, collected through cookies and similar technologies (Section 8).
• Approximate location, inferred from IP address.

(d) Information from third parties

We may receive business contact information from Clients (about their staff), from referral and integration partners, from business directories and professional networks, and from service providers that help us verify business information or prevent fraud.

Providing some information is necessary for us to deliver the Services. If you choose not to provide it, we may not be able to provide the Services.

We identify purposes before or when we collect Personal Information, and we collect, use and disclose it only for purposes a reasonable person would consider appropriate in the circumstances. The table sets out our purposes and the basis on which we rely. Where we act for a Client, the Client is responsible for the consent or other lawful authority that applies to its Callers.

Consent. Depending on the circumstances and the sensitivity of the information, consent may be express or implied. You may request to withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice (Section 9). Withdrawing consent may mean we cannot provide some Services.

(a) We use AI to deliver the Services. Voice Agents and other Services use automated speech recognition, large language models and speech synthesis. Callers are told at the start of a call, through a greeting the Client configures, that they are speaking with an AI assistant and that the call may be recorded and transcribed.

(b) No training on identifiable Client Data. We do not use identifiable Client Data, including call audio and transcripts, to train or fine-tune AI models, whether ours or anyone else’s.

(c) Our AI providers. We use AI model and speech providers under enterprise or API terms that do not permit them to use the data we send them to train their models.

(d) Voiceprints and biometrics. We do not create voiceprints, identify or authenticate individuals from their voice, or clone or synthesize any Caller’s voice. We do not use Personal Information to profile or target individuals for advertising.

(e) De-identified and aggregated data. We may create aggregated or de-identified information (for example call volumes and error rates) that does not identify any individual or Client, and use it to operate, secure and improve the Services. We will not attempt to re-identify it.

(f) Human oversight. Our staff may review logs, transcripts or recordings on a limited need-to-know basis for support, quality assurance, safety and security, subject to confidentiality obligations. Clients are responsible for reviewing the AI’s actions as set out in our Terms of Service.

(g) Automated decisions. The Services are not intended to make decisions with legal or similarly significant effects on individuals without human review. If a Service is configured to make or materially support such decisions, we will work with the Client to provide the transparency and human review that applicable law requires.

• Clients. Client Data is shared with the Client on whose behalf it was collected.
• Service providers and sub-processors. We use third parties to help provide the Services, in these categories:

We require our service providers, by contract, to protect Personal Information consistently with this Policy, to use it only for the services they provide to us, and to keep it confidential. A current list of our specific sub-processors is available on request at support@augova.com.

• Systems you connect. If a Client connects its calendar, CRM, practice management or accounting tools, we exchange information with them as the Client instructs.
• Legal and regulatory. We may disclose Personal Information where required or permitted by law, such as in response to a court order, warrant or lawful request, to protect rights, property or safety, or to prevent fraud.
• Corporate transactions. We may disclose Personal Information to parties involved in a proposed or actual merger, acquisition or sale of all or part of our business, under confidentiality obligations and as permitted by law.
• With your consent or at your direction.

We do not sell Personal Information.

By default, Client Data is stored in data centres located in Canada. Some service providers, including certain AI model, telephony and support providers, may process or access Personal Information in other countries, including the United States. When we transfer Personal Information to a service provider for processing, we remain responsible for it and use contracts and other measures to provide a comparable level of protection.

Personal Information processed or stored outside Canada is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement and national security authorities. Clients that need Canada-only processing, such as health care providers, can ask us to configure the Services accordingly, as set out in their contract or Health Information Addendum. For questions about our service providers outside Canada, contact us at info@augova.com.

We keep Personal Information only as long as needed for the purposes described in this Policy, to meet legal requirements, or to resolve disputes. Upon request, we may be able to delete Personal Information, however, it may hinder us from providing our Services.

We retain user information as set out in our Terms of Service, Privacy Policy, and other contractual documents. We do not currently use cookies on our site.

Under PIPEDA and other applicable law you may have the right to:

• Access the Personal Information we hold about you and learn how it has been used and to whom it has been disclosed.
• Challenge accuracy and request correction of inaccurate or incomplete information.
• Withdraw consent at any time, subject to legal or contractual restrictions.
• Request deletion of your Personal Information where it is no longer needed, subject to law.
• Challenge our compliance with this Policy or the law.
• Unsubscribe from marketing at any time using the link in any email or by contacting us. You will still receive administrative messages.

Our own data. To exercise a right, email us at support@augova.com with enough detail for us to locate your information. We may ask you to verify your identity. We will respond within 30 days, or tell you why we need an extension (up to a further 30 days, as PIPEDA permits). There is generally no charge for access, and if a fee applies we will tell you in advance. We may refuse access in limited circumstances allowed by law (for example, where the information contains another individual’s information, is subject to legal privilege, or cannot be disclosed for legal reasons), and we will explain why.

Client Data (calls and records handled for a Client). If you spoke with a Client’s Voice Agent or your information is in a Client’s records, please contact that Client first, because the Client is accountable for the information. If you contact us, we will, where we can, identify the Client and forward your request, and we will help the Client respond. If you have the date and the number you called, you may also ask us which Client’s service you interacted with.

Quebec and other provinces. If you are in Quebec, Alberta or British Columbia, provincial private-sector privacy laws may give you additional or different rights (for example, Quebec’s rights relating to automated decisions and data portability). We will respect applicable rights and handle requests accordingly.

Complaints. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376) or, for personal health information in Ontario, the Information and Privacy Commissioner of Ontario (ipc.on.ca). We encourage you to contact our Privacy Officer first.

The Website and Services may link to third-party sites or integrate with third-party tools that we do not control. This Policy does not apply to them. Please read their privacy policies.

We use physical, organizational and technological safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, access controls and multi-factor authentication, logging of automated actions, role-based staff access, vendor due diligence, and approval gates before money or customer records are changed. No system is completely secure, and we cannot guarantee absolute security.

If a breach of security safeguards involving Personal Information under our control creates a real risk of significant harm to individuals, we will report it to the Office of the Privacy Commissioner of Canada, notify affected individuals (directly or through the Client, as applicable), and notify other organizations that may be able to reduce the harm, as PIPEDA requires. We keep records of all breaches of security safeguards for at least 24 months. If a breach affects Client Data, we will notify the Client without unreasonable delay so that the Client can meet its own obligations, including under PHIPA where relevant.

The Services are for businesses and are not directed to individuals under 18, and we do not knowingly collect Personal Information from minors for our own purposes. A Client’s Callers may include minors in the ordinary course of the Client’s business (for example, a parent booking for a child). In that case the Client is responsible for appropriate consent and notice. If you believe a child has provided Personal Information to us directly, contact our Privacy Officer and we will delete it.

Voice recordings can be sensitive. We process Callers’ voices only to transcribe and respond to them and as the Client instructs. We do not create voiceprints, use voice to identify or authenticate individuals, or derive biometric templates. If we ever offer a voice-identification feature, we will do so only with separate notice and express consent.

Where a Client is a “health information custodian” under PHIPA (for example a dental office, medical clinic or therapist) and uses our Services in a way that involves personal health information, we do so only under a signed Health Information Addendum. In that case we act as the custodian’s agent or electronic service provider, as applicable, and we will: use and disclose personal health information only as the custodian permits and PHIPA allows; use Canadian data residency where the custodian requires it; apply the safeguards, access logging and retention rules the custodian specifies; notify the custodian at the first reasonable opportunity if information is stolen, lost or accessed without authority; and return or securely destroy the information at the custodian’s direction. Individuals with questions about their personal health information should contact their health care provider (the custodian).

We may update this Policy to reflect changes in our practices or the law. We will post the updated version with a new “Last Updated” date and, for material changes, give notice by email or in the Services before they take effect, and obtain fresh consent where required. Upon updates to our Privacy Policy and formal notice thereof, the updated terms will come into effect and will dwarf the previously stated terms herein.

For general inquiries: info@augova.com. For support-related inquiries: support@augova.com.

When you send a request, please include your name and contact details, the right you want to exercise and, for calls, the date, time and number you called, so that we can locate the information.