Privacy policy

This privacy policy applies between you, the User of this Website and Implement AI Limited, the owner and provider of this Website and the AI Call Agent platform. Implement AI Limited takes the privacy of your information very seriously. This privacy policy applies to our use of any and all Data collected by us or provided by you in relation to your use of our Website and our services.

This privacy policy should be read alongside, and in addition to, our Terms and Conditions, which can be found at: implementai.io/terms-and-conditions

Please read this privacy policy carefully.

1.About Us

Implement AI Limited is a company incorporated in England and Wales with registered number 14842097 whose registered office is at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.

We provide an AI-powered call answering platform that answers incoming calls, books appointments, routes urgent calls, and takes messages on behalf of our clients, including NHS general practices.

2.Data Protection Contact

Data Protection Officer: report.implementai.io

Primary Security Contact: Piers Linney, Executive Chairman

Emergency Contact: Escalation available for critical security incidents

If you have any questions about this privacy policy or how we handle your data, please contact us through our reporting page at report.implementai.io.

3.Our Role Under Data Protection Law

Implement AI Limited has two distinct roles under the UK General Data Protection Regulation (UK GDPR), depending on the service:

3.1 Website Users

For visitors and users of this Website, Implement AI Limited acts as the Data Controller. This means we determine the purposes for which, and the manner in which, your Data is processed.

3.2 AI Call Answering Service for NHS GP Practices

For the AI call answering service provided to NHS general practices, Implement AI Limited acts as a Processor. The GP practice is the Data Controller. This means:

• The GP practice determines the purposes and manner of processing patient data
• Implement AI processes patient data on behalf of and under the instructions of the GP practice
• Our obligations are defined in a Data Processing Agreement (DPA) entered into with each GP practice, compliant with UK GDPR Article 28
• The GP practice is responsible for obtaining patient consent and managing individual rights requests
• Implement AI supports the GP practice in fulfilling these obligations

4.Data We Collect

4.1 Website Data

When you visit or use our Website, we may collect the following Data:

• Name
• Job title and profession
• Contact information such as email address and telephone numbers
• Demographic information such as postcode, preferences and interests
• IP address (automatically collected)
• Web browser type and version (automatically collected)
• Operating system (automatically collected)
• Pages visited, referring sites, and activity on the Website (automatically collected)
• General information about any business operated by you

4.2 AI Call Answering Service Data

When the AI call answering service is used by a GP practice, the following patient data may be processed:

• Patient name (as provided during the call)
• Phone number (caller line identification)
• Call audio (full recording of the patient call)
• Call transcript (text transcription of the patient call)
• Appointment details (date, time, and type booked by the AI)
• Message content (messages taken by the AI for the practice)
• Call metadata (date, time, duration, routing outcome)
• Symptoms or clinical details mentioned by the caller (captured incidentally in the call recording for auditability only, not processed for clinical purposes)

The AI only books, routes, and takes messages. It does not assess clinical urgency or provide clinical advice.

5.How We Collect Data

5.1 Data Given to Us by You

• When you contact us through the Website, by telephone, post, email or through any other means
• When you register with us and set up an account to receive our products or services
• When you complete surveys that we use for research purposes
• When you elect to receive marketing communications from us
• When you use our services

5.2 Data Received from Third Party Sources

We may receive Data about you from the following publicly available third party sources: Companies House.

5.3 Data Collected Automatically

To the extent that you access the Website, we collect some information about your visit automatically, including your IP address, the date, times and frequency with which you access the Website, and the way you use and interact with its content. We also collect Data automatically via cookies, in line with the cookie settings on your browser.

5.4 AI Call Answering Service Data

Patient data is collected when a patient calls the GP practice and the AI system answers the call. The telephony provider routes the call to the AI system using the patient’s phone number only. The AI system then records the call, transcribes it for processing, and books appointments, routes calls, or takes messages based on the conversation.

6.How We Use Data

6.1 Website Data

Data may be used by us for the following purposes:

• Internal record keeping
• Improvement of our products and services
• Transmission by email of marketing materials that may be of interest to you
• Contact for market research purposes
• Showing you Implement AI Limited adverts and other content on other websites

We may use your Data for the above purposes if we deem it necessary for our legitimate interests. If you are not satisfied with this, you have the right to object in certain circumstances (see section 9 below).

For the delivery of direct marketing to you via email, we need your consent, whether via an opt-in or soft-opt-in. You have the right to withdraw consent at any time.

6.2 AI Call Answering Service Data

Patient data is used solely for:

• Answering incoming patient calls
• Booking appointments on behalf of the GP practice
• Routing urgent calls to the appropriate person at the practice
• Taking messages for the practice
• Auditability and dispute resolution (call recordings and transcripts retained for this purpose)

Patient data is NOT used for:

• Clinical assessment or clinical advice
• Research, planning, or analytics
• Model training or AI improvement
• Marketing
• Any secondary purpose beyond the call answering service
• Sharing with any party not specified in this policy or the DPA

7.Data Storage and Security

7.1 Data Storage Location

All customer and business data is stored and processed exclusively within Microsoft Azure UK South. This supports compliance with applicable data protection regulations and data residency requirements. Our infrastructure uses certified data centres physically located within the United Kingdom.

7.2 Encryption

• Data at rest: AES-256 encryption, supported by cloud-managed disk encryption
• Data in transit: TLS 1.2 or higher for all data transmissions, including API communications

7.3 Access Control

• Multi-factor authentication (MFA) is enforced for all users
• Role-based access control (RBAC) ensures individuals have the minimum necessary access
• All system access is logged and monitored through detailed audit trails
• Audit logs are retained for a minimum of 12 months in tamper-proof storage
• Access permissions are reviewed regularly
• Leaver access removal is automated through Entra ID

7.4 Data Masking

Before any external AI processing, data masking techniques are applied to minimise the risk of exposure of sensitive information. Only masked and minimised data necessary for the specific AI task is transmitted to the AI language model provider.

7.5 Network Security

• Enterprise-grade firewalls protect all network boundaries
• Web Application Firewalls (WAFs) protect internet-facing applications
• Network segmentation separates system components
• Microsoft Defender for Cloud provides continuous threat detection and monitoring
• Comprehensive anti-malware protections across all system components

7.6 Backups

• All critical systems and client data are automatically backed up daily
• Backup data is stored in geographically separate locations within Azure
• Backup media is securely erased after data deletion

7.7 Background Screening

All personnel joining Implement AI Limited from April 2026 onward are subject to background screening, including checks on financial and criminal history, prior to commencement.

8.Who We Share Data With

8.1 Website Data

We may share your Data with:

• Our group companies or affiliates, to ensure proper administration of the website and business
• Our employees, agents, and professional advisors, to provide relevant content and information
• Third party service providers who provide services to us which require the processing of personal data

8.2 AI Call Answering Service Data (Sub-Processors)

For the AI call answering service, patient data is shared with the following sub-processors:

All sub-processors are governed by contractual controls, including incident notification clauses. A complete list of service partners is maintained and available to clients upon request.

We do not sell your Data to any third party.

9.Your Rights

You have the following rights in relation to your Data:

• Right of access: the right to request copies of the information we hold about you
• Right to rectification: the right to have your Data corrected if it is inaccurate or incomplete
• Right to erasure: the right to request that we delete or remove your Data from our systems
• Right to restrict processing: the right to block us from using your Data or limit the way in which we can use it
• Right to data portability: the right to request that we move, copy or transfer your Data
• Right to object: the right to object to our use of your Data including where we use it for our legitimate interests

For AI call answering service patients: as the GP practice is the Data Controller, individual rights requests should be directed to the GP practice. Implement AI supports the GP practice in fulfilling these requests, including retrieving call recordings, deleting data, and ceasing processing upon instruction.

To make enquiries, exercise any of your rights, or withdraw your consent, please contact us through our reporting page at report.implementai.io.

If you are not satisfied with the way a complaint is handled, you may refer it to the Information Commissioner’s Office (ICO). The ICO’s contact details can be found at https://ico.org.uk/.

10.Data Retention

10.1 Website Data

Unless a longer retention period is required or permitted by law, we will only hold your Data on our systems for the period necessary to fulfil the purposes outlined in this privacy policy or until you request that the Data be deleted. Even if we delete your Data, it may persist on backup or archival media for legal, tax or regulatory purposes.

10.2 AI Call Answering Service Data

GP practices may request customised retention policies, including shorter retention periods for enhanced privacy, extended retention for compliance purposes, or legal hold capabilities.

After the retention period expires, data is securely overwritten using industry-standard deletion techniques. Backup media containing deleted data is securely erased. Certificates of data destruction are available upon request.

11.International Data Transfers

Under standard operations, client data remains within the United Kingdom. All primary processing and storage occurs within Azure UK South.

When AI services are utilised for call processing, only masked and minimised data necessary for the specific AI task is transmitted via encrypted channels (TLS 1.2+). Processing is transient. AI providers do not retain data after processing completion. Standard Contractual Clauses (SCCs) govern any transfers where services operate outside the United Kingdom. Additional technical safeguards (encryption, pseudonymisation) are applied to mitigate transfer risks.

12.Data Deletion

Clients may request deletion of specific data or all data associated with their account. Deletion requests are processed promptly in accordance with agreed timelines. Confirmation of deletion is provided upon completion.

Data is securely overwritten using industry-standard deletion techniques. Backup media containing deleted data is either securely erased or physically destroyed. Certificates of data destruction are available upon request.

13.Cookies

This Website may place and access certain Cookies on your computer. Implement AI Limited uses Cookies to improve your experience of using the Website. All Cookies used by this Website are used in accordance with current UK and EU Cookie Law.

Before the Website places Cookies on your computer, you will be presented with a message asking for your consent to their use. You can change your preferences and withdraw your consent at any time.

14.Changes to This Privacy Policy

We may update this privacy policy from time to time. The updated version will be indicated by an updated revision date and the new version will be effective as soon as it is accessible on the Website. We encourage you to review this privacy policy frequently to stay up to date.

15.Links to Other Websites

This Website may provide links to other websites. We have no control over such websites and are not responsible for their content. This privacy policy does not extend to your use of such websites. You are advised to read the privacy policy of other websites prior to using them.

16.Changes of Business Ownership and Control

Implement AI Limited may, from time to time, expand or reduce our business and this may involve the sale and/or transfer of control of all or part of Implement AI Limited. Data provided by Users will, where it is relevant to any part of our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this privacy policy, be permitted to use the Data for the purposes for which it was originally supplied to us.

17.Compliance and Certifications

Implement AI Limited maintains the following certifications and compliance programmes:

Certified

• Cyber Essentials: Certified 14 November 2025, certification body CyberSmart under IASME.
• UK GDPR and Data Protection Act (2018): Data Protection Officer appointed. Privacy by design approach implemented across all systems. Records of Processing Activities (ROPA) maintained. Data Processing Agreements in place with all sub-processors.
• EU AI Act: Mapped control set maintained and monitored alongside other assurance programmes. Annex IV technical documentation and Annex V declaration of conformity drafted.
• ISO/IEC 27001:2022: Certified October 2026, certification body Prescient Security.
• NHS Data Security and Protection Toolkit (DSPT): Standards Met. Self-assessment published October 2026, with evidence submitted across all 10 NDG standards.

In progress

• SOC 2 Type II: Examination in progress with Advantage Partners. Observation period July to October 2026. Report expected November 2026.
• Cyber Essentials Plus: CE Plus audit to follow within the new 3-month window. Expected completion January 2027.
• DCB0129 Clinical Safety Case: Clinical risk management plan, hazard log, and clinical safety case report being prepared for the AI call answering service. Clinical Safety Officer training in progress. Expected completion December 2026.
• DTAC (Digital Technology Assessment Criteria): Expected completion late December 2026.
• DCB0160: Deployment safety case pack for each GP practice. Expected completion late December 2026.
• ISO/IEC 42001:2023 (AI Management Systems): Planned following completion of current ISO 27001 and SOC 2 programmes.

18.Contact Us

If you have any questions about this privacy policy, our data practices, or your rights, please contact us: