FrontDesk Talk answers the phone for businesses. That means we handle information about three groups of people: the businesses that sign up (our customers) and their teams, the people who call or text those businesses (callers), and visitors to our website. Some callers share health information, so this policy also explains how we protect it, including as a business associate under HIPAA.
The short version:
- We use information to run the Service for the business you called, and for our own customers.
- We don’t sell personal information, and we don’t share it for targeted advertising.
- We don’t use health information or call content for marketing, and we don’t use it to train AI models.
- We sign a Business Associate Agreement (BAA) with customers who need one, and we protect health information with HIPAA safeguards.
- If you called a business that uses FrontDesk Talk, that business controls your information. Contact it first with privacy requests.
1. Who we are and what this policy covers
“FrontDesk Talk,” “we,” “us,” and “our” mean FrontDesk Talk, LLC, a Texas limited liability company. We operate the website at frontdesk.talk, the FrontDesk Talk web app, the FrontDesk Talk mobile app, and the FrontDesk Talk AI receptionist service (together, the “Service”).
FrontDesk Talk, LLC is a separate company from FrontDesk Care, LLC, which operates frontdesk.care. The two share the FrontDesk name. This policy covers FrontDesk Talk only.
This policy does not cover the privacy practices of the businesses that use FrontDesk Talk. Each business has its own privacy practices, and healthcare providers have their own Notice of Privacy Practices. It also does not cover third-party websites or services you reach through ours.
Our mailing address is 17350 State Hwy 249, Ste 220, Houston, TX 77064. You can reach us any time at help@frontdesk.talk or (775) 618-0007.
2. Key terms
- Customer means a business or organization that has a FrontDesk Talk account.
- Authorized user means a person the customer lets use its account, such as an owner, manager, or staff member.
- Caller means a person who calls, texts, books with, or sends documents to a customer through the Service, or whom a customer contacts through the Service.
- Visitor means a person who visits frontdesk.talk, requests a demo call, or contacts us.
- Customer Data means information the Service handles for a customer, including caller information, call audio, recordings, transcripts, Talk Notes, texts, contacts, appointments, and documents.
- Personal information means information that identifies, relates to, or could reasonably be linked to a person.
- Protected health information (PHI) has the meaning given in HIPAA. In short, it is individually identifiable health information that a HIPAA covered entity, or its business associate, creates, receives, keeps, or sends.
- Consumer health data has the meaning given in state laws such as the Washington My Health My Data Act. In short, it is personal information that is linked or reasonably linkable to a person and identifies their past, present, or future physical or mental health.
3. Our roles: when we act for a business, and when we decide
Privacy laws treat us differently depending on whose information it is and why we have it.
| Information | Our role | Who to contact first |
|---|---|---|
| Customer Data, including what callers say and send | Service provider, processor, or contractor for the customer. When the customer is a HIPAA covered entity (or a business associate of one) and the information is PHI, we are its business associate under our BAA. | The business you called or texted |
| Account, billing, and team information about our customers and their users | We decide how it is used (a “business” or “controller”) | FrontDesk Talk |
| Website visitors, demo calls, contact forms, and our referral program | We decide how it is used (a “business” or “controller”) | FrontDesk Talk |
When we act for a customer, we use Customer Data only to provide the Service to that customer, as our agreements with the customer and the law allow. We don’t use one customer’s Customer Data to serve another customer. The customer is responsible for its own privacy practices, including giving callers any notices the law requires, getting any consent the law requires, and answering callers’ privacy requests.
If you called or texted a business that uses FrontDesk Talk and want to access, correct, or delete your information, please contact that business directly. If you contact us, we will tell you which business to contact when we can, forward your request to the business, and help it respond. We may not be able to act on the request ourselves without the business’s direction.
4. Health information and HIPAA
Callers sometimes share health information with the receptionist, for example the reason for an appointment, symptoms, medications, insurance details, or the name of their doctor. Some of our customers are healthcare providers or other HIPAA covered entities, and some are not.
When HIPAA applies
When a customer is a HIPAA covered entity (or a business associate of one) and we create, receive, keep, or send PHI on its behalf, we act as its business associate. The customer accepts our Business Associate Agreement when its account is created, by checking the box agreeing to the BAA, the Terms of Service, and this Privacy Policy. We record the version, time, person, business, IP address, and device. If the BAA changes, an account owner accepts the new version in the app. The BAA controls how we may use and disclose that PHI. If this policy and the BAA differ about PHI, the BAA controls. Under the BAA we:
- Use and disclose PHI only to provide the Service to the customer, for our proper management and administration, and as HIPAA and the BAA allow or require
- Never sell PHI and never use it for marketing
- Never use PHI to train AI models
- Limit use, disclosure, and requests to the minimum necessary
- Use administrative, physical, and technical safeguards designed to protect electronic PHI, as described in our Security and HIPAA pages
- Require service providers that create, receive, keep, or send PHI for us to agree in writing to protect it (a business associate agreement with each of them)
- Report security incidents and breaches of unsecured PHI to the customer, as the BAA describes
- Help the customer respond to patients’ requests to access, amend, or get an accounting of their PHI
If you are a patient of a healthcare provider that uses FrontDesk Talk, your provider’s Notice of Privacy Practices describes your HIPAA rights. Please send HIPAA requests to your provider.
When HIPAA does not apply
Many of our customers are not covered by HIPAA, such as gyms, salons, and spas. Callers may still tell them about their health. We protect that information with the same safeguards we use for PHI, we don’t sell it, we don’t use it for advertising or marketing, and we don’t use it to train AI models. State consumer health data laws may apply to it, as described in Consumer health data.
What FrontDesk Talk is not
FrontDesk Talk is a phone answering and messaging service. It is not an electronic health record, it does not connect to electronic health records, and it is not a clinical tool. The receptionist does not diagnose, give medical advice, or decide whether something is an emergency. Practices that need connections to health records and clinical tools should look at FrontDesk Care.
5. Information we collect
Account and team information
When you sign up, we collect your name, business name, email address, mobile phone number, the business phone number you want answered, your industry, and your password (which we store only as a secure hash). If you sign in with Apple or Google, we receive the identifier and email address they share with us instead of a password. If you invite teammates, we collect their names, email addresses, phone numbers, and team roles.
Billing information
Payments are processed by Stripe. Your full card number goes directly to Stripe and never touches our servers. We receive and keep limited details such as the card brand, last four digits, expiration date, billing contact, plan, invoices, refunds, and payment history.
Business information you give the receptionist
To answer your calls well, the receptionist needs to know about your business. This includes your hours, services, prices, service area, FAQs, greeting, voice settings, urgent-call rules, transfer numbers, routing rules, staff names, and any other instructions you add. Please don’t put patient or customer health information into these settings. The receptionist doesn’t need it to answer general questions.
Caller and call information
When someone calls a business that uses FrontDesk Talk, the Service processes:
- The caller’s phone number, and caller ID name if available
- Call date, time, length, routing, and how the call ended
- Call audio, while the call is in progress, so the receptionist can listen and respond
- A transcript of the call, and an AI-written summary (a Talk Note)
- Details the receptionist picks out of the call, such as the caller’s name, the reason for the call, whether it is urgent, its category, and answers to the business’s intake questions
- Recordings of calls, only on plans that include them (Real Talk and Big Talk)
- Messages the caller leaves, and anything else they tell the receptionist
Health information on calls and texts
Callers may share health information, for example why they want an appointment, symptoms, injuries, medications, pregnancy, mental health, insurance, or a doctor’s name. That information becomes part of the transcript, Talk Note, recording, text thread, or appointment, and we handle it as described in Health information and HIPAA.
Text messages
On plans with texting, the Service sends and receives texts through the business’s number, including missed-call text backs (Talk Back), two-way conversations, appointment confirmations and reminders, and private document upload links. We keep the content of those texts, the phone numbers involved, timestamps, delivery status, and opt-out status (such as STOP and START).
Contacts, inbox, and notes
The Service builds a contact record for callers (name, phone number, email if given, and history with the business), and an inbox of calls, messages, tasks, and documents for the business’s team. Teams can add their own notes.
Appointments and connected calendars
If a business turns on booking, the receptionist books, moves, and cancels appointments. If the business connects Google Calendar or Microsoft Outlook, we read its availability and create, update, or delete the events the receptionist books. Those events can include the caller’s name, phone number, the service booked, and notes. We store the connection’s access tokens encrypted. We only request the calendar permissions needed for booking, and we don’t read unrelated email, contacts, or files.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We don’t use Google user data for advertising, we don’t sell it, we don’t use it to train AI models, and people at FrontDesk Talk don’t read it unless you ask us to for support, it is needed for security or to follow the law, or it has been aggregated and de-identified. You can disconnect a calendar at any time in the app or in your Google or Microsoft account settings.
Client documents
On Real Talk and Big Talk, a business can send a caller a private link to upload documents or photos (for example a lease, a tax form, an ID, or a photo of damage). We collect the files, their names and types, who requested them, and a record of every time a team member views, downloads, or deletes them. Files are checked for type and scanned for viruses before they are stored, and are kept in encrypted storage. Documents can contain sensitive information, including health, financial, or government ID details.
Outbound calls
Outbound call campaigns are coming soon to the Big Talk plan and are not available yet. Once a business uses them, we will process the contact lists, phone numbers, and call content for the calls it places, and any opt-out requests we hear.
Mobile app
If you use the FrontDesk Talk app for iPhone, we also collect your device type, operating system, and app version (so we can keep the app compatible and ask you to update when needed), and, if you allow notifications, a push notification token for your device. We use that token only to send you alerts about your account, such as new calls, new texts, and Talk Time usage. You can turn notifications off at any time in your phone’s settings. The app does not track you across other companies’ apps or websites, and it does not access your contacts, photos, camera, microphone, or location.
Website visitors and demo calls
When you visit frontdesk.talk, we collect standard technical information such as your IP address, browser type, device, pages viewed, and referring page. When you send us a form (demo call, contact, signup, or referral program), we save it with the page you sent it from, the first page of your visit, the site that referred you, and any campaign tags in the link you followed (UTM tags), so we know how you found us. If you request a demo call, we collect the phone number, name, business name, business type, and email you enter, your consent to receive that call, and your choices about our texts. Demo calls are handled by our voice AI provider, which creates a transcript and call logs. Please don’t share health information or other sensitive details on a demo call.
Product usage
When you use frontdesk.talk or the FrontDesk Talk web app, we record product usage events, such as which signup and setup steps you view or finish, with a random identifier stored in your browser. In the app, these events are linked to your account. They don’t include your name, email, phone number, or what is said on your calls, and we use them only to improve signup and setup, not for advertising. If your browser sends a Global Privacy Control or Do Not Track signal, we don’t record them on the website.
Cookies
We use a small number of cookies and similar technologies. See our Cookie Policy for details. We don’t use advertising pixels, and we don’t send health information or call content to analytics or advertising companies.
Support, security, and service logs
If you email, call, or text us, we keep a record of the conversation so we can help you. Our servers also keep technical logs (such as errors and requests) to keep the Service running and secure. We mask these logs: they don’t include request bodies, passwords, tokens, or cookies, and emails and phone numbers are masked.
6. Where information comes from
- From you, when you sign up, set up the receptionist, fill out a form, or contact us
- From callers, when they call, text, book, or upload documents to a business that uses the Service
- From our customers, when they add contacts, notes, appointments, or contact lists
- From services you connect, such as Google, Microsoft, or Apple
- From our service providers, such as Stripe (payment status), Twilio (call and text delivery details, caller ID), and Vapi (call transcripts, summaries, and recordings)
- Automatically, from your browser or device when you use the website or apps
- From partners in our referral program, when they refer a business to us
7. How we use information
Customer Data (on behalf of the business)
- Answer, transfer, and summarize calls, take messages, send texts, and book appointments for the customer
- Send Talk Notes and alerts to the people the customer chooses, by text, email, and push
- Request and store client documents the customer asks for
- Place outbound calls the customer sets up
- Show the customer its calls, transcripts, recordings, texts, contacts, and reports
- Provide support the customer asks for
- Keep the Service secure, detect fraud and abuse, and fix problems
- Meet our legal obligations, including under HIPAA and the BAA
Our own customers, users, and visitors
- Create and manage accounts, process payments, and track Talk Time
- Provide customer support and respond to requests
- Place the demo call you request, and follow up as you asked
- Send service announcements, security alerts, and account notices
- Send product news by email to customers and prospects who have not opted out, and texts only to people who opted in
- Run our referral program and pay partners
- Understand how people use our website and signup, and improve them
- Detect, prevent, and investigate fraud, abuse, spam, and security incidents
- Comply with law, carrier rules, and legal requests, and enforce our Terms of Service
We may create aggregated or de-identified information that does not identify any person or business, and use it to measure and improve the Service. We keep it in a de-identified form and don’t try to re-identify it. For PHI, we de-identify only as HIPAA allows.
We don’t use Customer Data, health information, or call content to advertise to anyone, to build profiles for marketing, or to make decisions that produce legal or similarly significant effects about a person.
8. How AI processes calls
The Service uses speech recognition, a large language model, and text-to-speech to hold natural conversations. During a call, the caller’s audio is turned into text, the language model decides what to say based on the business’s information and instructions, and the reply is spoken back. After the call, the language model writes a short summary and picks out details such as the caller’s name and whether the call is urgent.
These steps are run by our voice AI provider, Vapi, which uses a language model from OpenAI, speech-to-text from Deepgram, and voices from ElevenLabs and Vapi. Our providers may change over time. We will keep the list in Service providers current.
- We don’t sell data. Not customer data, not caller data, not demo numbers.
- No training on your calls. We don’t use call content, Customer Data, or PHI to train AI models, ours or anyone else’s. We do not permit our AI providers to use it to train their own models, and we choose provider settings and agreements that say so.
- Providers under contract. Our AI providers process call data only to provide their services to us, under confidentiality and security obligations, and under a business associate agreement where they handle PHI.
- The receptionist is an AI. It tells callers it is an AI assistant when asked.
- People review only when needed. Our staff don’t listen to calls or read transcripts except to provide support the customer asks for, to investigate a security issue or abuse, to fix a problem with the Service, or when the law requires it.
AI can make mistakes. Transcripts and Talk Notes are created automatically and may contain errors, including errors in names, numbers, and health details. Businesses should check important details with the caller. See the Terms of Service for more on AI limitations.
10. Service providers
These companies process personal information for us. Each may use it only to provide its service to us, and must protect it.
| Provider | What they do for us | What they may receive |
|---|---|---|
| Amazon Web Services | Cloud hosting for our servers, encrypted file storage for client documents, and secure email delivery (Amazon SES) | Everything our servers process, including Customer Data and uploaded documents, and Talk Note emails with health details for businesses that chose to email them by secure email |
| MongoDB Atlas | Our database | Account, business, and Customer Data, such as call records, transcripts, Talk Notes, texts, contacts, and appointments |
| Vapi | The voice AI platform that runs each call | Call audio, the caller’s number, transcripts, recordings (on plans that include them), call summaries, and the business information the receptionist uses |
| OpenAI (through Vapi) | The language model that decides what the receptionist says and writes call summaries | The text of the conversation and the receptionist’s instructions about your business |
| Deepgram (through Vapi) | Speech-to-text | Caller audio, to turn it into text |
| ElevenLabs and Vapi voices | Text-to-speech | The text of what the receptionist says, to turn it into a voice |
| Twilio | Phone numbers, calls, and texts. Each business gets its own Twilio subaccount | Phone numbers, call audio while a call is connected, call details, text message content, and carrier registration details |
| SendGrid (a Twilio company) | Email delivery | Email addresses and the content of emails we send. Talk Notes by email include caller details only for businesses that told us callers don’t share health information, or that chose to email the intake answers they haven’t marked as health details |
| Expo and Apple | Delivering push notifications to the mobile app | Device push tokens and notification content. Notifications include a caller’s name, number, or call summary only for businesses that told us callers don’t share health information |
| Stripe | Payments and billing | Billing contact details and subscription details. Card numbers go to Stripe directly |
| Google and Microsoft | Calendar connections you turn on, and Sign in with Google | Calendar availability, the events the receptionist books (which can include the caller’s name, phone number, and notes), and sign-in details |
| Apple | Sign in with Apple | The account identifier and email address Apple shares with us |
| PostHog | Product analytics about signup and setup | Random or account IDs and event names, such as “test call placed.” No names, emails, phone numbers, or call content |
Virus scanning of uploaded documents runs on our own servers. We may add or replace providers. Customers who have a BAA with us can ask for our current list of providers that handle PHI by emailing help@frontdesk.talk.
Some services a customer chooses are covered by the customer’s own agreements, not ours. For example, if a customer connects its own Google or Microsoft calendar, that calendar is the customer’s account, and the customer is responsible for having a BAA with that company where HIPAA requires it.
11. Talk Notes, alerts, and other messages that contain caller details
After each call, the Service lets the people the business chooses know about it: by text message, by email, and as a push notification in the mobile app. Text messages, regular email, and lock-screen notifications are not as private as the app: they can be read by anyone who has the phone or inbox, and they pass through phone carriers and email providers. So by default, they carry no caller details.
Protective notifications (the default). After setup, we ask each business whether callers may share health information with its receptionist. Until the business answers, and whenever it answers yes, texts, emails, and push notifications about calls and messages contain no caller name, phone number, call summary, intake answers, or text message words. A Talk Note only says that a new or urgent call came in and how long it was, with a link to the app, where the details are. A push about a new text says to open the app to read it, and a notice about uploaded documents says only that a client sent documents.
Detailed notifications. If a business tells us its callers don’t share health information, Talk Notes by text and email, and push notifications, include the caller’s name and number and a short summary of the call. A business must not answer “no” if its callers may share health information. Callers sometimes share health details even with businesses that don’t expect them, so if in doubt, a business should answer yes. The account owner also chooses who gets texts and emails, and each person controls their own push notifications.
Texts sent to callers (such as Talk Back, appointment reminders, and upload links) are written by or for the business. Callers should not text sensitive health details. To send documents, use the private upload link, not a text or email.
12. Call recording, transcripts, and consent
Every call the receptionist answers is processed by AI and transcribed. On Real Talk and Big Talk, calls are also recorded. Recordings and transcripts are available to the business in the app.
Some states, including California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington, require the consent of everyone on a call before it is recorded or, in some cases, before it is listened to by a machine. Each business that uses FrontDesk Talk is responsible for knowing the laws that apply to its calls and for giving callers any required notice (for example, in its greeting) and getting any required consent. We provide settings to help, such as a custom greeting, but the business decides how to use them.
If you call a business and don’t want to be recorded or to talk with an AI, you can hang up and contact the business another way, or ask to leave a message for a person.
13. Text messaging (SMS)
Businesses use FrontDesk Talk to text their callers, and we text our own customers and people who ask us to. Our SMS Terms explain the messages, how often they come, and how to stop them. Reply STOP to any message to opt out, or HELP for help. Message and data rates may apply.
Consent to receive texts is never a condition of buying anything. On our website, texts about your demo and account, and marketing texts, each have their own optional checkbox. Businesses that use FrontDesk Talk are responsible for getting any consent the Telephone Consumer Protection Act (TCPA) and state laws require before they send texts or place calls they start.
14. How long we keep information
We keep information only as long as we need it for the purposes in this policy, our agreements with customers, and the law. Here is what that means today:
| Information | How long we keep it |
|---|---|
| Calls, transcripts, Talk Notes, recordings, texts, contacts, inbox items, and appointments | While the customer’s account exists. When the account is deleted, we delete them from our database right away. If a customer cancels but does not delete the account, we keep them so the customer can come back, until the customer deletes the account or asks us to delete them. |
| Copies held by our voice AI provider | Our voice AI provider keeps call recordings, transcripts, and logs under its agreement with us, and deletes them on its own schedule or when we ask it to. |
| Contacts a team deletes in the app | Removed from the app right away, and fully erased when the account is deleted. |
| Client documents | Until the business deletes them. If the account stops being active (canceled or suspended), we email the owner after 60 days and delete every file after 90 days, unless the account is reactivated first. Upload links expire after 7 days by default (the owner can choose 1 to 30 days). |
| Account and team information | While the account exists. Deleted when the account is deleted. |
| Billing records (subscriptions, invoices, usage charges, refunds) and referral payout records | As long as tax, accounting, and other laws require. Stripe also keeps its own records. |
| Push notification tokens | Until you sign out, reset your password, or delete your account. |
| Demo call requests and sales inquiries | As long as needed to follow up and to honor your choices, and deleted on request. |
| Opt-out records (for example, a number that texted STOP) | As long as needed to keep honoring the opt-out, even after other data is deleted. |
| Error logs | Masked, and deleted automatically after 7 days. |
| Staff audit logs | Kept to protect the Service and show who did what. They do not contain call content. |
| Backups | Our database and storage providers keep encrypted backups that roll off on a fixed schedule, so deleted data can remain in backups for a limited time before it is overwritten. |
We may keep information longer when the law requires it, to resolve disputes, to enforce our agreements, or under a legal hold. For PHI, the BAA controls what happens when the customer’s agreement ends. Any information we keep stays protected by this policy and, for PHI, by the BAA.
15. How we protect information
We use administrative, technical, and physical safeguards designed to protect information, including:
- Encryption in transit (HTTPS and TLS) for every connection to our website, apps, and API
- Encryption at rest for our database and file storage, through our hosting providers
- Extra field-level encryption (AES-256-GCM) for calendar connection tokens and phone account credentials
- Passwords stored only as secure hashes
- A separate phone account (Twilio subaccount) for each business
- Role-based access for each business’s team (owner, manager, staff)
- Staff access limited to people who need it, with required two-factor authentication for our admin tools and an audit log of staff actions
- Private document links that expire, virus scanning, short-lived download links, and a log of every view and download
- Masked logs, rate limits, and signature checks on the messages our providers send us
- Protective notifications by default: texts, emails, and push notifications leave out caller details unless a business tells us its callers don’t share health information, or chooses to email the intake answers it hasn’t marked as health details
- Social Security numbers a business’s call intake asks for are stored encrypted, shown masked, revealed only to its owners and managers, and every reveal is logged
- Business associate agreements with service providers that handle PHI
See our Security page for more. No system is perfectly secure, and we can’t guarantee absolute security. Please use a strong, unique password, give team members only the access they need, and keep your devices locked.
16. Security incidents and breach notification
If we learn of a security incident that affects personal information, we will investigate it, take steps to contain it and reduce harm, and notify as the law and our agreements require:
- PHI: we notify the customer (the covered entity) as the BAA requires, so it can notify patients and regulators.
- Other Customer Data: we notify the customer without undue delay, and give it the information it reasonably needs to meet its own obligations.
- Our own customers, users, and visitors: we notify affected people, and regulators where required, under applicable state breach notification laws.
17. Your privacy rights and choices
Depending on where you live, you may have the right to:
- Know what personal information we collect, use, and disclose, and the categories of people we disclose it to
- Access a copy of your personal information, in a portable format where required
- Correct inaccurate information
- Delete your personal information
- Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we don’t do any of these)
- Limit the use of sensitive personal information, or withdraw consent to process it
- Get a list of the specific third parties we have disclosed your information to, where state law provides it
- Appeal our decision if we deny your request
- Not be discriminated against for exercising these rights
Callers: for information we hold for a business, please send requests to that business. We will help it respond. See Our roles.
How to make a request
Email help@frontdesk.talk or call (775) 618-0007. We will verify your identity before acting on a request, usually by confirming information we already have, such as by sending a code to your account email or phone. We may ask for more information if a request involves sensitive information. You can use an authorized agent, and we may ask for proof that the agent is allowed to act for you and confirm the request with you directly.
We respond within the time the law requires, generally within 45 days. If we need more time, we will tell you why and how much longer, as the law allows. We don’t charge for requests unless they are excessive or repeated, as the law allows.
If we deny your request, you can appeal by replying to our decision or emailing help@frontdesk.talk with the subject “Privacy appeal.” We will respond to your appeal within the time the law requires and explain our decision. If you are not satisfied, you can contact your state attorney general.
We honor Global Privacy Control (GPC) signals as a request to opt out of sale and sharing for the browser that sends them, even though we don’t sell or share.
18. California privacy rights (CCPA/CPRA)
This section supplements this policy for California residents, and is our notice at collection. In the past 12 months we collected the categories of personal information below, from the sources in Where information comes from, for the purposes in How we use information. We disclosed each category for a business purpose to the service providers in Service providers, and Customer Data to the business it belongs to.
| Category | Examples | Why we use it |
|---|---|---|
| Identifiers | Name, email, phone number, business name, account ID, IP address, device push token | Running the Service, accounts, support, security |
| Customer records (Cal. Civ. Code 1798.80(e)) | Name, phone, email, address, billing details | Accounts, billing, support |
| Commercial information | Plan, subscription and payment history, Talk Time usage | Billing, account management, guarantee and refunds |
| Internet or network activity | Pages viewed, referring site, campaign tags, product usage events, app version | Running and improving the website and app, security |
| Audio and electronic information | Call audio, recordings, transcripts, text messages, voicemail-style messages | Providing the AI receptionist for the business that was called |
| Professional or employment information | Job role on a customer’s team, business type | Accounts and team access |
| Sensitive personal information | Account login and password (hashed), health information callers share, contents of texts and calls, documents callers upload (which can include government ID or financial details) | Only to provide the Service, keep it secure, and as the law permits |
We do not collect precise geolocation, and we do not create inferences or profiles about people. We keep each category for the periods in How long we keep information.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months, and we do not knowingly sell or share the personal information of anyone under 16.
Sensitive personal information. We use and disclose sensitive personal information only to provide the Service, keep it secure, and for other purposes the CCPA regulations allow without a right to limit. We don’t use it to infer characteristics about anyone.
Medical information and PHI. PHI that we handle as a business associate under HIPAA, and medical information governed by California’s Confidentiality of Medical Information Act, are generally exempt from the CCPA and are protected under those laws and our BAA instead.
Customer Data. When we handle Customer Data as a service provider or contractor, California residents should send requests to the business. We do not retain, use, or disclose that data outside our direct business relationship with the customer, and we do not combine it with data from other sources except as the CCPA allows.
Financial incentives. We don’t offer financial incentives in exchange for personal information. Our referral program pays partners for referring businesses that become customers, as described in our Referral Terms.
Shine the Light. We don’t disclose personal information to third parties for their own direct marketing purposes.
19. Other US state privacy rights
Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, have rights similar to those listed above. We honor them in the same way, through the process in Your privacy rights and choices, including appeals.
Many of these laws treat health information as sensitive data that needs consent. When we handle health information for a business as its processor, the business is responsible for getting any consent its state law requires, and we process it only on the business’s instructions. We don’t collect sensitive data about our own customers or visitors for our own purposes.
Nevada. We do not sell covered information as defined in Nevada law. Nevada residents can still send us a request to opt out of sales at help@frontdesk.talk.
20. Consumer health data (Washington, Nevada, Connecticut, and other states)
This section is our consumer health data privacy policy under the Washington My Health My Data Act, Nevada Senate Bill 370, the Connecticut Data Privacy Act, and similar laws.
When we act for a business
Most consumer health data we handle comes from callers who share it with a business that uses FrontDesk Talk. For that data we are a processor: we process it only to provide the Service to that business, under a binding contract and the business’s instructions. The business decides how it is used. To exercise your rights, contact the business. We will help it respond.
Categories we may process
Information a caller chooses to share about their health, such as the reason for a visit, symptoms, conditions, injuries, treatments, medications, pregnancy or reproductive health, mental health, substance use, disability, health insurance, or the name of a provider; appointment details for health-related services; and the fact that a person contacted a health-related business.
Sources and purposes
We collect it from callers and from the business, to answer calls, take messages, book appointments, send Talk Notes and texts, receive documents, keep the Service secure, and meet our legal obligations. We do not use it for advertising, marketing, or AI model training.
Who we share it with
The business the caller contacted, and the service providers listed in Service providers that process it for us. We do not sell consumer health data, and we do not share it with third parties or affiliates for their own purposes.
Our own visitors and customers
We don’t seek consumer health data from visitors to our website or from our own customers. If you volunteer it (for example, on a demo call or in a support message), we use it only to provide what you asked for. We do not use geofencing around any healthcare facility, and we do not collect precise location.
Your rights
Depending on your state, you may have the right to confirm whether we collect, share, or sell your consumer health data, to access it, to get a list of the third parties and affiliates it was shared with and their contact information, to withdraw consent, and to have it deleted, including from our service providers. To make a request about data we hold for ourselves, or if you don’t know which business to contact, email help@frontdesk.talk with the subject “Health data request,” or call (775) 618-0007. We respond within 45 days, which the law lets us extend once by another 45 days when needed. You can appeal a denial as described in Your privacy rights and choices, and if we deny your appeal, you can contact your state attorney general.
21. Deleting your account
You can delete your account yourself in the FrontDesk Talk app (More, then Delete account, or from the menu during setup), or by emailing us. If you are the account owner and no other owner is on your team, deleting your account cancels your subscription, releases your Talk number, disconnects your calendars, deletes your stored documents, and deletes your business’s calls, transcripts, Talk Notes, contacts, texts, and settings from our database. Copies of recordings and call logs held by our voice AI provider are deleted as described in How long we keep information. If another owner is on your team, the business passes to them and only your login is deleted. We keep limited billing records (such as invoices and payment history) as the law requires, as described in How long we keep information. Before you delete, download anything you want to keep, because deleted data can’t be recovered.
22. Marketing choices
You can unsubscribe from our marketing emails using the link in any of them. You can stop our texts by replying STOP. We will still send service messages such as receipts, security alerts, and account notices.
The demo call you request from our website is one call. Asking for a demo does not sign you up for marketing texts unless you also check the separate box for offers and news.
23. Children
The Service is for businesses and is not directed to children. We don’t knowingly collect personal information from children under 13 through our website or accounts, and you must be 18 to have an account. If you believe a child gave us information, contact us and we will delete it. Callers of any age may reach a business that uses FrontDesk Talk, and their information is handled on the business’s behalf as described above. Businesses that serve children are responsible for meeting the laws that apply to them.
24. International visitors
FrontDesk Talk is offered to businesses in the United States, and we host the Service in the United States. Some of our service providers may process information in other countries under their agreements with us. If you visit our website from outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from those in your country.
25. Third-party links and services
Our website and apps may link to other websites and services, such as Stripe checkout, Google, Apple, or FrontDesk Care. Their own privacy policies apply, and we are not responsible for their practices.
26. Changes to this policy
We may update this policy from time to time. We will change the “last updated” date above, and if the changes are significant we will notify customers by email or in the app before they take effect. We will not use personal information in a materially different way than this policy described when we collected it without the notice or consent the law requires.
27. Contact us
Questions about this policy, your information, or our HIPAA program? Reach us at:
FrontDesk Talk, LLC
Attn: Privacy
17350 State Hwy 249, Ste 220, Houston, TX 77064
Email: help@frontdesk.talk
Phone: (775) 618-0007
Or use our contact page.