Privacy Policy

When you call a business that uses Opara AI, we may collect the following information:

• Your phone number (via caller ID)
• Your name (if you provide it during the call)
• Details of your inquiry or service request
• Call recordings for quality assurance and consent verification
• SMS consent status (whether you opted in or out)
• Timestamps of calls and messages

We use the information we collect to:

• Handle your inquiry and connect you with the appropriate business staff
• Send transactional SMS messages you have consented to, including inquiry confirmations, appointment reminders, and status updates
• Maintain consent records as required by the Telephone Consumer Protection Act (TCPA)
• Improve the quality and accuracy of our AI receptionist service

We do not sell, rent, or share your personal information with third parties for marketing purposes.

We use the following third-party services solely to operate our platform:

• Telnyx— SMS delivery
• Retell AI— AI voice receptionist (BAA on file)
• Supabase— Database and authentication infrastructure. Customer PHI onboarding remains blocked until the required HIPAA add-on and BAA readiness are active and independently verified
• Amazon Web Services (AWS) — Cloud infrastructure for our HIPAA-covered API layer, including AWS Bedrock (managed Claude AI), Lambda, SES email delivery, and CloudWatch logging (BAA on file)
• Stripe— Payment processing
• Vercel— Hosting for our public website and dashboard interface. The public contact form is processed by Vercel and is not approved for PHI; visitors are instructed not to submit patient names or health information
• Cloudflare Turnstile — Bot protection on website forms

Each processes data only as necessary to provide the service.

Retention varies by record type, contract, and applicable legal requirements. Customer agreements define the return or destruction schedule for protected health information; consent, opt-out, audit, and legal records may be retained longer where required. You may request deletion by contacting us, subject to those obligations.

Opara AI operates two SMS messaging programs—staff notifications and customer transactional messages—both transactional only, never marketing. Staff opt in before any alerts are sent; customer messages are sent only to people who provided their phone number for that purpose; and every message includes clear opt-out instructions (reply STOP).

5a. Customer messages (transactional, opt-out)

When a customer provides their phone number to a business that uses Opara AI—by calling it, booking an appointment, or being added by staff—Opara may send transactional messages about that appointment or inquiry on the business's behalf: appointment confirmations, reminders, and booking or payment links. These are transactional only, never marketing or promotional. Every message includes Reply STOP to opt out, which we honor across all future messages. SMS is optional; declining or opting out does not affect the service the customer receives.

5b. Staff notifications (dashboard opt-in + SMS “YES”)

Facility staff members receive transactional SMS alerts about missed calls, voicemails, and urgent operational items. A staff member's phone number is entered by an admin on the Opara AI dashboard; the system then sends a single opt-in request SMS to that number, and the staff member must reply YESfrom their own phone before any notifications are delivered. Until “YES” is received, no notifications are sent to that number. Staff can opt out at any time by replying STOP or by being removed from the dashboard by their admin.

• Frequency: Message frequency varies based on real call and appointment activity
• Opt-out: Reply STOP to any message to immediately unsubscribe
• Help: Reply HELP to any message for support information
• Cost: Standard message and data rates may apply
• No marketing: We do not send promotional or marketing messages through either program
• Mobile data: We do not share mobile information with third parties or affiliates for marketing or promotional purposes

For full details on how each program works, see our SMS Program & Consent page.

We implement industry-standard security measures including encrypted data storage, row-level security policies, HTTPS-only application communication, and restricted access controls. Voice-media transport and retention are not approved for customer PHI until the provider evidence is verified through the technical readiness process.

You have the right to request access to, correction of, or deletion of your personal information. You may also opt out of SMS communications at any time. To exercise any of these rights, contact us using the information below.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.

For questions about this Privacy Policy or to exercise your data rights:

Email: hello@oparaai.io