Privacy Policy

1. Who we are

BuildaBox provides an AI voice and chat agent that answers patient enquiries and books appointments for healthcare practices, integrating with Best Practice Software’s Bp platform.

BuildaBox Pty Ltd is an Australian company. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Because we handle health information, this applies regardless of our annual turnover. State health records legislation also applies (Vic, NSW, ACT).

2. Our role

The practice is the custodian of the patient record. We handle patient information only as its service provider, on its instructions, under a written agreement. We do not use patient data for our own purposes and we never sell it.

3. What we collect

• From patients: name, date of birth, phone, email; appointment details; the reason for the visit if volunteered (this is health information); call audio, transcripts and chat logs; call metadata.
• From the practice’s Bp system: appointment availability and the minimum demographic fields needed to match a caller and write a booking. We do not retrieve clinical notes, results, prescriptions or documents.
• From practice staff: name, work contact details, login and audit records.

4. Notice and consent

Every call opens with notice that the caller is speaking to an automated assistant, that the call is recorded, and how to reach a human instead. Chat shows equivalent notice. We rely on the patient’s consent and the practice’s authority as treating provider.

5. How we use and share it

To identify callers, manage appointments, send confirmations and reminders, pass messages to staff, report to the practice, and maintain service quality and safety.

We share with: the practice; Amazon Web Services (cloud hosting, AI language models and monitoring, Australia); Deepgram (speech-to-text, Australia); and Twilio and Telnyx (telephony and SMS). All are contractually bound to protect the data, use it only to deliver our service, and not train models on it. We disclose otherwise only where required by law or to prevent a serious threat to life or health.

6. Overseas disclosure

All patient data is stored in Australia. We do not disclose personal information overseas.

7. Security

Encryption in transit and at rest, role-based access with MFA, per-practice data separation, audit logging, staff training and independent penetration testing. Detail is in our Data Storage and Handling Policy, available on request.

8. Retention

By default, call audio is kept for 30 days and transcripts and chat logs for 90 days. A practice may instruct us to shorten either period, or to extend the transcript and chat log period to up to 12 months. Booking records and system logs are kept for 12 months. Backups are kept for up to 35 days, so deleted data remains in backups until they expire, after which it is no longer recoverable. On termination, data is exported to the practice on request and deleted within 30 days, and remaining backup copies expire within a further 35 days. We do not hold the clinical record.

9. Access, correction and complaints

Contact your practice first, as it holds the master record. Otherwise:

We acknowledge within 5 business days and respond within 30 days. Unresolved complaints can go to the OAIC (oaic.gov.au, 1300 363 992) or your State health complaints body.

10. Data breaches

We maintain an incident response plan. We notify the affected practice without undue delay, and within 24 hours of becoming aware of an actual or reasonably suspected incident affecting their data. We support the practice in assessing the incident and in notifying the OAIC and affected individuals where required under the Notifiable Data Breaches scheme, and we notify them ourselves where the obligation falls on us.

11. Automated decisions

BuildaBox uses speech recognition and large language models for operational decisions only: matching callers, selecting available slots, escalating to a human. It makes no clinical decisions and does not assess medical urgency. Practice staff can review and change any booking, and patients can request a human at any time.

12. Changes

Practices receive 30 days’ notice of material changes.