Privacy

Who holds what

For patient information, your clinic is the controller and FullDiary is the processor. We handle it on your instructions to do the job you have asked for, and for nothing else. We never sell it, and we never use it to train a model.

What we collect on a call

• The caller's phone number, and the name and contact details they give.
• The reason for the call as they describe it, in their words.
• A transcript of the call. We do not keep the audio.
• The booking written, and the confirmations sent.

Where it is stored

Patient data is stored in Australia, in Sydney — for New Zealand clinics as well as Australian ones.

For a New Zealand practice that means patient information crosses the border, which under the Privacy Act 2020 is a disclosure you are making and should be able to explain to a patient who asks. It is done on the basis that Australia has comparable privacy protection. A New Zealand data region is not built.

It is processed by named international subprocessors, which means parts of a call leave the country while it is happening. We will not claim full data residency, because that is not achievable on any current voice stack and the precision is the point.

Who we use, and for what

• Twilio — the phone number and the call itself.
• Retell — the voice agent that holds the conversation.
• A large-language-model provider — the model the agent thinks with, on a no-training, minimum-retention tier.
• MongoDB Atlas (Sydney) — where the record is stored.
• Resend — the notification and summary emails to you.

Each of these is contracted on a no-training, minimum-retention tier, and we keep the evidence of those settings rather than assuming them. Ask and we will show you what we hold.

This website

Separate from the call data above, and much smaller. If you send the form on the contact page we collect your name, your clinic, your email, an optional phone number and whatever you write. It is delivered to hello@fulldiary.health by Resend, through Cloudflare, which serves this site. It is not added to a mailing list and it is not stored anywhere else.

Enquiries are kept for twelve months and then deleted. Ask us sooner and we will delete yours on request.

No cookies, no analytics, no tracking pixels, no advertising. Cloudflare keeps short-lived server logs to serve the site and defend it from abuse; we do not build any profile of you from them.

How long we keep it

Transcripts are kept for twelve months by default and then purged. Booking records persist in your own practice management system, which is yours and outside our control.

A clinic can ask for a shorter retention period. A patient can ask for their transcript to be deleted, and we will do it and tell you it happened.

Patients' rights

A patient can ask what we hold about them, ask for a copy, ask for it to be corrected, or ask for it to be deleted. Route the request through the clinic or email us directly and we will handle it within thirty days.

If you think we have mishandled health information you can complain to the Office of the Australian Information Commissioner, or to the Office of the Privacy Commissioner in New Zealand.

Last updated 29 August 2026 · questions to hello@fulldiary.health