Privacy Notice for the AI Phone Assistant

The controller within the meaning of the GDPR is the practice Pul’s Zahnmedizin named in this privacy policy.

For the automated handling of telephone enquiries we use AI phone-assistant software provided by Bodo Tech UG (haftungsbeschränkt), Kullrichstr. 10, 44141 Dortmund, Germany, HRB 38357, engaged directly by us as a processor.

Solely on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR, which is requested by an announcement at the very beginning of the call, the software processes the contents of the conversation on our behalf in order to record, forward or answer your request. The announcement points out the use of the AI phone assistant and refers to this privacy notice.

No audio or sound recording takes place. The audio stream is processed in real time and is not stored as a sound recording. Only a text transcript of the conversation is stored, for transcription and documentation.

Technically, a native real-time voice model for audio-to-audio processing is used. Functionally, this involves speech recognition, semantic analysis and speech output.

In addition, technical connection and call information is processed, in particular date, time, call duration, phone number (caller ID) and the result or status of the call.

The practice does not transmit conversation content directly to Google Cloud, easybell or Hetzner. These providers are engaged as sub-processors by Bodo Tech.

For the technical implementation of the AI voice processing and hosting, Bodo Tech uses the following sub-processor: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland.

Processing takes place in the europe-west1 region (Belgium, EU). Zero Data Retention (ZDR) is agreed between Bodo Tech and Google; accordingly, Google does not store the transmitted content beyond the real-time processing.

Insofar as there is a connection to Google LLC, based in the USA, due to the group structure, or a transfer of data to the USA takes place, this is carried out on the basis of the EU-US Data Privacy Framework and, additionally, on the basis of Standard Contractual Clauses (SCC) in the data processing agreement between Bodo Tech and Google.

For the telephony connection and the operation of the telephony bridge, Bodo Tech also uses the following sub-processors:

• easybell GmbH, Brückenstraße 5a, 10179 Berlin, Germany – SIP trunk and telephony connection; signalling encrypted via TLS and voice media via SRTP.
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – hosting of the telephony bridge / telephony edge.

No user or caller profiles are created for training purposes.

The conversation data is not used to train or improve AI models. For processing by Google, this is governed by the Zero Data Retention agreed between Bodo Tech and Google.

Audio or sound recordings are not stored.

The raw transcript of the conversation is stored for 72 hours (3 days) and then automatically deleted. Storage is encrypted at rest.

Call metadata, in particular date, time, call duration, phone number and the result or status of the call, is stored for 7 years insofar as statutory retention obligations require this.

At the AI sub-processor Google, due to the agreed Zero Data Retention, the transmitted conversation content is not stored beyond the real-time processing.

The practice has concluded a data processing agreement with Bodo Tech UG (haftungsbeschränkt) that governs the protection of callers’ data and prohibits disclosure to unauthorised third parties.

Bodo Tech, in turn, has concluded sub-processing agreements with Google Cloud EMEA Limited, easybell GmbH and Hetzner Online GmbH. The practice has no direct contract with Google Cloud, easybell or Hetzner.

Applicable data protection law grants you the following data subject rights vis-à-vis us with regard to the processing of your personal data, with reference to the cited legal basis for the respective conditions of exercise:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent given pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.