Privacy Policy

Each business that uses AE One decides what information it collects about its own customers, patients and callers, and what it uses it for. For that information we act on the business's behalf, as its service provider: we hold and process it only to provide AE One to that business. The business is responsible for telling its customers how it handles their information. If you are a customer of a business that uses AE One, please contact that business first; we will help it respond.

For information about the businesses that use AE One and their team members (account, sign-in and billing details), we are responsible for it directly.

• Accounts and team members: name, email, phone, role and permissions, sign-in details (including Sign in with Google), two-step sign-in settings, and a record of actions taken in the workspace.
• Billing: the billing contact's name and email and the subscription. Card details are entered with Stripe; we don't store card numbers.
• A business's customer records: contacts and notes, bookings, quotes, invoices and payments, form and intake answers, signed documents, uploaded files and photos, and messages sent and received by email, SMS and connected social channels.
• Health information: clinics and other health businesses can record medical history, treatment notes, intake forms and patient files (see “Health information” below).
• Phone calls answered by the Voice Agent: the caller's number, a transcript and summary of the call, its outcome, anything the caller asks the receptionist to do, and any voicemail (see “Calls answered by the Voice Agent (AI receptionist)” below).
• Website activity: if a business adds AE One's tracking to its own website, we record page visits and form events against a random visitor ID kept in a cookie: the page address (without query details), the referring site and campaign tags. We don't store IP addresses for this; we use them briefly to stop abuse.
• Information from Meta and Google, described in their own sections below.

• To provide AE One to the business: storing its records, sending and receiving its messages, taking bookings, answering its calls, and running the automations it sets up.
• To run the AI features the business uses (see “AI features” below).
• To bill for AE One, provide support when asked, and send service notices.
• To keep AE One secure: limiting abuse, investigating problems and keeping audit records.
• To meet our legal obligations.

We do not sell personal information. We do not use a business's customer records, messages or call transcripts to train AI models.

AE One uses AI only to help the business that holds the information:

• The Voice Agent answers calls (see the next section).
• Call summaries, ticket triage and suggested replies, quote drafts from enquiries, social post captions and course quiz questions use Anthropic's Claude models. Before customer text is sent, AE One removes identifiers: names, phone numbers, email and street addresses, dates of birth, and Medicare and similar numbers.
• Health businesses: in a workspace that holds health information, customer text is not sent to these features unless the business turns that option on. Even then, only identifiers are removed; diagnoses and treatment details are still sent.
• Clinical notes are not sent to any AI service.

At the start of every call the receptionist tells the caller they are speaking with an AI assistant and that the call is transcribed. This can't be switched off.

During the call, the caller's speech is turned into text by Deepgram (through its Australian endpoint), the conversation is run by an OpenAI language model, and the receptionist's replies are spoken by a Deepgram voice. Call audio passes through our phone carrier, Telnyx, and AE One's voice server in Sydney.

If one of these services fails during a call, the receptionist switches to a backup so the call isn't dropped: OpenAI turns the caller's speech into text, ElevenLabs speaks the replies, or Anthropic runs the conversation. These backups are in the United States, and health and medical businesses don't use them unless they choose to.

We keep a written transcript of the call, a short summary, the outcome, and anything the receptionist did for the caller, such as booking an appointment, taking a message, creating a callback task or sending a text. These are stored in the business's AE One workspace. By default, card numbers, tax file numbers, Medicare, bank account, passport and licence numbers, and dates of birth are removed from the stored transcript.

AE One does not currently keep an audio recording of calls the receptionist answers. If a caller leaves a voicemail, the voicemail audio is held by our phone provider, and the business can play it back from AE One.

The receptionist won't take payment card details and doesn't give medical advice. If a caller describes an emergency, it tells them to hang up and call 000. If a caller mentions self-harm, it gives them 000 and Lifeline (13 11 14) and alerts the business's staff.

Health information is sensitive information under the Privacy Act. Clinics using AE One can keep medical history, treatment notes, intake forms and patient files. Clinical records can only be opened by staff with a reason to see them (for example the treating practitioner, the care team, or approved access), two-step sign-in is required to view them, and each view is logged. Workspaces that hold health information never share customer lists with Meta, and their customer text isn't sent for AI summaries, triage or drafts unless the business opts in. If a health business uses the Voice Agent, its calls are handled as described above, including by the overseas providers named there. The clinic remains responsible for its own obligations as a health service provider.

Businesses send emails and texts to their customers through AE One. Marketing emails carry an unsubscribe link that works in one click, and marketing texts end with “Reply STOP to opt out”. Replying STOP (or UNSUBSCRIBE, CANCEL, END, QUIT or OPTOUT) stops further texts from that business; START turns them back on. Each business is responsible for having consent to send its marketing messages under the Spam Act 2003 (Cth).

When a business connects a Facebook Page, Instagram professional account, ad account, or WhatsApp number, we process:

• Messaging content and metadata: the text of Messenger, Instagram, and WhatsApp messages, message IDs, timestamps, and the page-scoped or app-scoped IDs (PSID / IGSID) that identify a sender to the connected business.
• Page and account details: page name and ID, Instagram username and ID, ad account IDs, WhatsApp Business Account and phone-number IDs.
• Lead ad submissions: the fields a person submits in a Facebook or Instagram instant form (such as name, email, phone, and the questions the business asked), plus the campaign and ad the lead came from.
• Access tokens: Page and system-user tokens, stored encrypted in a secrets vault and used only to send and receive on the connected accounts.

We do not receive a person's Facebook or Instagram password, friends list, or profile beyond what Meta provides for the connected conversation.

• To deliver messages between a business and its customers in a unified inbox.
• To let the business's AI assistant answer routine enquiries within the business's scope, always disclosed as an AI assistant.
• To turn lead-ad submissions into contacts, opportunities, and follow-up tasks for the business.
• To publish the business's posts and manage its ads, and to measure ad performance (spend, reach, results) where the business connects an ad account.
• Where a business builds a customer-list audience, to prepare hashed (scrambled) email addresses and phone numbers for Meta to match. Workspaces that hold health information can't do this.

We do not sell personal information, and we do not use message content to train models.

Meta data is kept while the business keeps its account and the connection active. A person can request deletion of their Meta-linked data at any time through Meta's data-deletion flow. For Facebook requests we then delete, automatically, the messages, comments and lead-ad records linked to that person's Meta account in every workspace that holds them. The business's own contact record is not deleted, but nothing in it links back to the Meta account once those records are gone. Requests that involve a workspace holding health information, and Instagram and WhatsApp requests, are reviewed by our team before deletion. A status page at /meta/deletion/<code> shows whether the request is complete or under review.

A business can connect a Google Calendar to AE One so that bookings don't clash with the calendar owner's other commitments, and so that new bookings appear in that calendar. This section explains exactly what we access from Google when someone connects Google Calendar, and what we do with it.

What we access. With your permission, AE One accesses:

• Your calendar list: the names and IDs of the calendars in your Google account, so you can choose which calendars should block bookings.
• Free/busy times: when the calendars you choose are busy, so we don't offer a booking slot at a time you're already taken.
• Events on calendars you own: we create, update and delete the events for bookings made in AE One, in your primary Google calendar. If you turn on a rule that needs event details (such as ignoring short events, counting all-day events or treating events marked “Show as: Free” as busy), we read the start and end times, all-day dates, status and “show as” setting of events on your own calendars, only to apply that rule.

We don't keep or use the titles, descriptions, attendees or attachments of your own events, and we don't access your Gmail, contacts, Drive or any other Google service through this connection.

Why and how we use it. We use Google user data only to provide this feature: showing accurate availability on your booking pages and keeping your calendar in step with your bookings. What the events we add carry is the business's choice. With “Minimal” (the default for health businesses), an event carries the service name, the customer's first name and the booking time. With “Full details” (the default for other businesses), it also carries the customer's name as the business has it, phone number and email, how the booking was made, the booking reference and a link to the booking in AE One; the location is the business's address, or the customer's phone number for a phone or online booking. Neither ever includes booking notes, intake form answers, call recordings, transcripts or summaries, or clinical information. Where a customer books online and types their email, it is added as a guest.

What we store. We store the access and refresh tokens Google issues, encrypted (AES-256-GCM) in our database; the calendar IDs you choose to block bookings and your blocking rules; and the ID of each event we create, linked to its booking so we can update or remove it. Busy times are fetched when availability is checked and held in server memory for under a minute; we don't save them to our database. We don't store the names of your calendars or copies of your other events.

What we never do. We do not sell Google user data. We do not use it for advertising, including personalised or retargeted ads. We do not use it to train or improve AI or machine-learning models. We do not allow people to read it except where you ask us to for support, where it's needed for security or to comply with the law, or where it has been aggregated and anonymised for internal operations. We transfer it to others only as needed to provide this feature (to the infrastructure providers that host AE One under contract), or where the law requires it.

AE One's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion. You can disconnect Google Calendar at any time from Settings → My account (or an admin can do it from the Calendar sync tab of the team and services settings page, named for your industry, e.g. “Practitioners & services”). Disconnecting deletes your stored tokens and calendar settings straight away, removes the upcoming booking events AE One added to your calendar, and stops all further access. Events for past bookings stay in your calendar, because they're yours. You can also remove AE One's access from your Google account at any time at myaccount.google.com/permissions; once access is removed we can no longer read or change your calendar. To have any remaining Google-derived data deleted (such as the event IDs linked to past bookings), contact us using the details below.

If you choose to sign in with Google, Google shares your name, email address and profile picture with us. We use them only to sign you in, to match you to your AE One account, and to show your name and picture inside AE One. Signing in with Google doesn't give AE One access to your calendar or any other Google data; calendar access is only requested if you separately connect Google Calendar, as described above.

A business can connect its own accounts with other services. AE One then sends them only what the connection needs: Stripe for the business's card payments, Xero for invoices, payments and payroll, and Microsoft Outlook for booking events (the same details as Google Calendar above: with “Minimal”, the service name, the customer's first name and the time; with “Full details”, also the customer's name, phone and email, how it was booked, the booking reference and a link to it in AE One). A clinic can import its records from Cliniko; that is read only, and nothing is sent to Cliniko. A business can also send its own data to addresses it chooses, such as webhooks it sets up.

We share information with the business it belongs to; with the service providers that run AE One for us (our sub-processors), each receiving only what it needs for its part of the service; with the services a business chooses to connect, as described above; and with authorities only where the law requires it. The full list of sub-processors, what each receives and where it processes it, is on our sub-processors page.

AE One's database and file storage, the servers that run the app, and the voice server for the Voice Agent are in Sydney, Australia. Some of the providers we use are overseas, so personal information is disclosed to, or processed in, other countries, mainly the United States:

• OpenAI (United States): the text of Voice Agent conversations, and the caller's speech if it is the backup for turning speech into text.
• Anthropic (United States): text for the AI features above, with identifiers removed, and the conversation text if it is the receptionist's backup.
• ElevenLabs (United States): the text of the receptionist's replies, only if it is the backup voice.
• Resend (United States): emails and their recipients.
• Telnyx (a United States company): calls, texts and voicemail on Australian phone numbers.
• Deepgram (a United States company): call audio, sent to its Australian endpoint.
• Stripe, Meta, Google and Microsoft (United States and other countries): only for a business that uses or connects them.

Vercel, which hosts the app, is a United States company whose network serves pages worldwide. The sub-processors page lists each provider's location.

We keep a business's information for as long as it has an AE One account. If a paid plan is cancelled, the account moves to the Free plan and the information is kept. If a payment is left unpaid, access is paused and the information is kept, so the business can pick up where it left off. If nobody signs in to a Free account for 90 days, we may pause it, and we email the account owner before we delete a paused account and its information. A business can ask us to delete its workspace and its information by contacting us. Some operational records are cleared automatically: the content of sent emails after 30 days, email and SMS sending records after 180 days, and webhook delivery records after 30 days. Records of who viewed clinical and patient records are kept for seven years.

• You can ask the business you're dealing with, or us, to access or correct your information, or to delete it where the law allows.
• Businesses can export their contacts, and can de-identify an archived contact: their name and contact details are removed and they won't be contacted again.
• You can unsubscribe from a business's marketing emails with the link in each email, and stop its texts by replying STOP.
• You can ask Meta to have your Meta-linked data deleted, and disconnect Google Calendar or remove AE One's access to your Google account, as described above.

AE One uses cookies that it needs to work: to keep you signed in, to protect the steps when you connect Google, Microsoft, Meta, Stripe or Xero, and to remember settings. AE One's own pages don't load third-party analytics or advertising tags, with one exception: a business can switch on its own Google Analytics, Meta Pixel, LinkedIn Insight Tag or TikTok Pixel for its booking, form, quote and payment pages. When it does, those tags run on that business's pages only, Google, Meta, LinkedIn and TikTok set their own cookies and act for the business (not for AE One), and they're told the page address with personal details removed and that a booking, enquiry or payment happened, with its value. They never get your name, contact details or answers. Health businesses ask your permission first, and nothing loads until you allow it. On a business's own website, the business decides which tags run, and AE One's website tracking (described above) uses its own cookie.

Each business's information is kept separate from every other business's at the database level, and team members only see what their role allows. Information travels over encrypted connections. The tokens that connect Google, Microsoft and Xero accounts are encrypted in our database, and other connection secrets are kept in a secrets vault. Two-step sign-in is available to everyone, a business can require it for its whole team, and it is always required to view clinical records. Actions in a workspace are written to an audit log that can't be edited. No system is completely secure, and we work to fix any weakness we find.

If we become aware of a data breach involving information we hold, we will tell the affected business promptly and work with it to assess the breach and, where the Notifiable Data Breaches scheme requires, to notify the people affected and the Office of the Australian Information Commissioner.

Contact us at privacy@aeone.au with any question, request or complaint about privacy. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.