Privacy notice

LocumMeds AI Reception (“the agency”, “we”) is an AI phone receptionist service for UK GP practices, provided by Medical Locum Recruitment Limited (trading as Locum Meds; company number 10634499; ICO registration ZB279227), Iveco House, Suite 1.24, Station Road, Watford WD17 1ET, reachable at AI-Receptionist@locummeds.co.uk. It answers calls on a practice’s behalf, books appointments, takes messages and passes everything to the practice’s staff. This notice explains how personal data is handled — both when you ring a practice that uses the service, and when you use this website.

When you call a GP practice that uses LocumMeds AI Reception, that practice is the data controller for your call — it decides why and how your data is used, exactly as it does for calls its own reception team answers. We act as the practice’s data processor under a written data processing agreement (UK GDPR Article 28), handling your data only on the practice’s instructions and never for our own purposes.

Every call starts with two disclosures: that the call is answered by an AI, and that it is recorded. The service is non-clinical by design — it never assesses symptoms or gives medical advice, and callers describing an emergency are told to hang up and dial 999.

• Call audio — the recording of your call, and the live audio while the call is in progress.
• Transcripts and summaries — what was said, written down word for word, plus a short summary for the practice’s staff.
• Booking and message details — the information you give to book, change or cancel an appointment or leave a message: typically your name, date of birth, phone number and the reason for your call, sometimes a postcode or NHS number if the practice asks for it.
• Call records — the number dialled, the time and length of the call, and what happened (booked, message taken, transferred).

The practice’s lawful basis for this processing is its own — typically Article 6(1)(e) (a task in the public interest: providing NHS primary care reception) with Article 9(2)(h) for any health information you volunteer, but the practice’s own privacy notice is authoritative for its choices.

Call recordings and transcripts are kept for the retention period the practice chooses (between 1 and 24 months; 12 months unless the practice sets otherwise) and are then deleted automatically. Appointments, booking requests and messages are records of care coordination and are kept by the practice like any other reception record; a patient’s whole record can be erased on request to the practice (UK GDPR Article 17).

When you use the demo form on this site, we (the agency) are the controller for the details you send — your name, practice, work email and anything you write in the message box. We use them only to arrange and follow up your demo (our legitimate interest in responding to a business enquiry you initiated, Article 6(1)(f)) and we do not add you to mailing lists or share them. The website sets only the cookies needed for signing in to the dashboard — no advertising or analytics cookies.

The service is built on a small number of subprocessors, each processing the minimum it needs to run your receptionist:

• Soniox — Speech-to-text — writes down what the caller says during the live call. What it handles: Call audio while the call is in progress, and the live transcript. Where: European Union (Soniox EU region) — audio and transcripts processed and stored in the EU.
• Anthropic — Conversation model — decides what the receptionist says. What it handles: The live transcript and the practice's configuration; not used to train their models. Where: United States / Anthropic global processing, under the UK International Data Transfer Addendum.
• ElevenLabs — Text-to-speech — the receptionist's voice. What it handles: The receptionist's own words only — never the caller's audio. Where: United States, under the UK International Data Transfer Addendum / EU Standard Contractual Clauses.
• OpenAI — Writes the short call summary you see on each call. What it handles: Call transcripts (not audio); not used to train their models. Where: United States.
• Twilio — Telephony — carries the calls and sends/receives SMS. What it handles: Phone numbers, call audio in transit, text messages. Where: United Kingdom.
• Fly.io — Runs the software that answers the call and joins it to the receptionist. What it handles: Call audio in flight only — nothing is stored on it. Where: United Kingdom (London).
• Supabase — Database, file storage and sign-in for this dashboard. What it handles: Call records, transcripts, recordings, bookings, staff accounts. Where: United Kingdom (London).
• Netlify — Hosts this dashboard website. What it handles: No patient data at rest — pages are rendered per request. Where: Global edge network; no patient data stored.

Your call data is stored in the United Kingdom (London). Transcribing the caller happens in the European Union. The rest of the live conversation — deciding the reply, speaking it, and the call summary — is processed in the United States under the UK International Data Transfer Addendum and EU Standard Contractual Clauses. Telephony and the software that answers your calls stay in the UK. The full transfer and safeguards detail is in the DPA above.

The voice provider’s copy of each line the receptionist speaks is deleted as soon as it has been played. No subprocessor uses your data for its own purposes, and none of your data is used to train AI models.

Under UK GDPR you can ask for access to your data, correction, erasure, restriction, portability, and you can object to processing. For anything about a call to a practice, contact that practice — it is the controller, and it has the tools to find and erase your record. For anything about this website, contact us at AI-Receptionist@locummeds.co.uk. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

If how the service handles data changes materially, this page will be updated and the date at the top revised. Practices are told about subprocessor changes through their data processing agreement.