Security
Security and compliance
Patient trust is the product. Here's how Velaire handles the data that runs through it, every vendor that can reach it, and where each one processes it.
Every vendor, named
- 01Retell AI
- 02Twilio
- 03Supabase
7 vendors, each with what it can touch.
Patient data, handled seriously
Handled under the Australian Privacy Principles rather than a framework borrowed from another market. We publish every vendor that can touch a patient call and the region it processes in.
Read the security overview →Data is encrypted at rest and in transit across every system that touches a call.
Role-based access, with one practice's data unreachable from another's.
Access, changes and exports are logged so your practice manager can review activity.
Every subprocessor that can reach patient data is listed publicly, with the region it processes in.
Every vendor that can touch a patient call
This is the chain we would want to see from anyone else. Each row is what that vendor does, the patient data it can reach, and where it processes it.
Retell AI
Voice agent
Processed in: United States
Agreement: Direct agreement
Live call audio, the speech-to-text transcript, and any clinical detail the caller volunteers during the conversation.
The most sensitive vendor in the chain, because it holds the audio and the transcript rather than just metadata.
Twilio
Telephony and SMS
Processed in: United States
Agreement: Covered under Retell's agreement
The phone number on both ends of the call, call duration and routing metadata, and the contents of any SMS sent back to the patient.
On a Retell-managed number, Twilio operates as Retell's subprocessor and sits under Retell's agreement rather than a separate one. On a bring-your-own-carrier setup that is not true and a direct agreement is needed.
Supabase
Database
Processed in: United States
Agreement: Direct agreement
Stored patient records: name, callback number, the reason for the call, consent records and opt-out state.
Consent and opt-out are enforced here by database constraints and a trigger rather than by application code, so a stray script or a hand-run query cannot bypass them.
Vercel
Application hosting
Processed in: United States
Agreement: Direct agreement
Request data passing through the application layer, including anything submitted through a form on this site.
Google Workspace
Processed in: United States
Agreement: Direct agreement
Any patient detail that appears in an email notification sent to the practice, such as a message taken from a caller.
Cal.com
Demo scheduling
Processed in: United States
Agreement: No patient data — no agreement required
The name, email address and chosen time of whoever books a demo on this site. That is a practice's own staff arranging a sales call, never a patient. It is not present on a call, in the agent, or on any page where a patient enters their details.
Loads only on the demo page, and only because a visitor went there to pick a time. Unlike analytics it is available in every market, since a calendar someone deliberately opened is the service they asked for rather than observation they did not.
Google Tag Manager and Google Analytics
Website analytics
Processed in: United States
Agreement: No patient data — no agreement required
Pages viewed on this marketing site, plus the IP address and browser the request came from. It is not present on a call, in the agent, or on any page where a patient enters their details.
Listed last because it never sees a call. It loads only in the markets named in our analytics policy and is absent from the rest, because those markets require opt-in consent that this site does not yet ask for.
What we do not claim
The absence of these is worth more to you than another badge would be.
- We are not SOC 2 certified, and we do not display a SOC 2 badge.
- We are not ISO 27001 certified.
- We hold no HITRUST certification. No AI receptionist vendor we reviewed holds one either.
- We do not have a signed agreement with any electronic health record vendor, so Velaire does not write into your chart. It captures the request and hands it to your front desk.
- We do not claim that patient data stays inside any single country beyond the regions named above.
Security questions
How is our data protected?
Do you record calls?
Which data-protection framework applies to us?
Your next caller could be your next patient.
See how Velaire would handle the calls your practice misses. A personal walkthrough, built around your questions.
Let’s talk about your practice