Privacy Policy

Recall, operated by Vernon Family (Pty) Ltd (“we”, “us”), provides software to healthcare practices. This policy explains how we handle personal information. By using Recall, you agree to it.

1. Our role

For your own practice account data, Recall is the responsible party. For the patient information a practice enters into Recall, the practice is the responsible party and Recall is the operator, processing that information only on the practice's instructions to provide the service (POPIA terms).

2. Information we collect

• Practice & account: practice name, your name, email, phone, and login credentials (passwords are hashed by our authentication provider).
• Patient information (entered by the practice): names, contact details including WhatsApp number, medical aid, clinical notes, appointments and billing.
• Messages: the WhatsApp conversations between the practice (AI or staff) and patients.
• Technical: log data, basic device/browser information, and cookies needed to keep you signed in.

3. How we use information

• To provide and run the service: manage patients, appointments and billing; power the AI assistant; send reminders and recovery messages.
• To send you the account and notification emails you opt into.
• To secure, maintain and improve the service.

We do not sell personal information.

4. AI processing

To generate replies and summaries, message content and relevant patient details are processed by our AI provider (Anthropic), only to provide the service. Your data is not used to train third-party models.

5. Service providers

We use trusted providers who process data on our behalf to run Recall:

• Supabase — database, authentication, storage.
• Vercel — application hosting.
• Anthropic — AI replies and summaries.
• Resend — transactional email.
• Meta (WhatsApp Business Platform) — message delivery.

Some providers may process data outside South Africa; we take steps to ensure appropriate safeguards.

6. Storage, security & retention

Data is encrypted in transit and at rest, access is restricted, and each practice's data is isolated from others. We keep information while the practice's account is active or as needed to provide the service and meet legal obligations. A practice can request an export or deletion of its data.

7. Deleting your data

You can ask us to delete your data at any time. If you have a Recall account, email support@recallai.health from your account email address and we will delete your account and the personal information associated with it within 30 days, except where we are required to keep certain records to meet legal obligations. This includes data we receive through Facebook Login and the WhatsApp Business Platform.

Patients: because your practice holds the relationship and is the responsible party for your information, please ask the practice to delete your data and Recall will help them do so. You may also email us at support@recallai.health and we will pass your request to the relevant practice.

8. Patient rights (POPIA)

Patients may ask to access, correct or delete their information. As the practice holds the relationship, please direct such requests to the practice, and Recall will help the practice fulfil them.

9. Cookies

We use essential cookies to keep you signed in and secure. We do not use advertising cookies.

10. Children

Recall is not directed at children. Where a practice records a minor's information, the practice is responsible for obtaining the necessary consent.

11. Changes

We may update this policy. We'll post the new version here with a new date.

12. Contact

Questions about privacy? Email support@recallai.health.