Privacy Policy

Privacy at a glance

Who we are. Salutant is an AI receptionist for Australian health practices. It is operated by Grounded Scribe Pty Ltd.

What we handle. For the practices that use Salutant: their account and billing details. For the people who call, chat with or text a practice through Salutant: what they tell the receptionist, such as their name, phone number, date of birth, the reason for their call and any message they leave. More

Where it is kept. The live call and its speech are handled in the United States. The AI and everything we store stay in Australia. More

The receptionist says what it is. The greeting on every call tells the caller it is an AI receptionist and keeps a written record of the call. Call audio is not kept, apart from a voicemail a caller chooses to leave.

How long we keep it. Each practice chooses how long call and chat transcripts, messages and voicemail recordings are kept: 1 week, 1 month (the default) or 1 year. More

What we never do. Sell personal information, use it for advertising, or use it to train AI models.

Your rights. You can ask to see or correct your information, and complain to us or to the Office of the Australian Information Commissioner. More · Contact us

1. Introduction

Salutant is operated by Grounded Scribe Pty Ltd (ABN 69 695 177 818) ("we", "us", "our"). This Privacy Policy explains how we collect, use, disclose and protect personal information through Salutant: the AI receptionist that answers a practice's phone and website chat, its dashboard, and salutant.com.

It is not a consent form: where we need consent for something, we ask for it separately and clearly.

1.1 Who this policy covers

• Practices and their team: the health practices that use Salutant, and the people at those practices who have a Salutant sign-in.
• Callers and clients: people who call, chat with, text or reply to a practice through Salutant.
• Website visitors: people who visit salutant.com or send us an enquiry.

1.2 Our role for callers' information

When Salutant answers a practice's calls and chats, it does so for that practice. The practice decides how the receptionist works (its hours, rules and settings) and how long conversation records are kept, and is responsible for its own clients' records. We handle callers' information on the practice's behalf, to provide the service to the practice, as this policy describes. The practice controls its callers' information.

1.3 Applicable laws

• Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• Privacy and Data Protection Act 2014 (Vic)
• Health Records Act 2001 (Vic)
• Notifiable Data Breaches scheme

2. Information We Collect

2.1 Practice and user accounts

• Name, email address and password (stored in encrypted form only)
• Role at the practice (for example owner, manager or reception)
• The practice's details: name, phone numbers, address, opening hours, appointment types, the clinicians it lists, and the knowledge it gives the receptionist (such as fees, parking and policies)
• The receptionist's settings and the practice's Salutant phone number

2.2 Phone calls the receptionist answers

• The caller's voice during the live call, which is turned into text as they speak and is not kept
• The caller's phone number (caller ID), and the date and length of the call
• What the caller tells the receptionist: their name, who the call is for, their date of birth, whether they have been to the practice before, the reason for their call, and any message for the practice
• A written transcript of the call and a written summary of it
• A voicemail message, if the caller chooses to leave one: the recording and its text

The receptionist does not keep call audio. The one exception is a voicemail message a caller chooses to leave, which is kept so the practice can listen to it.

2.3 Website chats

If a practice adds the Salutant chat to its website, we collect what a visitor types in the chat and any contact details they give, such as their name, phone number or email address. The chat tells visitors: "You're chatting with an AI receptionist. A written record of this chat is kept for the practice."

2.4 Texts and secure reply pages

A practice can text a caller back from Salutant. A text is either a plain one-way text, or a short text with a link to a secure page on salutant.com where the person reads the practice's message and can reply. The page closes 7 days after the text is sent. We keep the texts, the messages on the page and any replies. Texts are practical messages from the practice about appointments and care, never marketing. Texting starts only once Salutant's sender name is approved.

2.5 Appointments and practice software

If a practice connects its practice software (such as Halaxy, Cliniko or Nookal), the receptionist reads the times that are free and the appointment types available, looks up whether a caller is already a client (by name, date of birth and phone number), and books, moves or cancels appointments there, or holds a request for the practice to approve. A practice without practice software keeps its appointments in the Salutant calendar, which we store. Where a caller is new to the practice, Salutant may create a basic client record (name and phone number) for them.

If the practice owner switches on call notes, after each call where we are sure who the client is, the receptionist adds the call summary to the client's clinical notes in the practice's software. The summary may include health information the caller gave.

2.6 Calls and texts the practice makes

People at a practice can call or text clients from the practice's Salutant number. These calls are not recorded or transcribed. We keep the number called, when, how long the call lasted, and any outcome or note the person saves.

2.7 Payment information

Plans and balance top-ups are paid through a PCI DSS compliant payment processor. We do not store full card details. We keep the plan, payments, top-ups and how the balance was used (minutes and texts).

2.8 Enquiries and technical information

When you send an enquiry through salutant.com, we collect your name, email address, the topic and your message, and use them only to respond. We also collect standard technical information when you use Salutant: IP address, browser and device type, and when you signed in.

Security and abuse protection. Our sign-up, contact and demo call forms may include an automatic check that the form is being used by a person and not an automated program. To run it, our security and abuse protection provider receives your IP address and technical information about your browser and device. It does not receive what you type into the form, and uses this only to tell people apart from automated abuse. It is processed in Australia and the United States, and may pass through other countries on the provider's global network.

2.9 What we do not collect

• Voice biometrics: we do not use a caller's voice to identify them
• Location data (GPS tracking, geolocation)

3. How We Use Information

3.1 To provide Salutant

• Answer the practice's calls and website chats, following its settings
• Check who is calling by name, date of birth and phone number. Caller ID is treated as a hint, never proof
• Book appointments, or hold a request for the practice to review, for example when the receptionist cannot confirm who the caller is
• Take messages and tell the practice about them, including an urgent alert when a caller may be in distress
• Send the texts the practice chooses to send, and show replies to the practice
• Run accounts, billing, the balance and customer support
• Send essential service emails, such as sign-in, billing and balance emails

3.2 Automated processing

The receptionist is a computer program that acts on personal information. It does not give clinical advice or make clinical, diagnostic or eligibility decisions about anyone.

• Answering: it answers from the practice's knowledge and settings. When it cannot be sure, it takes a message instead of guessing.
• Booking: where the practice turns it on, it books appointments using the caller's details and the practice's settings, or holds the request for the practice to approve. A practice can require approval of every booking.
• Summaries: it writes summaries of calls, voicemail messages and chats. They are shown to the practice as a starting point, not a record of fact.
• Call notes: where the practice turns it on, the call summary is added to the client's clinical notes automatically, as a draft where the software allows.
• Crisis: a caller describing an emergency is told to call Triple Zero (000), and a practice can choose to have its greeting mention emergency and crisis support. On mental-health lines, crisis services are offered when distress is detected, and the practice gets an urgent alert.

3.3 What we do not use information for

• Selling personal information
• Advertising, or profiles for advertising
• Training, fine-tuning or improving AI models
• Sharing with third parties for their own purposes

4. Where Information Is Processed

Everything we keep is stored in Australia, and the AI that runs the receptionist works in Australia too. A live call is handled in the United States as it happens, and nothing from it is kept there. Texts, emails, payments, website visit counts and the check on our forms that you are a person go through providers overseas, which keep their own delivery, payment or security records.

A live call is carried, and its speech recognised and voiced, by our telephony and speech processing providers in the United States, in real time and not retained. Any call recording, a voicemail included, is transcribed in Australia, and a call recording is then immediately and permanently deleted. Only the resulting text transcript and call summary are stored, encrypted, in Australia. The exception is a voicemail message a caller chooses to leave: it is kept in Australia for the practice to hear, and deleted at the end of the practice's retention period.

The receptionist's replies and summaries are written by an AI service. AI processing happens in Australia, and it never falls back to processing overseas. The AI service keeps nothing after processing and never uses the information to train AI.

4.1 Encryption

• In transit: TLS 1.3 for all data transmission
• At rest: AES-256 encryption for all stored data
• Passwords: hashed with a salt, never stored in plain text

5. Service Providers

We disclose personal information to service providers only for the service they provide to us:

• Hosting: our database and application, in Australia
• Telephony: carrying calls, voicemail, and the practice's own calls
• Speech processing: recognising and voicing speech during a live call, and transcribing any call recording (in Australia, with nothing kept)
• AI processing: writing the receptionist's replies and summaries, in Australia
• SMS: delivering texts
• Email delivery: service emails and alerts to the practice
• Payment processing: plans and balance top-ups
• Website analytics: counting visits to our public pages
• Security and abuse protection: checking that our sign-up, contact and demo call forms are used by a person
• Practice software: the system the practice connects (such as Halaxy, Cliniko or Nookal), which the practice chooses

Service providers are bound by terms that include purpose limitation, security obligations and breach notification. The email and SMS providers keep the messages they deliver for their own delivery records. None of them may use the information to train AI models. A list of our service providers is available to customers on request at privacy@salutant.com.

We may also disclose information if the law requires it, or as part of a merger, sale or transfer of the business, and we will tell practices of any change in ownership.

6. Data Security

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Role-based access: reception staff see callers' names, never clinical notes
• Strong password requirements, and monitoring of failed sign-in attempts
• Audit logging of access to data
• Incident response procedures

7. How Long We Keep Information

To close an account, the practice emails our support address (section 15). We delete the account 30 days after the request. In those 30 days the practice can ask for a copy of its data, and we send it before deletion.

8. The Practice's Responsibilities

A practice that uses Salutant is responsible for:

• Telling its callers and clients that it uses an AI receptionist, for example in its own privacy policy and collection notice
• Obtaining any consent its profession or the law requires
• Its own obligations for health records and privacy
• The settings it chooses, and keeping its team's sign-ins secure
• Reviewing call notes the receptionist adds to its clinical records
• Telling clients that call summaries may be added to their records

The receptionist helps: it always says "I'm an AI receptionist and I keep a written record of this call" (with its name, if the practice gives it one) before anything else, and the website chat says "You're chatting with an AI receptionist. A written record of this chat is kept for the practice." A practice cannot switch these off.

9. Your Rights

Under the Australian Privacy Principles, you can:

• Ask for access to the personal information we hold about you
• Ask us to correct information that is wrong or incomplete
• Ask us to delete your information, subject to legal requirements
• Make a complaint to us or to the OAIC (section 13)

If you called, chatted with or texted a practice, the practice holds the record of that conversation and is usually the best first contact. You can also contact us and we will work with the practice. Practices can correct their own details in the Salutant dashboard at any time.

Texts sent for a practice are service messages about your appointments and care. To stop them, ask the practice to update your record.

10. Cookies and Analytics

We use essential cookies for signing in, security and preferences. We use a website analytics service on salutant.com's public pages to count visits (page views, traffic source, country and device type). It is not linked to anyone's identity and is not used for advertising. We do not use third-party advertising cookies. Analytics never runs on the dashboard, setup, sign-in recovery or secure reply pages.

11. Children

Salutant is used by health practices, and some callers will be calling about a child. The practice is responsible for handling children's information in line with its professional obligations. Australia's Children's Online Privacy Code is due to be registered by 10 December 2026. We will update this policy to meet it where it applies to us.

12. Overseas Disclosure (APP 8)

Personal information is stored in Australia, and AI processing happens in Australia. Some of our service providers, including for telephony, messaging, email, payments and security and abuse protection, may process information overseas, including in the United States. We take reasonable steps to ensure these providers handle personal information in line with the Australian Privacy Principles, including contractual protections and checking their security practices.

13. Data Breaches and Complaints

If a data breach is likely to result in serious harm, we will contain it, tell affected practices without undue delay (and no later than 72 hours after becoming aware of it), and notify the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

If you think we have breached the Australian Privacy Principles, contact us using the details below. We will investigate and respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

14. Changes to This Policy

We may update this policy. We will tell practices about material changes by email or in Salutant, and the updated policy takes effect from the date at the top. We review it at least once a year.

Version 1.2 (11 October 2026): texts are practical messages from the practice, never marketing; clearer wording on how the receptionist says it is an AI (Privacy at a glance and section 2.4).

Version 1.1 (6 October 2026): added security and abuse protection: the automatic check on our forms that you are a person, what it receives and where it is processed (sections 2.8, 4, 5 and 12).

15. Contact Us

For questions about this policy, or to access or correct your information, contact our Privacy Officer. We acknowledge privacy requests within 3 business days and respond within 30 days.

• Grounded Scribe Pty Ltd (operator of Salutant), ABN 69 695 177 818
• Postal address: Privacy Officer, Grounded Scribe Pty Ltd, Office 4164, Ground Floor, 470 St Kilda Rd, Melbourne VIC 3004
• Privacy Officer: privacy@salutant.com
• Support: support@salutant.com
• Phone: (03) 4422 2211