Privacy policy

Last updated: 10 November 2026

1. Who we are

callmate is a service that answers dental clinics' phone calls with an AI assistant and keeps their appointment schedule. It is operated by KRAIT STUDIO SRL (IDNO 1026023167264), Chișinău, Republic of Moldova. For any question about personal data, write to [email protected].

2. Our role

• For data about patients and callers of a clinic, the clinic is the controller and we process the data on its behalf and under its instructions (a data processing agreement is signed with each clinic).
• For data about clinic staff accounts and visitors of this website, KRAIT STUDIO SRL is the controller.

3. What data we process

• Calls: caller's phone number, call recording and transcript, name, requested service, preferred time, short notes the caller gives (for example, "pain on the lower left"), the language of the call.
• Appointments: patient name and phone, service, doctor, date and time, status, confirmations and reminders sent.
• Clinic staff accounts: name, email, password (stored only as a hash), role, sign-in records.
• Google Calendar, if a clinic connects it — see section 4.

At the start of each call the caller is told that they are talking to an AI assistant and that the call is recorded.

4. Google user data

A clinic owner may connect the clinic's Google account so that the schedule in callmate and the doctors' Google calendars stay in sync. We request only these permissions:

• See your calendars (calendar.readonly) — to show the list of calendars so the owner can choose which calendar belongs to which doctor, and to read events in the chosen calendars: start and end time, status, title and, if present in the title, a phone number. These events mark the time as busy so that the AI never books a patient over them, and clinic staff see them in the callmate schedule.
• View and edit events (calendar.events) — to create, update and delete events for appointments and blocked time made in callmate (patient name, service, doctor, phone), and to notice when the clinic moves or deletes such an event in Google, so the appointment is moved or cancelled in callmate too.

How we handle this data:

• Only the calendars the owner selects are synchronized. We do not access Gmail, contacts or any other Google data.
• Data from Google is used only to provide this synchronization to the clinic. It is not sold, not used for advertising, not used to train AI or machine-learning models, and not sent to the AI that talks to callers — the AI receives only free time slots.
• People at KRAIT STUDIO SRL do not read this data, except with the clinic's permission for support, when required for security, or when required by law.
• The Google access token is stored encrypted (AES-256-GCM). Copies of Google events are deleted 30 days after the event ends, and all Google data is deleted immediately when the clinic disconnects Google.
• The clinic can disconnect Google at any time in callmate settings or at myaccount.google.com/permissions.

callmate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Why we process data and on what basis

• To answer calls and manage appointments for the clinic — on the basis of our contract with the clinic and the clinic's legal basis towards its patients.
• To send appointment confirmations and reminders — on the clinic's instruction.
• To keep the service secure and to fix errors — our legitimate interest.
• To meet legal obligations.

The AI does not make decisions with legal or similarly significant effects; it only books, moves or cancels visits at the caller's explicit request.

6. Who receives the data

• Retell AI, Inc. (USA) — the voice platform that handles calls, speech recognition and speech synthesis.
• OpenAI (USA) — the language model that generates the assistant's replies during a call.
• ElevenLabs (USA) — voice synthesis.
• Meta Platforms (WhatsApp Business) — confirmation and reminder messages.
• Hetzner Online GmbH (Germany) — servers and database.
• The telephony provider of the clinic's callmate phone number.
• Google — only if the clinic connects Google Calendar; data goes to the clinic's own Google account.

Transfers to the USA are covered by standard contractual clauses approved by the National Center for Personal Data Protection (CNPDCP). We never sell personal data.

7. How long we keep data

• Call recordings and transcripts — up to 30 days.
• Copies of Google Calendar events — 30 days after the event ends; immediately deleted on disconnect.
• Appointments and patient contacts — while the clinic uses callmate; after the contract ends they are returned to the clinic or deleted, as the contract says.
• Staff accounts — until the account is deleted.

8. Security

All traffic is encrypted (HTTPS). Access to data is limited by role, each clinic sees only its own data, secrets are encrypted, and the database is backed up.

9. Your rights

Under Law No. 195/2024 on personal data protection you have the right to access, correct and delete your data, to restrict or object to processing, and to data portability. Patients may contact their clinic or write to [email protected] — we will pass the request to the clinic and help it respond. You can also complain to the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md).

10. Changes

We will publish any change to this policy on this page with a new date. We inform clinics of important changes in advance by email.