Privacy and security
Where callers’ information goes, and who can see it
What we keep, where it’s kept, and who can see it.
Where it runs
- Our own servers, in Perth
- Speech recognition, the voice, the language model and call records run on servers Skycomm owns in Burswood, Perth. No cloud or overseas speech or AI service handles the call.
- The phone network
- Calls reach us through an Australian phone carrier, which keeps its own call logs.
- Text messages
- Counterbell doesn’t send text messages to patients yet. When it does, it will use an Australian provider.
What we keep, and for how long
| Information | How long |
|---|---|
| Call audio | Not kept. Speech is turned into text as the caller speaks. |
| Call record: name, calling number, request, outcome, and a short text of the caller’s side with dates of birth and phone numbers removed | 30 days by default, unless the practice chooses a longer period. Then deleted automatically, and from backups within about 30 days. |
| Access logs: who looked at what, and when | As long as the service runs, and as long as the law requires. |
Call information is never used to train AI models, never used for marketing and never sold. Counterbell never asks callers for Medicare, DVA or health fund numbers.
Connections to the staff page are encrypted, and our backups are encrypted.
Who can see a practice’s calls
- Your team. Everyone has their own sign-in with two-step verification, and sees only your practice’s calls.
- Numbers are masked in the list. Opening a call shows its number, and the opening is logged.
- Every view is logged. Your practice manager can read the access log.
- Skycomm support, only with a reason. Our staff can open a practice’s call records only for a stated reason tied to a support ticket, for up to an hour. Your practice can see when it happened.
What the AI is allowed to do
- Every line it speaks is a set script, a line your practice approved, or a read-back of what the caller said.
- It never gives medical advice, and never decides urgency, eligibility or treatment.
- Emergency words are checked first, at any point in the call.
Practice software
Today, Counterbell isn’t connected to any practice’s software. Booking requests come to your team.
Booking straight into your appointment book is planned. It needs your software vendor’s approval, and only starts at practices that switch it on.
Once connected, it reads only what a call needs: appointments, practitioners and appointment types, and a patient’s name, date of birth, postcode and phone numbers to check who is calling. It writes only new appointments and cancellations, and checks each one was saved. It never reads clinical notes, results, medications, correspondence or billing.
How we test and watch it
Every change to how Counterbell handles calls is checked against a set of test calls, including emergency phrases and attempts to trick it.
We place a test call every 15 minutes and test the transfer to reception every weekday. We’re alerted if anything fails.
Where we’re up to
- An independent security review is being arranged. Until then, the staff page for real practices opens only from networks we’ve approved.
- We’ve tested the staff page ourselves. We don’t hold a formal certification such as ISO 27001.
- A practising GP will sign off what Counterbell says on calls before our first practice goes live.
Questions? Get in touch. To report a security issue, email help@skycomm.com.au (see our security.txt). Read our privacy policy.