Last updated: 2026-05-11
This is the privacy policy of A1 Ergotech Limited ("we", "us", "our"), a company registered in England and Wales.
| Company number (Companies House) | 10369880 |
| VAT registration | GB 465689729 |
| ICO data-controller registration | ZC141264 |
| Registered office | On record with Companies House under company number 10369880. |
| Trading name for the product | A1 Voice |
| Privacy contact | privacy@a1ergo.tech |
| Data Protection Officer | The founder, contactable at privacy@a1ergo.tech |
A1 Voice is an AI receptionist platform for UK practices (dental, GP, and other professional services). We act as the data processor when handling calls on behalf of our customer practices and as the data controller when handling our own customer relationships, billing, and marketing.
We collect the following categories of personal data:
When a practice's patient calls into A1 Voice, we process — on the practice's behalf, as their processor:
The patient's relationship is with the practice; the practice is the data controller for patient data, and we process it under a Data Processing Agreement.
If you visit voice.a1ergo.tech, a1ergo.tech, or voice.a1ergo.tech/dental:
We do not use third-party tracking cookies, advertising pixels, or session-recording tools on our public pages.
| Purpose | Categories | UK GDPR Article 6 lawful basis | UK GDPR Article 9 (where applicable) |
|---|---|---|---|
| Operating A1 Voice for customer practices | Customer + patient data | 6(1)(b) — performance of the contract with the practice | 9(2)(h) — provision of health/social care, executed under Data Protection Act 2018 Schedule 1 Part 1 paragraph 2 |
| Customer billing and account administration | Customer financial + contact data | 6(1)(b) — performance of contract; 6(1)(c) — legal obligation (HMRC) | — |
| Customer support | Customer contact + service records | 6(1)(b) — performance of contract | — |
| Service security, fraud prevention, audit logging | Server logs, account data | 6(1)(f) — legitimate interests (operating a secure service) | — |
| Marketing to existing customers (transactional follow-ups, product updates) | Customer contact | 6(1)(f) — legitimate interests, with opt-out | — |
| Marketing to prospects who explicitly opt in (e.g. demo requests via Cal.com) | Prospect contact | 6(1)(a) — consent | — |
| Improving the AI — non-identifiable model evaluation | Anonymised / aggregated transcripts and metrics | 6(1)(f) — legitimate interests, with opt-out at the practice level | — |
We do not use customer or patient call audio/transcripts to train third-party LLMs without explicit written consent at the practice level.
We use sub-processors in the following categories. Each is bound by a written contract imposing data-protection obligations no less protective than those we owe to our customers, and they process Customer Personal Data only on our documented instructions.
| Category | Purpose | Region of processing |
|---|---|---|
| Cloud infrastructure provider | Hosting, compute, storage, networking — the call-handling pipeline (WebRTC, audio storage, transcripts, dashboard, database) | UK / EEA |
| LLM inference provider(s) | Large-language-model inference for call handling | UK / EEA where pinned; otherwise subject to the transfer safeguards in § 5 |
| Payment processor | Customer billing payments (controller billing data only; never patient data) | EU |
| TLS certificate provisioning | Certificates for the public service endpoints (no Customer Personal Data) | Distributed |
| Source-control + CI provider | Source code and build/test metadata (no customer or patient data) | US, with appropriate transfer safeguards |
The current named sub-processors in each category — including the specific vendor, role, and region of processing — are published at https://voice.a1ergo.tech/sub-processors and kept in sync with Schedule 3 of our standard Data Processing Agreement. We will update that page as sub-processors change. Practices are notified at least 30 days in advance of any new sub-processor that will process patient data, via that page and email to the technical contact on the Order Form.
Some services are linked from our public pages but are not sub-processors of A1 Voice — when you use them, you are interacting with that provider as their own customer, and they are an independent data controller of your data. We list them here for transparency:
| Service | What it does | Data they collect | Their role |
|---|---|---|---|
Cal.com (EU instance, cal.eu) |
Hosts our demo-booking widget on voice.a1ergo.tech/dental and similar marketing pages |
Your name, email, and any details you fill into the booking form | Independent data controller under their own Privacy Policy. Cal.com EU's privacy notice and terms apply to this booking data; A1 Voice receives only the resulting calendar event sent to our internal calendar. |
Cal.com is included in our companion Data Processing Agreement (Schedule 3) for transparency only — patient call data does not flow through Cal.com.
A1 Voice call-handling infrastructure (WebRTC, audio storage, transcripts, dashboard, database) is hosted in the UK (AWS eu-west-2, London region). Customer-account data and patient call recordings / transcripts are stored within the UK / EEA.
A1 Voice AI-inference layer (LLM calls supporting call handling) is region-pinned to the UK (London, europe-west2) via the Vertex AI EU regional endpoint of our LLM inference provider. (europe-west2 is the Google Cloud London region — a UK locality, included within our LLM provider's "Vertex AI EU" product offering.) Speech-to-text transcripts and any prompt context derived from them remain within the UK during inference; no audio is sent to LLM providers.
Where, exceptionally, a transfer of Customer Personal Data outside the UK / EEA is required (for example, if our region-pinned endpoint is unavailable and we fail over to a non-UK / non-EEA endpoint to maintain service), we rely on the UK Information Commissioner's International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs) plus the UK Addendum, as appropriate. Our internal Transfer Impact Assessment evidences the supplementary safeguards behind these mechanisms; it is shared with customer practices on request.
For practices that need a tighter posture (e.g. strict UK-only residency, no fail-over outside the UK), contact us at the email in § 1.
Our source-control and CI provider processes source-code and build/test metadata in the US under appropriate transfer safeguards; no customer or patient data flows through this category. The specific vendor and region are published at /sub-processors.
| Category | Retention period | Reason |
|---|---|---|
| Customer billing records | 7 years from end of tax year | HMRC statutory requirement |
| Signed customer contracts and core correspondence | 6 years from end of contract | Limitation Act 1980 (six-year limitation period for simple-contract claims) |
| Customer account / configuration records (operational) | Duration of contract + 12 months | Operational continuity and complaints window |
| Customer support records | 12 months from case closure | Operational and quality improvement |
| Patient call audio recordings | Per the practice's Data Processing Agreement (typically 30–90 days) | Set by practice; we are processor only |
| Patient call transcripts | Per the practice's Data Processing Agreement (typically 30–90 days) | Set by practice; we are processor only |
| Anonymised / aggregated quality metrics | Indefinitely (no personal data) | Service improvement |
| Marketing prospect data | Until opt-out, or 24 months of inactivity, whichever first | Direct Marketing Code |
| Server logs | 30 days | Security and operational |
These retention defaults are confirmed for now; per-customer Data Processing Agreements may set tighter periods at the practice's request.
If we hold your personal data, you have the following rights under UK GDPR:
For patient data: the patient should contact the practice directly (the practice is the data controller). We will work with the practice to fulfil the request.
For your own data (as a customer or visitor): contact us at the email in § 1.
We will respond within one month of receiving the request, in line with UK GDPR Article 12(3). For complex or numerous requests we may extend this by up to two further months, in which case we will tell you (and the reason for the extension) within the first month.
We use industry-standard security controls, including:
eu-west-2, London) — patient call audio and transcripts are stored in the UK. AI-inference (LLM) calls are region-pinned to the UK (europe-west2, London — Google Cloud's London region) via our LLM inference provider's regional endpoint; no audio is sent to LLM providers. Where, exceptionally, a transfer outside the UK / EEA is required, appropriate safeguards (UK IDTA / SCCs) apply (see § 5).A1 Voice does not store credit-card numbers — payments are handled by our payment-processor sub-processor under PCI DSS scope.
If you have a complaint about how we handle your personal data, please contact us first using the email in § 1. If you remain unsatisfied, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 0303 123 1113 https://ico.org.uk/
Our ICO data-controller registration number is ZC141264.
We may update this policy from time to time. Material changes will be communicated to active customer practices in advance; the version date at the top of this document will always reflect the latest update. Previous versions are retained in our git history.