Privacy policy

Who we are

Omelia builds AI receptionists that answer dental clinics’ phone calls and WhatsApp messages, book appointments and follow up with patients. This policy explains what personal data we handle, why, who helps us, how long we keep it and the rights you have. It covers this website, the Omelia app clinics use, and the calls and messages our agents handle.

Omelia AI is based in London, United Kingdom. Write to us at hello@getomelia.com about anything in this policy.

Clinics, patients and who decides

When our agent answers a clinic’s phone or WhatsApp, the clinic decides what happens to your data. The clinic is the controller and Omelia is its processor: we only act on the clinic’s instructions, under the data processing terms in our Terms of service. If you are a patient, the clinic’s own privacy notice applies too, and the clinic is the first place to ask about your data.

When you visit this website, book a call with us, or a clinic signs up and pays us, Omelia is the controller.

What we collect on this website

• When you book a discovery call: your name, your clinic or company, its website, your email, your phone number if you give it, what you need, any notes, and the time and time zone you chose. We use them to hold the call, prepare for it and send you the confirmation and reminders. If you give a phone number, our assistant may send you a short WhatsApp message before the call.
• When you try our demo agents: what you say or type is sent to our AI providers to produce the reply. The demo books nothing. Your IP address is counted for up to 36 hours to limit how often the demo can be used.
• Your IP address when you send a form, to stop abuse.

This website sets no cookies and runs no advertising or analytics trackers. Fonts are served from our own server. Your browser keeps a few settings on your device, such as where you are in the booking form.

Cookies in the Omelia app

The app clinics sign in to uses only the cookies it needs to work: the sign-in session, the language you chose, the clinic you are working in, and, when our support team signs in to help you, a support session. The payment page loads Stripe, which sets its own cookies to process the card safely. We use no advertising or analytics cookies.

What our agents handle for clinics

On a clinic’s behalf, Omelia handles:

• calls: the caller’s number, the audio, a recording and a written transcript;
• WhatsApp and SMS: messages, voice notes and the photos patients send;
• patient details: name, phone, email, language, the treatment asked about, appointments, notes, and whether the patient agreed to be contacted;
• for treatment abroad, if the clinic uses it: travel details such as flights, hotel and dates.

Patients often share health-related information, such as the treatment they want or photos of their teeth. It is used only to answer them and book them in for the clinic. Our agents describe what they see and never diagnose, and they are not a substitute for a dentist.

Telling people they are speaking to an AI

• Our phone agents say they are an AI assistant at the start of the call. Where local law allows it and the clinic chooses so, they say it as soon as the caller asks. They never pretend to be a person.
• On WhatsApp, the first reply to a patient says they are writing to an AI assistant.
• Anyone can ask to speak to a person, and the agent passes them to the clinic’s team.
• Calls are recorded and transcribed so the clinic can see what was said and so we can keep the agents working well. Clinics choose whether the agent says so at the start of the call, and they must tell their patients in their own privacy notice.

How we use personal data

• To answer calls and messages, book, move and cancel appointments, send confirmations and reminders, and pass conversations to the clinic’s team.
• To write call summaries and notes for the clinic, and to fill in the clinic’s records.
• To check the quality of our agents. Before a transcript is reviewed, names, phone numbers, emails, dates of birth and addresses are removed.
• To run our relationship with clinics: setting up their agents, support and billing.
• To keep the service secure and stop abuse.

We do not sell personal data, we do not use it for advertising, and we do not use clinics’ patient data to train AI models.

Messages and how to stop them

Our agents contact someone only for a clinic that has a reason to: the person asked, booked, or agreed to be contacted. Reply STOP to any WhatsApp or SMS message and you will not be messaged again. Every email we send has a one-click unsubscribe link. Someone who asks not to be contacted on a call is marked so, and every automatic message checks it first.

Google data (Calendar, Gmail and Meet)

When a clinic, or our own team, connects a Google account to Omelia, we ask only for what the features below need. You choose the account on Google’s own screen, and you can disconnect at any time.

• Google Calendar (calendar.events, calendar.readonly): we read your calendars and their busy times to offer only free slots, and we create, move and cancel the bookings our agents make, with a Google Meet link when the booking is online. We also read events added outside Omelia, so your diary in Omelia matches your calendar.
• Gmail (gmail.send), only if you connect it: we send booking confirmations, and what a patient asks our agent for on a call (their booking, your address, their trip details or a short note), from your address. We cannot read, search or delete any email in your mailbox. Google also tells us the email address of the account you connect (openid, email), so we can show which address we send from.
• Google Meet (meetings.space.readonly): for an online consultation booked through Omelia, we check whether the patient joined, so the booking is marked attended or missed.

Your Google tokens are encrypted and stored in the EU. We use Google data only to provide these features to you. We do not sell it, use it for advertising or use it to train AI models, and nobody at Omelia reads it unless you ask us to for support or the law requires it.

To disconnect, open Connections in Omelia and press Disconnect: we delete the stored tokens and revoke Omelia’s access at Google. Google removes access for a whole Google account at once, so while another Omelia connection (Google Calendar or Gmail, in any workspace) still uses the same Google account, we delete this connection’s tokens and revoke when the last one is disconnected; Omelia tells you when this happens. Google can take a few minutes to show the change. You can also remove Omelia at any time at myaccount.google.com/permissions, which ends every Omelia connection on that account. Bookings already written into your calendar stay there, because they are yours.

Omelia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who processes data for us

We share personal data only with companies that run parts of the service, under contracts that oblige them to protect it:

• Netcup GmbH (Nuremberg, Germany): the servers our app, database and recordings run on.
• Backblaze (Amsterdam, Netherlands): backups of our database.
• OpenAI (USA): the voice of our phone agents, and the transcription of voice notes and recordings.
• xAI (USA): an alternative voice for phone agents, only for clinics that choose it.
• OpenRouter (USA): passes text to the AI models that write chat replies, summaries and checks. The models we use come from Anthropic, Google and OpenAI (USA), and open models (such as DeepSeek or GLM) that run only at hosting providers that keep nothing and train on nothing.
• Zernio, operated by Arbichat S.L. (Spain): phone lines and the WhatsApp connection.
• Meta (Ireland): delivers WhatsApp messages.
• Resend (EU region): sends and receives email.
• Stripe (Ireland): takes card payments from clinics. We never see or store full card numbers.
• Website readers we use while setting up a clinic, which read the clinic’s public website only.
• Only if a clinic connects them: Google, Kommo, GoHighLevel, HubSpot and Cal.com, under the clinic’s own agreement with them.

The AI providers we use may keep what they are sent for a limited time, usually up to 30 days, to check for abuse. They do not use it to train their models.

Data outside the UK and EU

Some of these companies are in the United States. Where data leaves the UK or the EU, the transfer is covered by the UK International Data Transfer Addendum, the EU Standard Contractual Clauses or an adequacy decision, such as the EU–US Data Privacy Framework for companies certified under it. For Türkiye, transfers follow Article 9 of the KVKK.

How long we keep data

• Calls, recordings, transcripts, messages, photos and patient records: for as long as the clinic uses Omelia, unless the clinic deletes them sooner. A clinic can delete a patient’s record from the app at any time.
• When a clinic stops using Omelia, it can ask us to hand its data back or delete it, and we do so within 90 days, apart from what the law makes us keep.
• Discovery-call bookings and our own sales notes: while we are in touch, and deleted on request.
• Invoices and payment records: six years, as UK law requires.
• Records of AI usage (models, amounts and costs, with no message content): 90 days.

Security

Data travels encrypted, and connection tokens such as Google’s are stored encrypted. Each clinic can see only its own data. Our staff reach a clinic’s data only to support it, sign in with two-factor authentication, and the changes they make are logged.

Your rights

Under the UK GDPR, the EU GDPR and Türkiye’s KVKK you can ask for a copy of your data, ask for it to be corrected or deleted, object to its use or ask for its use to be limited, take it elsewhere, and withdraw your consent at any time.

If you are a clinic’s patient, ask the clinic first; we help clinics answer within one month. For anything else, write to hello@getomelia.com and we answer within one month.

You can also complain to a data protection authority: the Information Commissioner’s Office in the UK, the Personal Data Protection Authority (KVKK) in Türkiye, or the authority in your EU country.

Children

Omelia is a service for clinics, not for children. A clinic that treats children is responsible for the consent of a parent or guardian.

Changes to this policy

When this policy changes we update the date at the top. If a change affects how clinics’ patients’ data is handled, we tell clinics before it takes effect.