Medinova Health processes call recordings, transcriptions, patient names, phone numbers, and appointment details solely to provide our voice agent and practice management services.
All data is used exclusively for delivering the Medinova service - routing calls, booking appointments, generating analytics, and improving voice recognition accuracy. We do not sell or share data with third parties.
Processing is carried out under UK GDPR Article 6(1)(b) (contractual necessity) and Article 9(2)(h) (health or social care purposes). Medinova acts as a data processor on behalf of healthcare provider organisations.
Data is stored within the UK and EEA on encrypted infrastructure. Call recordings are retained for 90 days by default. Practice administrators may configure shorter retention periods.
Patients and practices have the right to access, rectify, or request deletion of their data. To exercise these rights, contact the healthcare provider that uses Medinova, or reach us at the contact page.
All data is encrypted in transit and at rest. Access is restricted to authorised personnel via role-based controls. We maintain ISO 27001-aligned security practices and conduct regular penetration testing.
This policy is reviewed quarterly. Material changes will be communicated to practice administrators 30 days in advance.
Last updated: January 2026