The honest version. Written so a compliance officer can read it in five minutes and tick the boxes that matter.
Vocetica operates as a data processor on your behalf. Lawful basis, purpose limitation, data minimisation and retention all defined per engagement.
Call recordings, transcripts and caller metadata are processed and stored in UK and EU regions only. No US hosting, no EU-US data transfers for your call data.
All call recordings encrypted at rest (AES-256). TLS 1.2+ in transit. Encryption keys managed in UK/EU KMS with audit logging.
Standard DPA is signed with every Vocetica client before go-live. ICO-compliant controller-to-processor terms. Read the DPA.
Call recordings retained for 90 days by default (configurable 30/90/180). Transcripts retained per your data retention policy. Full delete-on-request within 30 days of DSAR.
Vocetica is registered with the UK Information Commissioner's Office as a data processor (Tier 1). Application reference C1918623, paid 25 April 2026. Registration certificate and ZA number expected within 7 working days; this page will publish the ZA number automatically on receipt. Verify Vocetica's listing on the ICO public register of fee payers.
Full current sub-processor list published and maintained below. Changes notified 30 days in advance.
Sophie's scripts are written with SRA Standards & Regulations (law firms) and GDC Standards for the Dental Team (dental practices) in mind — no unauthorised advice, no misleading claims, no pressure tactics.
When a caller dials a number routed through Sophie, Vocetica processes the following on your behalf: the caller's phone number, the content of the conversation (audio + transcript), the qualification fields your intake captures (name, email, accident/treatment detail, callback preference), and technical metadata (call timestamp, duration, carrier, country).
We process this data only as your data processor — never for Vocetica's own commercial purposes, never for model training, never sold to third parties, never shared with anyone outside the sub-processor list below. Caller audio is not used to train any AI model, ours or anyone else's.
Every Vocetica client signs a written DPA before go-live. It includes:
A template DPA is available on request prior to engagement — privacy@vocetica.com.
Vocetica uses the following sub-processors to deliver Sophie. UK/EU-hosted or with UK/EU data residency commitments where relevant:
Sub-processor changes are notified to clients with at least 30 days' notice. You may object to material changes in writing.
Unless agreed otherwise in your engagement:
On termination of your contract, all caller data is deleted from Vocetica systems within 30 days, with confirmation of deletion issued to you.
If a caller makes a DSAR to you (as data controller) that involves data we process on your behalf, contact privacy@vocetica.com and we'll provide the relevant recording, transcript and metadata within 5 working days — well inside the statutory 30-day window. Deletion and rectification requests are handled on the same timeline.
In the event of a personal data breach affecting your callers' data, we will notify you without undue delay (target: within 24 hours of detection) with a factual description, the categories and approximate numbers of data subjects affected, the likely consequences, and the measures we've taken or propose to take. This is faster than the ICO's 72-hour reporting requirement, giving you time to make your own notification if required.
Sophie is a non-lawyer and a non-dentist. Every intake script she runs is written with the following regulatory boundaries in mind:
Vocetica is operated as a UK sole trader trading as "Vocetica." We're transparent about this because it matters for procurement — some firms require supplier due diligence including Companies House records. A sole trader does not have a Companies House number.
We are registered as self-employed with HMRC. Invoicing details, HMRC UTR, and VAT status (if applicable) are shared on engagement. A limited company structure is on the roadmap; clients on existing engagements will be novated to the new entity with written notice.
For any compliance, privacy, data protection, or incident-related enquiry: privacy@vocetica.com
For general enquiries: hello@vocetica.com
Last updated: 24 April 2026. Material changes to this page are communicated to existing clients with 30 days' notice.