Valet Med

GDPR overview

Implementation is concrete rather than a generic claim. The privacy policy is drafted as an Art. 13/14 GDPR notice combined with the Austrian DSG, is dated (version 23.05.2026), and gives a legal basis per purpose: Art. 6(1)(b), (f), (a) and (c). Rights under Art. 15 to 22 are listed individually, with a one-month response time and office@valetai.at as the contact. The supervisory authority is named: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna. Third-country transfers rely on standard contractual clauses (Art. 46(2)(c)), the EU-US Data Privacy Framework (Art. 45) and, exceptionally, Art. 49. An Art. 28 processing agreement is issued to practices on request, and all EU/EEA sub-processors are under Art. 28 contracts. The policy states that no automated decision-making under Art. 22 takes place, treats health data as Art. 9 data, cites the Swiss nDSG for Switzerland, and exempts strictly necessary cookies under §165(3)(2) TKG 2021.

Who owns the data?

For website, contract and billing data, Andreas Shanti, the sole trader behind the Valet AI brand, is the controller under Art. 4(7) GDPR. For patient data captured during calls the roles reverse: the practice remains the controller and Valet AI acts as its processor under a separate Art. 28 GDPR data processing agreement (Terms §11). The practice therefore keeps its call content, and must itself tell its patients that an AI phone assistant is in use (§8). Sub-processors are bound by Art. 28 contracts, with standard contractual clauses or the EU-US Data Privacy Framework for third-country providers. Confidentiality is mutual and survives termination (§12); no content licence or transfer of rights is claimed anywhere.

Reuse rights

The practice reaches its own call data without asking anyone: the practice dashboard carries the summary, the written transcript, the callback requests and the statistics for every call, and appointments can optionally be synchronised into the practice's own external calendar. The publisher states that data is processed strictly for the contractual purpose only - appointment capture, callbacks and call documentation - that it is transmitted encrypted, and that the audio stream is transient: only the written transcript is stored, in a self-hosted EU database. In return, the terms (§8) bind the customer to contractual use and forbid introducing unlawful content. On the public website, Google Analytics 4 runs in Consent Mode v2 with ad_storage denied and IP anonymisation, and the policy rules out advertising services, retargeting, social media pixels and cross-site profiling. The site never says whether conversations may be reused to train or improve models, and mentions no opt-out.

Data retention & training

Hosting summary

The publisher describes a self-contained on-premise architecture in the EU rather than a cloud API. Its own EU server carries the AI voice and dialogue processing, the telephony and audio stack, the database, configuration and web API. External providers are few and their locations declared: voice AI on Amazon Web Services in the EU, PSTN and SMS routing, payment in Ireland, transactional email, calendar synchronisation and audience measurement, the last two under standard contractual clauses and the EU-US Data Privacy Framework. A dated update (28 July 2026) states that the productive speech path uses AWS in the EU as a processor, while web, dashboard and configuration run on EU hosting. No hosting country is ever named: the jurisdiction given is simply the EU. Art. 28 agreements cover all EU and EEA providers. Encryption is TLS in transit, DTLS-SRTP for WebRTC and SIP-TLS for telephony, with encrypted backups; infrastructure access is restricted to the owner by key and multi-factor authentication. The SOC 2 Type II report offered for download is that of AWS as a sub-processor, not a certification of Valet Med, and the site itself says it does not replace the practice's own processing agreement.