Voral
Book a conversation

Privacy Policy

Last updated: 13 October 2026

1. Introduction

Voral Pty Ltd (ABN 81 696 276 669) ("Voral", "we", "us") provides AI-powered practice management assistants for Australian medical practices. This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

This policy applies to all users of our platform, including medical practice administrators, healthcare practitioners, and patients who interact with our voice assistant.

2. Definitions

  • "Voral", "we", "us" refers to Voral Pty Ltd (ABN 81 696 276 669).
  • "You", "your" refers to any individual whose personal information we collect, including practice staff, practitioners, and patients.
  • "Personal information" has the meaning given under the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable.
  • "Sensitive information" includes health information and other categories defined under the Privacy Act that receive enhanced protections.
  • "Practice" refers to the medical practice or healthcare organisation that uses our platform.
  • "PMS" refers to the Practice Management System used by the practice (e.g. Best Practice, Cliniko).

3. Australian Privacy Act & the 13 APPs

We comply with all 13 Australian Privacy Principles under the Privacy Act 1988. These principles govern how we manage personal information throughout its lifecycle, from collection and use through to storage, disclosure, and destruction.

As a service handling health-adjacent scheduling data, we apply the enhanced protections the Act affords to sensitive information, even where we do not directly handle clinical health records.

4. Information We Collect

We collect the following categories of personal information:

  • Practice data: Practice name, address, contact details, practitioner names, and PMS configuration.
  • Scheduling data: Patient names, phone numbers, dates of birth, appointment types, dates, times, and practitioner preferences.
  • Call recordings: Voral does not keep audio recordings of calls, and our voice platform provider does not record them.
  • Call data: Call transcripts, call summaries, call duration, and escalation records.
  • Contact data: Name, email, practice name, location, and practice size submitted through our website contact form.
  • Authentication data: Staff email addresses and names for admin dashboard and Chrome extension access.
  • Usage data: Booking success rates and platform interaction logs.

5. How We Collect Information

We collect personal information through the following methods:

  • Directly from you: When patients call the practice and interact with our AI assistant, when practice staff register for and use the admin dashboard, and when visitors submit our website contact form.
  • From your Practice Management System: When our platform queries the PMS to search for patients, check availability, or book appointments on behalf of callers. Data exchanged is limited to scheduling information.
  • Automatically: Call metadata (duration, timestamps) and usage analytics are collected during platform operation.

6. Voice Calls, Recordings & Transcription

Our AI practice assistant handles patient phone calls via real-time voice technology. Key details:

  • Callers are informed at the start of each call that they are speaking with an AI assistant.
  • Call recordings (audio): Voral stores no call audio, and our voice platform provider does not record calls.
  • Retention is set for each practice. Each practice's setting decides how long call transcripts and summaries are retained. The default retention period is 3 days. A practice can ask us to set a longer period to meet its own clinical governance or regulatory requirements (e.g. 7 years under state health records legislation).
  • Call transcripts (text) are generated from the audio and stored alongside the call record. They are accessible to authorised practice staff via the admin dashboard.
  • Call summaries including booking outcomes, patient details, and practitioner information are stored for practice record-keeping.
  • Where a call is escalated to a human receptionist, the escalation record (reason, patient name, phone number, transcript summary) is stored and accessible to authorised practice staff.

7. SMS Communications

Our AI assistant may send SMS messages to callers for appointment confirmations and follow-up communications. SMS messages are sent via a third-party SMS delivery provider in the United States. The caller's phone number and message text, which can include the patient's name and appointment details, are transmitted to the provider for delivery, so they leave Australia. When a call is escalated, we may also send text alerts to practice staff through the same provider. An alert contains the practice name and a link to the dashboard, not patient details. No clinical data is included in SMS messages.

8. Health Information

Voral is a scheduling and call management tool, not a clinical system. We do not store, process, or transmit clinical health records, diagnoses, treatment plans, or Medicare claim information.

Where scheduling data or call transcripts may incidentally contain health-related information (e.g. appointment type referencing a medical specialty, or a caller describing symptoms during a booking call), we treat this as sensitive information under the Privacy Act and apply the protections of the My Health Records Act 2012 (Cth) by analogy.

9. AHPRA Considerations

Our service assists with administrative scheduling only. We do not provide clinical advice, triage, or health assessments. Our AI assistant is designed to recognise medical emergencies and immediately direct callers to Triple Zero (000) or their nearest emergency department.

Practices using Voral remain solely responsible for clinical decisions and AHPRA compliance in their clinical operations.

10. How We Use Your Data

  • To facilitate appointment scheduling and management on behalf of practices.
  • To sync bookings with your Practice Management System (PMS).
  • To provide call transcripts, summaries, and escalation records to authorised practice staff.
  • To send appointment confirmation and follow-up SMS messages to callers.
  • To generate anonymised analytics and insights for practice administrators.
  • To send service communications and platform updates.

11. AI & De-Identification

We take the responsible use of AI seriously. Our commitments:

  • No patient data is used for AI model training without explicit opt-in consent from the practice. We do not train models on patient call recordings, transcripts, or personal information by default.
  • Where data is used for platform improvement (e.g. improving speech recognition accuracy), it is first de-identified by stripping names, phone numbers, dates of birth, and other personal identifiers.
  • De-identified and aggregated data may be used to improve the quality and reliability of our AI assistant across all practices. This data cannot be traced back to any individual patient or practice.
  • We do not sell, licence, or share personal information or call data with third parties for their own purposes.

12. Marketing Communications

We may send marketing communications to practice administrators who have opted in. You can opt out at any time by clicking the unsubscribe link in any marketing email or by contacting us at privacy@voral.ai.

Patient data, call recordings, and health-related information are never used for marketing purposes.

13. Information Sharing

We may share personal information with the following categories of recipients:

  • Practice staff: Authorised practice administrators and receptionists who access call records, transcripts, and escalations via the admin dashboard or Chrome extension.
  • PMS providers: Scheduling data exchanged with your PMS (Best Practice or Cliniko) via their official APIs or approved integration middleware.
  • Service providers: Third-party infrastructure providers who process data on our behalf under data processing agreements (see Section 14).
  • Law enforcement or regulators: Where required by law, court order, or regulatory obligation.

We do not sell personal information to third parties.

14. Third-Party Services

We use the following categories of third-party services to deliver our platform:

  • Voice infrastructure: Real-time voice communication services for AI-powered calls. The voice provider keeps call-session details, such as call times and calling numbers, outside Australia. Voral stores no call audio.
  • Speech and AI processing: Speech recognition, the agent's voice and the AI language model for practice calls, processed in Australia.
  • Cloud hosting: Application and database hosting in Sydney, Australia.
  • Authentication: Identity and access management services with Australian data residency for admin dashboard and extension authentication.
  • SMS delivery: Third-party SMS provider in the United States for sending appointment confirmations, follow-up messages and alerts to practice staff. Only the recipient's phone number and message text are shared. No clinical data is transmitted.
  • Email delivery: Transactional email service for our website forms, which handles these messages outside Australia. No patient data is transmitted.
  • Enquiry records: A workspace tool outside Australia where we keep a copy of enquiries from our website forms.
  • Error monitoring: Application error reports, stored in the European Union.
  • Website analytics: Website usage statistics, processed in the United States.
  • PMS integrations: We connect to Best Practice and Cliniko via their official APIs or approved integration middleware. Data exchanged is limited to scheduling information.

All third-party service providers are bound by data processing agreements that require them to protect personal information to a standard consistent with this policy and the Australian Privacy Principles.

15. Cookies & Analytics

Our website uses essential cookies required for authentication and platform functionality. We do not use third-party advertising or tracking cookies.

We may use analytics tools to understand how our website and platform are used. No patient data, call recordings, or health-related information is shared with analytics providers. You can manage cookie preferences through your browser settings.

16. Data Storage & Security

  • Our website, dashboard and APIs encrypt data in transit using TLS 1.2 or higher. Phone calls are not end-to-end encrypted: they travel over the public telephone network and our providers' networks.
  • Our database is encrypted at rest by our hosting provider.
  • Our databases and application servers are hosted in Sydney, Australia, and most information stays in Australia. Some information is handled outside Australia today: call-session details kept by our voice platform provider (and, until they expire, recordings of calls made before we switched call recording off), text messages sent through our messaging provider in the United States, application error reports stored in the European Union, details people send through our website forms, website usage statistics, and calls to our public demo and demo phone line. Section 6 of our Data Residency page has the full list.
  • Access controls follow the principle of least privilege. Each practice can only access their own data through organisation-scoped authentication.
  • PMS credentials are stored encrypted and are only decrypted at runtime for API calls.
  • We conduct regular security assessments.

17. Data Retention & Deletion

We believe practices should control how long their data is retained. Our approach:

  • Call transcripts and summaries are deleted after the period set for each practice. The default retention period is 3 days. At the same point, caller names and other patient details are removed from call records. A message for reception keeps its details until reception has answered it, then they are removed after the same period, and after 14 days at most. The date, time and length are kept for reporting. A practice can ask us to set any period that meets its clinical governance, regulatory, or quality assurance requirements.
  • Recordings and monitoring records of calls made before we switched call recording off in October 2026 stay with our voice platform provider outside Australia for up to about 30 days, and in its backups for up to about 30 days more. The practice's setting does not apply to them.
  • Demo and test calls are kept until deletion is requested.
  • For practices subject to state health records legislation (e.g. NSW Health Records and Information Privacy Act 2002, VIC Health Records Act 2001), we recommend configuring retention to at least 7 years for adult patients and until age 25 for minors, in line with those requirements.
  • Patient phone number mappings are deleted once they have not been updated for the practice's retention period (3 days by default).
  • Website contact form submissions are kept until you ask us to delete them.
  • When a practice stops using Voral, we delete its practice-specific data (including transcripts, summaries, escalations, and configuration) when the practice asks us to.
  • Individuals may request deletion of their personal data by contacting their practice, who will notify us. Deletion is completed within 30 days.

18. Secure Data Destruction

When data reaches the end of its retention period or is subject to a deletion request, it is deleted as follows:

  • Call transcripts, call summaries and patient phone number mappings are permanently deleted from our database. Patient details are cleared from call and escalation records, which are kept for reporting (see Section 17).
  • Database backups containing deleted records are rotated out within the backup retention window (about 10 days).
  • Some copies sit outside our database and are not removed by our retention settings: database backups until they rotate out, system logs, and what our voice platform, messaging and error monitoring providers keep for the periods they set. See our Data Residency page.

19. Data Breach Response

We maintain a Data Breach Response Plan in compliance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). In the event of an eligible data breach that is likely to result in serious harm:

  • We will take immediate action to contain the breach and preserve evidence.
  • We will assess the scope and severity of the breach within 24 hours.
  • We will notify the Office of the Australian Information Commissioner (OAIC) as required under the NDB scheme.
  • We will notify affected individuals and practices directly, including what information was involved and recommended steps they can take.
  • We will conduct a post-incident review and implement measures to prevent recurrence.

20. Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Where we make material changes, we will notify affected practices via email or through the admin dashboard. The "Last updated" date at the top of this page indicates when this policy was most recently revised.

21. Access, Correction & Complaints

Under the APPs, you have the right to access and correct personal information we hold about you. To make a request, contact us at privacy@voral.ai. We will respond within 30 days.

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us directly. If you are unsatisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

22. Contact

Voral Pty Ltd (ABN 81 696 276 669)
327 Springvale Rd, Springvale VIC 3171
Melbourne, Victoria, Australia
Email: privacy@voral.ai