Plain English summary: We collect the minimum information needed to run our service. We don't sell your data. We don't share it with anyone except the providers listed in our sub-processors list. Your clinic's data and your patients' data are kept strictly separate from every other client.
FlowLeads Limited ("FlowLeads", "we", "our", "us") is a New Zealand registered company providing an AI-powered virtual receptionist service for allied health clinics. Our registered address is in New Zealand and we operate under New Zealand law.
Contact: [email protected]
This policy covers:
FlowLeads acts as a data processor in relation to patient data. Clinics (our clients) are the data controllers responsible for determining how that data is used. This distinction matters under the NZ Privacy Act 2020.
We do not collect, store, or process: medical records, diagnoses, treatment notes, health fund details, or any clinical health information beyond what a caller voluntarily states during a booking call.
| Purpose | Legal basis (Privacy Act 2020) |
|---|---|
| Providing and operating the FlowLeads service | Contract performance |
| Processing call data and generating call summaries for your clinic | Contract performance (on behalf of clinic) |
| Billing and invoicing | Contract performance |
| Customer support and service communications | Legitimate interest |
| Platform security and fraud prevention | Legitimate interest |
| Service improvement and product development | Legitimate interest (aggregated, non-identifiable) |
| Legal compliance | Legal obligation |
We share data only with the third-party providers necessary to deliver our service. A full list is maintained in our Sub-processors List. We do not sell data to any third party. We do not share data with advertisers.
We may disclose information if required to do so by law, court order, or regulatory authority in New Zealand or Australia.
Patient call data and clinic information is stored on servers located in AWS ap-southeast-2 (Sydney, Australia), keeping data within the New Zealand and Australian jurisdiction. Some sub-processors (such as voice AI providers) process data in the United States — refer to our Sub-processors List for details.
Where data is processed outside New Zealand, we take steps to ensure adequate safeguards are in place consistent with the NZ Privacy Act 2020 and the Office of the Privacy Commissioner's guidance on cross-border transfers.
| Data type | Retention period |
|---|---|
| Call transcripts and summaries | 12 months from call date, then deleted |
| Booking records | Duration of clinic subscription + 12 months |
| Clinic account and billing data | Duration of subscription + 7 years (tax obligations) |
| Website visitor logs | 90 days |
On termination of a clinic's subscription, all patient call data associated with that clinic is permanently deleted within 30 days unless earlier deletion is requested.
We take reasonable steps to protect information from loss, misuse, and unauthorised access, including:
No method of transmission over the internet is 100% secure. If you become aware of any security concern related to FlowLeads, contact us immediately at [email protected].
You have the right to:
For patient callers whose data is held by a clinic client: please contact the relevant clinic directly, as they are the data controller for that information.
To exercise your rights, email [email protected]. We will respond within 20 working days.
Where FlowLeads processes health information on behalf of allied health clinics, we do so in compliance with the Health Information Privacy Code 2020. Our clinic clients remain the health information agency responsible for that information. FlowLeads processes it solely on their instructions and for the purposes set out in our service agreement.
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be notified to clinic administrators by email. Continued use of the service after notification constitutes acceptance of the updated policy.
For any privacy-related questions or requests:
FlowLeads Limited
Email: [email protected]
Country: New Zealand