Privacy notice

LocumMeds AI Reception (“the agency”, “we”) is an AI phone receptionist service for UK GP practices, reachable at shabaz@locummeds.co.uk. It answers calls on a practice’s behalf, books appointments, takes messages and passes everything to the practice’s staff. This notice explains how personal data is handled — both when you ring a practice that uses the service, and when you use this website.

When you call a GP practice that uses LocumMeds AI Reception, that practice is the data controller for your call — it decides why and how your data is used, exactly as it does for calls its own reception team answers. We act as the practice’s data processor under a written data processing agreement (UK GDPR Article 28), handling your data only on the practice’s instructions and never for our own purposes.

Every call starts with two disclosures: that the call is answered by an AI, and that it is recorded. The service is non-clinical by design — it never assesses symptoms or gives medical advice, and callers describing an emergency are told to hang up and dial 999.

• Call audio — the recording of your call, and the live audio while the call is in progress.
• Transcripts and summaries — what was said, written down word for word, plus a short summary for the practice’s staff.
• Booking and message details — the information you give to book, change or cancel an appointment or leave a message: typically your name, date of birth, phone number and the reason for your call, sometimes a postcode or NHS number if the practice asks for it.
• Call records — the number dialled, the time and length of the call, and what happened (booked, message taken, transferred).

The practice’s lawful basis for this processing is its own — typically Article 6(1)(e) (a task in the public interest: providing NHS primary care reception) with Article 9(2)(h) for any health information you volunteer, but the practice’s own privacy notice is authoritative for its choices.

Call recordings and transcripts are kept for the retention period the practice chooses (between 1 and 24 months; 12 months unless the practice sets otherwise) and are then deleted automatically. Appointments, booking requests and messages are records of care coordination and are kept by the practice like any other reception record; a patient’s whole record can be erased on request to the practice (UK GDPR Article 17).

When you use the demo form on this site, we (the agency) are the controller for the details you send — your name, practice, work email and anything you write in the message box. We use them only to arrange and follow up your demo (our legitimate interest in responding to a business enquiry you initiated, Article 6(1)(f)) and we do not add you to mailing lists or share them. The website sets only the cookies needed for signing in to the dashboard — no advertising or analytics cookies.

The service is built on a small number of subprocessors, each processing the minimum it needs to run your receptionist:

• Supabase — database, file storage and dashboard sign-in.
• Twilio — telephony — carries the calls and text messages.
• Hume AI — voice understanding during the live call.
• OpenAI — language model — call handling and summaries (transcripts, not audio; not used for model training).
• Deepgram — speech-to-text transcription.
• Netlify — hosts the website and dashboard (no patient data at rest).

Calls are answered and processed in the UK/EU where the provider offers it; where a transfer outside the UK occurs, it is covered by UK-approved safeguards (the full detail is in each practice’s data processing agreement). No subprocessor uses your data for its own purposes, and none of your data is used to train AI models.

Under UK GDPR you can ask for access to your data, correction, erasure, restriction, portability, and you can object to processing. For anything about a call to a practice, contact that practice — it is the controller, and it has the tools to find and erase your record. For anything about this website, contact us at shabaz@locummeds.co.uk. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

If how the service handles data changes materially, this page will be updated and the date at the top revised. Practices are told about subprocessor changes through their data processing agreement.