Designed for GDPR and
HIPAA regulated customer
support environments.
SpiraLink voicebots are designed to operate in environments governed by GDPR and HIPAA, with compliance built into how conversations are handled, not added afterward.
Explicit consent before
data processing (GDPR)
When a conversation involves the processing or logging of personal
data, the voicebot clearly informs the caller.
Before continuing, the voicebot:
-
Explains that personal data may be processed or logged
-
States the purpose of this processing
-
Asks for explicit consent to proceed
Only after consent is given does the system continue within that scope.
If consent is not granted or is withdrawn:
-
Processing is limited to what is strictly necessary
-
Or the call is transferred to a human agent
This ensures lawful processing and transparency under GDPR.
Transparency during
the conversation
The voicebot communicates clearly throughout the interaction.
This includes:
-
Informing the caller when data is retrieved from internal systems
-
Indicating when information is used to resolve the request
-
Clearly announcing when a handover to a human agent occurs
There are no hidden processing steps from
the caller's perspective.
Conditional and
purpose-limited data
logging (GDPR & HIPAA)
Conversations are not logged indiscriminately.
When logging is enabled:
-
The purpose of logging is defined in advance
-
The scope of stored data is limited
-
Logging starts only after required disclosures and consent
This supports data minimization and purpose limitation.
If logging is not permitted:
-
Data is used only in real time to resolve the interaction
-
Conversation content is not stored
Controlled access
to sensitive and
health-related data
The voicebot communicates clearly throughout the interaction.
It can only:
-
Access data required for the specific request
-
Retrieve or update information within approved boundaries.
-
Perform actions explicitly allowed by the organization.
For healthcare use cases, access to Protected Health Information (PHI) is strictly limited to what is necessary to support the interaction, in line with HIPAA's minimum necessary standard.
Human intervention
is always available
The system is designed to support meaningful human involvement.
It is designed to:
-
Callers can request a human agent
-
The system escalates automatically when uncertainty or risk is detected.
-
Human agents receive full conversation and system context.
This supports GDPR requirements for human
oversight and HIPAA expectations around
accountability.
Data retention
and purpose limitation
The system is designed to support meaningful human involvement.
Personal and health-related data is:
-
Used only for the purpose of resolving the interaction
-
Retained according to predefined retention policies.
-
Not reused outside its original intent.
The voicebot does not train itself on live customer data
unless explicitly configured and permitted.
