# AI receptionist data privacy: what happens to a call’s data, step by step

By Antony Boguslavskiy, Founder, Vocenya · Published 2026-11-05 · Updated 2026-11-05

**Short answer:** A call to an AI receptionist creates several kinds of data: audio, a transcript, a summary, the caller’s details and the alerts sent to you. Before choosing a vendor, ask what is recorded, who can access it, which companies process it, how long it is kept, how to delete it and whether it trains AI models. For patient calls, you also need a signed BAA.

When a dental office, a law firm or an insurance agency asks about [AI receptionist](/ai-receptionist) data privacy, the real question is simple: when a customer calls and the AI answers, where does what they said end up, and who can see it?

This post answers it by following one call from ring to summary. Then it lists the questions to ask any vendor, and answers each one for Vocenya from our [privacy policy](/privacy), our terms and our help articles. Where something is not covered there, we say so rather than guess.

*As of November 2026. Policies change; read the current privacy policy and terms of any vendor before you sign.*

## Following one call’s data from ring to summary

Say a patient calls a dental practice at 7:15 PM about a broken crown. Here is the data that one call creates, in order:

1. **Call details.** The caller’s number, caller ID, time, length and how the call was routed. Every phone service keeps these.
2. **Live audio.** What the caller says is processed in real time so the AI can understand and reply. The AI’s replies are generated as speech.
3. **A recording**, if the plan records calls.
4. **A transcript** of the conversation.
5. **A summary** of two to four sentences: who called, what they need, what happens next.
6. **Caller details**: name, callback number, reason, urgency, appointment preferences.
7. **Alerts** to the business: an email and a phone or browser notification.
8. **Integrations**, if connected: an appointment in the calendar, a lead in a CRM, a message in Slack.
9. **A handoff**, if the call goes to a person, who sees the summary first.

Each of these is a separate privacy question, because each can be stored in a different place and seen by different people.

## Recordings, transcripts and summaries

Recordings, transcripts and summaries are the core of what an AI receptionist keeps. Vendors differ on what they record and on which plans.

On Vocenya:

- **Only the AI receptionist’s part of a call is recorded.** Recordings play on plans that include them, which today are Growth and Pro.
- **Each call has a transcript and a summary** on the Calls page. Summaries are written in English, and say so when the call was in another language.
- **Vocenya does not play a recording announcement.** Whether you need to tell callers depends on your state and theirs; our guide to [call recording consent laws](/blog/call-recording-consent-laws) covers that.
- **Alerts carry call details by default**, by email and notification. In HIPAA mode they leave the caller’s details out, and you see them only when you sign in.

## Who can access it

Access is usually wider than owners assume, because call data is useful to several people and several companies. Think about it in three rings.

**Your business.** On Vocenya, the account owner sees everything. Team members you add can see calls and get the alerts they choose; owners get every alert by default. Decide who on your team really needs call details, and set alerts accordingly.

**People who take handoffs.** When the AI passes a call or chat to a person, that may be your own staff or a GH Live agent from GH Business Solutions. The privacy policy states that these agents “may be located outside the United States, including in the Philippines”, access only what they need for the conversation, and are bound by confidentiality. GH Live is an optional add-on; without it, handoffs go only to your own team.

**Companies that process the data.** Every AI receptionist relies on other companies (subprocessors) for phone service, AI models and hosting. Vocenya’s privacy policy names them, including Amazon Web Services (hosting, storage and the voice engine for HIPAA-mode calls), Anthropic (Claude AI models, through Anthropic's own API, that process transcripts and chats for features such as summaries), Telnyx (phone numbers and calling), ElevenLabs (voice generation for non-HIPAA accounts), Stripe (payments), and app notification and email providers. The full list, with what each one receives, is on the [sub-processors page](/subprocessors). Integrations you connect, such as Google Calendar, Microsoft 365, Acuity Scheduling, Jobber, Housecall Pro or ServiceTitan, receive what you send them.

Vocenya’s own team can also reach account data to operate the service, provide support and keep it secure, as the privacy policy describes. If you need to know exactly who can access what for your account, ask us.

## Retention and deletion

Retention is how long data is kept; deletion is how you get rid of it sooner. Ask both, because “we keep it as long as needed” can mean anything.

What Vocenya’s privacy policy and terms say:

- **While your account is active,** call data is kept to provide the service. After that it is deleted or de-identified “within a reasonable period”, unless the law requires keeping it longer (for example, consent and Do-Not-Call records).
- **After termination,** you can request an export of your data within 30 days, after which it may be deleted.
- **Deleting a call's recording or transcript, or a chat's messages:** account owners can do it on the call or chat in the portal or the app. The call record itself (time, length, numbers, minutes used) stays for billing.
- **Deleting your account** (Settings, then Profile, for the only owner) cancels the plan, releases your numbers and permanently deletes calls, recordings, leads and chats.
- **Callers can ask too.** A person who called a business using Vocenya can ask that business, or email us, to delete their messages, call records and lead details; the policy commits to doing it within 30 days, apart from records the law requires us to keep.

Owners can also have recordings and transcripts deleted automatically after 30, 90 or 365 days (Calls, then Recordings and transcripts), and delete those of every call older than a number of days at once. Automatic deletion is off until you turn it on.

## Is your data used to train AI?

This is often the first question owners have, and the answer depends on the exact words in the vendor’s terms, so read them.

Vocenya’s privacy policy says: “We do not sell personal information, and we do not use customers’ call recordings, transcripts or messages to train third-party AI models.” The terms say the same, and that you own the information you and your callers provide.

Your business information, such as the answers you write on the Receptionist page, is used to run your receptionist. That is how it knows your hours and prices. When you ask any vendor about training, ask two separate questions: is my data used to train the vendor’s own models, and is it used to train anyone else’s? If the answer is not in writing, ask for it in writing.

## Extra protections for healthcare: HIPAA mode

A practice covered by HIPAA can only let a vendor handle patient information if it has satisfactory assurances, documented in a written agreement. The HIPAA Privacy Rule at [45 CFR 164.502(e)](https://www.law.cornell.edu/cfr/text/45/164.502) says those assurances “must be documented through a written contract or other written agreement”, which is the business associate agreement (BAA).

Vocenya’s HIPAA mode, an add-on at $150 a month, includes a signed BAA. As the [HIPAA mode help article](/help/account-and-billing/hipaa-mode) explains, it changes how data flows:

- **Voices:** Standard voices covered by the BAA, answering in English and Spanish. Your own voice and the voice library are off.
- **Alerts:** emails and notifications leave out callers’ details; your team sees “Vocenya call” as the caller name, and transfer briefings leave out the reason for the call.
- **Integrations:** you confirm you have a BAA with the calendar or CRM provider before connecting it, and Vocenya sends only the caller’s name, phone number and appointment time, never the reason for the call.
- **Recordings** are stored in systems GH controls.
- **Messaging:** WhatsApp is not available, and website chat stays on BAA-covered systems.

A BAA covers how the vendor handles patient data. It does not make your whole practice compliant, and it does not replace your own policies. Our earlier [HIPAA AI receptionist guide](/blog/hipaa-ai-receptionist-guide) goes deeper, and the [HIPAA AI receptionist page](/hipaa-ai-receptionist) shows what the add-on includes.

### When Vocenya is not the right fit

If you need data stored only in a specific region outside the US, or no handoffs to agents outside the US, check those requirements with us first. Some of them we cannot meet today, and it is better to know before you forward your number.

## AI receptionist data privacy: six questions to ask any vendor

Copy this list into your email to any AI receptionist or answering service you are considering:

| Question | What a good answer includes |
| --- | --- |
| What exactly is recorded and transcribed? | Which part of the call, on which plans, and whether you can turn it off |
| Who can access call data? | Your team, any human agents (and where they are), the vendor’s staff |
| Which companies process it? | A named list of subprocessors |
| How long is it kept? | A specific period or a clear rule, plus what happens when you leave |
| How do I delete it? | Account deletion, record deletion, and how callers can ask |
| Is it used to train AI? | A written answer covering the vendor’s own models and third parties |

For healthcare, add a seventh: will you sign a BAA, and what changes when you do?

## Next step

Read the [privacy policy](/privacy) with this list beside you, and email us anything it does not answer. When you are ready, compare plans and the HIPAA add-on on the [pricing page](/pricing).

## Frequently asked questions

### Does an AI receptionist record my calls?

Most create at least a transcript and a summary; some also record audio. Vocenya records only the AI receptionist’s part of a call, and recordings play on the Growth and Pro plans. Every call has a transcript and summary. Vocenya does not play a recording notice, so check what your state requires.

### Is customer data used to train AI models?

It depends on the vendor, so read the terms. Vocenya’s privacy policy and terms say it does not sell personal information and does not use customers’ call recordings, transcripts or messages to train third-party AI models. Ask every vendor for a written answer covering both their own models and third parties.

### Can I delete call recordings?

With Vocenya, account owners can delete a call's recording and transcript on the call itself, or have recordings and transcripts deleted automatically after 30, 90 or 365 days. Deleting your account permanently deletes calls, recordings, leads and chats, and you can email us to ask for other records to be deleted. Callers can also ask the business or us to delete their records, which the privacy policy commits to within 30 days, except records the law requires keeping.

### Is an AI receptionist HIPAA compliant?

No software is compliant on its own; what matters is whether the vendor will sign a business associate agreement and how it handles patient data. Vocenya’s HIPAA mode includes a signed BAA, BAA-covered voices, alerts without patient details and limits on integrations. Your practice still needs its own HIPAA policies.

---

Source: https://vocenya.com/blog/ai-receptionist-data-privacy
Vocenya, powered by GH Business Solutions. Plans from $49/month with a 14-day free trial: https://vocenya.com/pricing