Security and your data
Your receptionist talks to your customers and patients, so their details need to be safe. Here's exactly how Pathir protects them, in plain English.
- UK company: Pathir Ltd, registered in England and Wales (16779893)
- Built for UK GDPR: you're the controller, we're your processor
How we protect data
- Encrypted in transit. Every page, call webhook and API request uses HTTPS, and browsers are told to only ever connect securely (HSTS).
- Connected logins encrypted at rest. Your Cliniko API key and Google Calendar access are encrypted in our database with a separate key.
- Passwords never stored. We keep only a salted scrypt hash, so nobody (including us) can see your password.
- Locked-down admin. Only the founder has admin access, through a private address and login that locks after repeated failed attempts.
- Accounts kept apart. Each business only ever sees its own conversations and customers, checked on our server for every request.
- Safe web pages. Security headers stop other sites framing Pathir or reading where you came from.
Clinics and patient data
- Identity check first. The receptionist checks date of birth (and name if the number isn't on file) before sharing or changing anything, enforced by our server, not just the AI.
- Live from Cliniko. Appointments are read from and written to your Cliniko account as they happen.
- Minimal copies. We keep a small index of patient phone numbers and names to greet callers. Never dates of birth or clinical notes.
- No clinical advice. The receptionist books, moves and cancels appointments and takes messages. It doesn't diagnose or advise.
Calls, recordings and retention
Calls are recorded and transcribed so you can review what was said and teach your receptionist. Texts and emails are kept the same way. We keep conversations while your account is open, so you can look back at them. When you delete your account, we delete your business data, conversations and customer records from Pathir.
AI and your data
Pathir doesn't use your data or your customers' data to train AI models. Our AI provider doesn't train on data sent through its business service. The receptionist only knows what's on your website, what you tell it, and the conversation in front of it.
Who we work with
We use a small number of established providers to run Pathir, under contracts that protect your data. Some operate outside the UK, with appropriate safeguards for international transfers. Customers can ask us for the full list of sub-processors.
- Cloud hosting: Running the Pathir app and storing its data
- Telephony: Phone numbers, calls and text messages
- Voice: The receptionist's voice and call transcription
- AI processing: Understanding and replying to customers (no training on your data)
- Email: Sending and receiving email
- Payments: Billing for Pathir plans (we never see full card numbers)
- Your connected tools: Google Calendar or Cliniko, only if you connect them
If something goes wrong
If we ever find a security incident affecting your data, we'll tell you without undue delay, explain what happened and what we're doing about it, and help you meet your own obligations, including any report to the ICO.
Report a security issue
Found a vulnerability? Email johannis@pathir.com with the details. We'll reply quickly and won't take action against good-faith research.
Questions
Got a security questionnaire or questions about how we handle data? Email johannis@pathir.com. See also our privacy policy.
Questions
Is Pathir secure?
Yes. Everything travels over encrypted HTTPS, passwords are never stored (only scrypt hashes), the logins for services you connect (like Cliniko and Google Calendar) are encrypted in our database, and only the founder has admin access, behind a private address and login.
Who owns my customers' data?
You do. Under UK GDPR you're the controller and Pathir is your processor: we only use your customers' details to run your receptionist, and never sell them or use them for anything else.
Is patient data safe with the Cliniko integration?
Pathir reads appointments live from Cliniko and checks a caller's date of birth (and name if their number isn't on file) before sharing or changing anything. That check is enforced by our server, not left to the AI. We keep only a small index of patient phone numbers and names so the receptionist can greet people, never dates of birth or clinical notes.
Is my data used to train AI?
No. Pathir doesn't train AI on your data, and our AI provider doesn't train on data sent through its business service.
Where is my data stored?
With established cloud providers, some of them outside the UK, under contracts with safeguards for international transfers. Cliniko data stays in your own Cliniko account. Customers can ask us for the full list of sub-processors.
Can I delete my data?
Yes. Delete your account from Settings and we delete your business data, conversations and customer records from Pathir. Billing records are kept only as long as the law requires.
Try Pathir free for 2 weeks
No card needed. Enter your website and your AI receptionist is ready in about 5 minutes.