Front Desk Privacy Policy

Effective Date: October 28, 2026

GAIN AI LLC ("GAIN AI," "we") runs an AI phone receptionist for medical and dental practices, and GAIN AI Front Desk, the app practice staff use to see those calls. This policy explains what information the receptionist and the app handle, and why. It covers two groups of people: the staff who use Front Desk, and the callers (usually patients) who talk to a practice's AI receptionist.

1. Patients and other callers

When you call a practice that uses GAIN AI, we handle your call on behalf of that practice, as its HIPAA business associate under a Business Associate Agreement. The practice's own Notice of Privacy Practices explains how it uses your health information.

• What we handle: the call recording and transcript, a written summary, details you give on the call (such as your name, date of birth, callback number and reason for calling), and call details from the phone network (caller ID, time and length).
• Why: only to answer the call, pass your message to the practice, flag urgent calls, and run and fix the service.
• Your requests: to see, correct or get a record of disclosures of your information, contact your practice. If you contact us instead, we forward your request to the practice within 5 business days.

2. Practice staff who use Front Desk

• Account details: your name, work email, role and practice.
• Sign-in and security: sign-in times, IP address, device type, a record of which records you opened (the audit log), and your acceptance of our terms. Passwords are stored only as a one-way hash.
• Push alerts: if you turn on alerts, a device token that lets us send notifications to that phone or browser. Alerts never include patient details.
• Messages you send us: AI change requests and support emails.

3. What we don't do

• We don't sell personal or health information.
• We don't use it for advertising, and Front Desk has no ads, ad trackers or third-party analytics.
• We don't use patients' information to train general AI models.

4. Service providers

We use a small number of providers to run the service. Any provider that handles patient information must sign a business associate agreement with us before it does.

• Retell AI: the voice agent (call handling, speech recognition and voice), including its phone carrier. Under its agreement, Retell may process data outside the United States.
• Amazon Web Services: hosting, database, sign-in, email, and the AI that writes call summaries and draft callbacks (Amazon Bedrock).
• Apple and browser push services: to deliver alerts. Alert text contains no patient details.

We may also disclose information when the law requires it.

5. Security

We protect information with encryption in transit and at rest, two-factor sign-in for every staff account, automatic sign-out after 15 minutes without activity, and an audit log of who opened which records. No system is perfectly secure, and we can't promise that information will never be accessed without permission. If a breach affects patient information, we tell the practice as our Business Associate Agreement requires.

6. How long we keep information

• Call information is kept for as long as the practice's service needs it, and returned or deleted when the practice's agreement ends, as the Business Associate Agreement describes.
• Audit logs and terms acceptances are kept for 6 years, as HIPAA documentation rules require.

7. Deleting your Front Desk login

Staff can delete their own login in the app: Account → Delete my login. This signs you out everywhere and removes your name, email, password and devices. We keep the audit log and your terms acceptance as legal records, with your name removed. Patient records belong to your practice and stay with it.

8. Children

Front Desk is for practice staff and isn't directed to children. A practice's AI receptionist may take calls about children (for example from a parent), which the practice handles as described in section 1.

9. Changes

If we change this policy, we'll update the effective date above. Material changes to how we handle patient information are made through the practice's Business Associate Agreement.

10. Contact

GAIN AI LLC
Email: info@gainai.io