Privacy Policy

Last updated: June 01, 2025

1. Data Controller

The Data Controller for personal data processing is:

2. Data Collected

Koecall.ai collects and processes the following personal data:

2.1 Registration Data

• First and last name
• Email address
• Phone number
• Date of birth (optional)
• Preferred language

2.2 Call Data

• Text transcripts of conversations with the AI assistant
• Date, time, and duration of calls
• Calling phone number (for identification)
• Language used during the call
• Call direction: Inbound (user-initiated) or outbound (proactive wellness check)
• Proactive call settings (if configured): frequency preferences, time slots, call purposes

2.3 WhatsApp Conversation Data

The AI assistant is also available on WhatsApp. When you write to our WhatsApp number we process:

• The text of the messages you send and of the assistant's replies
• Your WhatsApp phone number (used to recognise you)
• Date and time of each message
• Any attachment you decide to send (see section 3)

WhatsApp conversations are stored as a single message history per phone number, so the assistant can keep the context of the conversation. Messages exchanged on WhatsApp do not consume voice call minutes.

2.4 Assistant Personalisation Data

The caregiver or the user can optionally configure the assistant. If you fill in these fields, we process:

• Assistant name, conversation style and custom instructions
• Topics of interest and topics to avoid
• Daily routine (wake, meal and bed times)
• Medication names, dosages and schedules, if you choose to enter them
• Emergency contacts indicated by you

2.5 Knowledge Base Content

You can optionally upload documents or add website addresses so the assistant can answer using that material. In this case we process:

• The uploaded files and the text extracted from them
• The web pages you indicate and the internal pages linked from them (one level deep)
• A search index built from that content, used only to answer the questions of your assisted person

2.6 Scam Protection Data

If the scam protection feature is enabled, the assistant analyses the ongoing conversation to detect patterns typical of phone and online fraud. When such a pattern is detected, an alert is generated and sent to the caregiver. No additional category of data is collected for this purpose: the analysis is performed on the conversation content already described above.

2.7 Technical Data

• IP address
• Browser and device type
• Web platform access logs

3. Content You Choose to Send Us

Some features let you send us free content: WhatsApp messages, photos and attachments, and knowledge base documents. What you send is entirely your choice.

3.1 Attachments Sent via WhatsApp

If you send a photo or a file on WhatsApp, we store it in a private storage area that is not publicly accessible, and we process it only to understand your request and reply to you — for example to turn an appointment date into a reminder. Images may be analysed by an artificial intelligence model for this sole purpose. Attachments are never used for advertising and are never sold.

3.2 Knowledge Base Documents

Documents and websites you add to the knowledge base are used exclusively to let the assistant answer the questions of the person you are assisting. You are responsible for having the right to share the material you upload.

4. Purpose of Processing

Personal data is processed for the following purposes:

• Service delivery: Providing the personalized AI assistant over the phone and on WhatsApp
• Identification: Recognizing the user by phone number when making a call or writing on WhatsApp
• Personalization: Improving the experience based on previous conversations and on the assistant settings you configured
• Conversation history: Allowing the user and authorized caregivers to view transcripts and chat history
• Reminders: Managing appointments and reminders mentioned during conversations, and sending them via SMS or WhatsApp according to your preference
• Answering with your own material: Using the documents and websites you added to the knowledge base to answer questions
• Scam protection: Detecting fraud patterns during conversations and alerting the caregiver, when the feature is enabled
• Service communications: Sending service-related notifications
• Billing: Managing subscriptions, payments and invoices
• Service improvement: Analyzing aggregated data to improve the AI

5. Legal Basis for Processing

Data processing is based on:

• Consent (Art. 6.1.a GDPR): For registration and use of the service
• Contract performance (Art. 6.1.b GDPR): For providing the requested service
• Legal obligation (Art. 6.1.c GDPR): For accounting and tax obligations
• Legitimate interest (Art. 6.1.f GDPR): For security, fraud prevention and service improvement

5.1 Content Sent Voluntarily

As explained in section 3, you are free to decide what to send us. Where the content you choose to send happens to include particular categories of data (for example health information in a photo of a medical report), the processing is based on your explicit consent under Art. 9.2.a GDPR, which you give by deliberately sending that content in order to receive an answer. You are not required to send it, and you may withdraw your consent at any time by asking us to delete the content.

6. Processing Methods

Data is processed using electronic tools and automated procedures, with appropriate security measures.

6.1 How the Service Works

6.2 How the WhatsApp Channel Works

6.3 Third-Party Services

For service delivery we use:

• Microsoft Azure: Cloud infrastructure, database, file storage and communication services
• Azure Cognitive Services: Speech recognition and synthesis
• Azure AI Search: Indexing and searching your knowledge base content
• OpenAI / Azure OpenAI: Conversational AI models used for calls, chat and image understanding
• Meta Platforms (WhatsApp Business): Delivery of messages on the WhatsApp channel
• Twilio: Sending SMS reminders and verification codes
• Stripe: Payment and subscription processing
• Serper.dev: Web search queries, when the assistant needs up-to-date public information
• Google: Calendar synchronisation, only if you connect your Google account

All providers are bound by appropriate data processing agreements. Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Data Retention

Personal data is retained for the following periods:

• Account data: For the duration of the contractual relationship and for 5 years thereafter
• Conversation transcripts: 12 months from the date of the call
• WhatsApp message history: 12 months from the date of the message
• Attachments sent via WhatsApp: 12 months, or until you ask for their deletion
• Knowledge base documents and search index: Until you remove them or delete the account
• Assistant settings: Until you change them or delete the account
• Technical logs: 90 days
• Billing data: 10 years for tax obligations

The user can request early deletion of data at any time. When an account is deleted, the associated conversations, WhatsApp threads and attachments, appointments, assistant settings and knowledge base content are deleted as well, except where we are required by law to keep them.

8. Data Sharing

Personal data is not sold to third parties. It may be shared with:

• Authorized caregivers: If the user has authorized a family member or caregiver, they can access conversation history, chat history, reminders and wellbeing alerts
• Service providers: The processors listed in section 6.3
• Competent authorities: If required by law

9. Data Subject Rights

Under GDPR, the user has the following rights:

• Access (Art. 15): Obtain confirmation of processing and a copy of data
• Rectification (Art. 16): Correct inaccurate data
• Erasure (Art. 17): Request deletion of data ("right to be forgotten")
• Restriction (Art. 18): Restrict processing in certain cases
• Portability (Art. 20): Receive data in a structured format
• Objection (Art. 21): Object to processing
• Withdraw consent (Art. 7): Withdraw consent at any time

To exercise these rights, contact: sales@koecall.ai

The user also has the right to lodge a complaint with the Data Protection Authority.

10. Security

We adopt appropriate technical and organizational security measures:

• Data encryption in transit (TLS 1.3) and at rest (AES-256)
• Secure user authentication
• Attachments stored in private containers, never publicly accessible; temporary, expiring links are used when an authorised operator needs to view them
• Data access limited to authorized personnel
• Certified cloud infrastructure (Microsoft Azure)
• Regular backups and disaster recovery procedures
• Continuous security monitoring

11. Cookies

The website uses technical cookies necessary for operation:

• Session cookies: To maintain user session
• Preference cookies: To store selected language
• Consent cookies: To store cookie preferences

We do not use profiling or third-party advertising cookies.

For detailed information about cookies used, see our Cookie Policy.

12. Changes to Privacy Policy

We reserve the right to modify this Privacy Policy. Significant changes will be communicated via email or through a notice on the platform. Continued use of the service after changes constitutes acceptance of the same.

13. Contact Us

For privacy-related questions or to exercise your rights: