1. Who We Are

Hi Human Ltd (“Hi Human”, “we”, “us”, “our”) is a UK-based technology company that provides an AI-powered patient communication platform for healthcare practices including dental surgeries, GP practices, and NHS organisations. Our AI receptionist, Hannah, handles patient communications across multiple channels.

Data Controller: Hi Human Ltd
Registered in: England & Wales
Website: hihuman.co.uk
Data Protection Contact: [email protected]

For clarity on our role:

When we process data on behalf of healthcare practices: We act as a data processor. The practice is the data controller and their own privacy notice governs how your data is used.
When we process data for our own purposes (e.g., our website visitors, prospective customers): We act as a data controller and this privacy policy applies directly.

2. What Data We Collect

2.1 Website Visitors

Data	Purpose
IP address	Website security
Browser type and version	Website compatibility
Pages visited	Website improvement

2.2 Practice Administrators

Data	Purpose
Full name, email address	Account identification and access
Phone number	Account security and support
Login activity and IP addresses	Security monitoring and audit

2.3 Patients Interacting with Hannah (AI Receptionist)

When patients interact with Hannah via voice call, webchat, SMS, WhatsApp, Instagram, Facebook Messenger, RCS (Rich Communication Services), or Telegram on behalf of a healthcare practice, we may process:

Data	Purpose
Name, date of birth	Patient identification and verification
Contact details (phone, email)	Appointment confirmations, follow-up
Conversation content	Service delivery, quality assurance
Voice recordings (where applicable)	Service delivery, quality improvement

Important: When patients interact with Hannah, the healthcare practice is the data controller. We process this data under a Data Processing Agreement.

3. How We Collect Data

Directly from you: When you visit our website, create an account, or interact with Hannah via voice, webchat, SMS, WhatsApp, Instagram DM, Facebook Messenger, RCS, or Telegram.
From healthcare practices: Practice administrators provide data when configuring the platform.
From practice management systems: With the practice’s authorisation, we retrieve appointment availability and patient records from connected systems (e.g., Dentally, Quicksilver).
From integration partners: We work with certified healthcare technology partners including Deltapath and Harris Health Alliance under formal partnership and NDA agreements.
Automatically via cookies: See our Cookie Policy for details.

4. Why We Process Your Data (Lawful Bases)

Data Type	Lawful Basis
Practice administrator accounts	Contract (Art. 6(1)(b))
Patient data on behalf of practices	Legitimate interests / Contract (under DPA)
Website analytics	Legitimate interests (Art. 6(1)(f))
Marketing communications	Consent (Art. 6(1)(a))
Security and fraud prevention	Legitimate interests (Art. 6(1)(f))
Billing and payments	Contract (Art. 6(1)(b))

5. Who We Share Data With

Recipient	Purpose	Safeguard
Healthcare practices	Data controllers for patient data	Data Processing Agreement
Google Cloud Platform	Infrastructure hosting (London, UK)	UK data residency
OpenAI	AI language model processing	DPA; no training on our data
Deepgram	Voice transcription	Data Processing Agreement
Meta (WhatsApp, Instagram, Messenger)	Messaging channel delivery	Meta Platform Terms; DPA
Google (RCS Business Messaging)	RCS messaging delivery	Google Cloud Terms; DPA
Telegram	Messaging channel delivery	Telegram Bot API Terms
Stripe / GoCardless / Revolut	Payment processing	PCI DSS / FCA regulated
Bandwidth / Twilio	Telephony and SMS	Data Processing Agreement
Deltapath	Unified communications & healthcare infrastructure partner	Partner Agreement; NDA
Harris Health Alliance	HealthTech innovation & NHS integration partner	Partner Agreement; NDA
Quicksilver	NHS backend integration	NHS compliant; DPA

We do not sell personal data to any third party.

6. International Data Transfers

Hi Human’s infrastructure is hosted within the United Kingdom (Google Cloud Platform, europe-west2 region, London). Where sub-processors process data outside the UK (e.g., OpenAI, Meta), we ensure appropriate safeguards including Standard Contractual Clauses and UK IDTA.

7. How Long We Keep Data

Data Type	Retention Period
Practice administrator accounts	Duration of contract + 6 years
Patient conversation logs	As directed by practice; default 2 years
Voice call recordings	As directed by practice; default 90 days
Billing records	7 years (legal requirement)
Security audit logs	2 years

8. Your Rights

Under UK GDPR, you have the right to:

Access — request a copy of your personal data
Rectification — request correction of inaccurate data
Erasure — request deletion of your data
Restriction — request we limit how we use your data
Portability — request your data in a machine-readable format
Objection — object to processing based on legitimate interests
Withdraw consent — where processing is based on consent

To exercise your rights: Email [email protected]

We will respond within one calendar month.

If you are a patient: Your data is controlled by the healthcare practice. Contact the practice directly first.

Information Commissioner’s Office (ICO): ico.org.uk | 0303 123 1113

9. Data Deletion

You can request deletion of your data at any time. Visit our Data Deletion page to submit a request.

For data processed via our messaging channels (WhatsApp, Instagram, Facebook Messenger, RCS, Telegram), you may also submit a deletion request through those platforms directly, or contact us at [email protected].

10. Automated Decision-Making

Hi Human uses AI (Hannah) to interpret patient requests, suggest appointment types, and determine availability. These are administrative decisions (appointment booking and routing) — not clinical decisions. The AI does not make diagnoses, determine eligibility for services, or produce legal effects. Patients may request to speak with a human at any time.

11. Communication Channels

Hi Human’s AI receptionist Hannah may communicate with patients across the following channels on behalf of healthcare practices:

Voice — inbound and outbound telephone calls
Webchat — embedded chat widget on practice websites
SMS — text messaging
WhatsApp — via Meta WhatsApp Business API
Instagram DM — via Meta Instagram Messaging API
Facebook Messenger — via Meta Messenger Platform
RCS (Rich Communication Services) — rich messaging via Google RCS Business Messaging
Telegram — via Telegram Bot API

Messages on all platforms are subject to this Privacy Policy, the healthcare practice’s own privacy notice, and the respective platform’s terms and policies. We process only the minimum data necessary. Message content is encrypted at rest.

12. NHS and Healthcare Compliance

Hi Human Ltd is committed to meeting the standards required for NHS and healthcare technology deployments in the United Kingdom:

DCB0129 (Clinical Safety): Hi Human undergoes clinical risk management with a qualified Clinical Safety Officer. A Clinical Safety Case Report and Hazard Log are maintained.
DTAC (Digital Technology Assessment Criteria): We complete the DTAC self-assessment covering clinical safety, data protection, technical security, interoperability, and usability.
DSPT (Data Security and Protection Toolkit): We register with and complete the NHS Data Security and Protection Toolkit annually.
Cyber Essentials: We pursue Cyber Essentials certification for our infrastructure.
NHS Integration: We integrate with NHS systems via Quicksilver for backend connectivity, ensuring compliance with NHS interoperability standards.
Data Processing Agreement: All healthcare practice customers receive a UK GDPR Article 28 compliant Data Processing Agreement.
DPIA: A Data Protection Impact Assessment has been completed, assessing 15 risks with mitigations documented.
ROPA: A Record of Processing Activities is maintained per UK GDPR Article 30, covering 16 processing activities.

For NHS and healthcare organisations requiring compliance documentation, please contact [email protected].

13. Integration Partners

Hi Human works with certified healthcare technology partners to deliver seamless integrations:

Deltapath — unified communications and healthcare infrastructure partner, specialising in UCaaS, contact centre, telehealth, and nurse call systems. 20+ years in enterprise communications. (Official partnership agreement and NDA in place)
Harris Health Alliance — HealthTech innovation partner, specialising in digital maternity, NHS integration, quality management, genetics, and bespoke development. 20+ years in NHS healthcare technology. (Official partnership agreement and NDA in place)
Quicksilver — NHS backend integration platform
Dentally — practice management system integration

All partner integrations are governed by Data Processing Agreements and confidentiality obligations.

14. Special Category Data (Health Data)

Hi Human processes health-related data as a data processor on behalf of healthcare practices. This includes reasons for appointment, symptoms mentioned during conversation, and prescription requests. We process this data under:

Article 9(2)(h): Processing necessary for healthcare provision
Article 6(1)(b): Performance of a contract between the practice and patient

Health data is encrypted at rest (AES-256-GCM), encrypted in transit (TLS 1.2+), isolated per practice (tenant-level encryption keys), and subject to strict access controls. No health data is used for AI model training.

15. Changes to This Policy

We may update this privacy policy from time to time. We will post the updated version with a revised effective date on this page.

16. Contact Us

Department	Email
Data Protection / Privacy	[email protected]
NHS & Healthcare Compliance	[email protected]
General Support	[email protected]
Press & Media	[email protected]
Partnerships	[email protected]
Sales	[email protected]

Website: hihuman.co.uk
Post: Hi Human Ltd, England & Wales

Effective Date: March 2026 | Last Updated: March 2026