Privacy Policy

OpBench is a product of GenAI Ventures ("OpBench," "we," "us," or "our"). This Privacy Policy explains how we collect, use, and share information when businesses use our AI-powered call platform to confirm, reschedule, and manage patient/customer appointments. OpBench is offered to businesses in the United States, Canada, and the United Kingdom.

Who This Policy Applies To

This policy applies to:

• Business owners, administrators, and staff who use the OpBench dashboard ("Business Users"); and
• Patients, customers, or other individuals who receive an OpBench-initiated call or who call a number answered by OpBench on a Business User's behalf ("Call Recipients").

OpBench provides automated outbound calling to confirm upcoming appointments and detect no-shows or cancellations, typically placed approximately 24 hours before a scheduled appointment. Business Users on the Full Reception plan also have an AI receptionist that answers inbound calls to their dedicated OpBench phone number, answers common questions, and schedules appointments on a connected Google Calendar. Business Users upload appointment/contact data (typically via spreadsheet upload) and can download updated call logs, review call recordings and transcripts, and are notified when a call requires human follow-up (for example, when the Call Recipient asks a question or requests to reschedule).

Information We Collect

About Call Recipients (patients/customers):

• Name and phone number;
• Email address, if provided by the Business User;
• Appointment date, time, service/provider details, and appointment status (confirmed, cancelled, no-show, rescheduling requested);
• Call recordings, transcripts, and AI-generated call summaries;
• Any information the Call Recipient states during the call (for example, a stated reason for rescheduling), including, for inbound calls, the caller's phone number and the details they provide to book or ask about an appointment.

About Business Users:

• Business name, address, phone number, and time zone;
• Login credentials (email and hashed password);
• Uploaded appointment/contact files and any data contained in them;
• Onboarding and configuration details (services offered, call scripts, calling hours);
• Subscription and billing details (payment card details are collected and processed by Stripe and are not stored by OpBench);
• If you connect Google Calendar, your Google account email address, calendar availability, and the appointment events OpBench creates, updates, or deletes on your behalf.

About website visitors (opbench.com, separate from the calling service):

Usage and device information collected by Google Analytics and DataFast, which we use to understand how visitors find and use the site (for example, pages viewed, referring source, browser, and approximate location). These tools may use cookies or similar technologies.

How We Use This Information

We use collected information to:

• Place outbound calls to confirm appointments, detect no-shows, and process cancellation or rescheduling requests;
• Answer inbound calls, respond to questions, and schedule appointments for Business Users on the Full Reception plan;
• Read availability from, and write appointments to, a Business User's connected Google Calendar;
• Detect and record opt-out requests so that numbers are not called again;
• Flag calls for human review when a Call Recipient asks a question or requests a reschedule;
• Generate call recordings, transcripts, and summaries, and make them available to the Business User via the portal;
• Process uploaded appointment files and generate updated call logs for download;
• Send notification emails to Business Users;
• Maintain audit logs for administration, troubleshooting, and quality review;
• Meet legal, regulatory, and contractual obligations, including responding to lawful requests from authorities.

We do not use Call Recipient or Business User data to train generalized or foundational AI/ML models.

Outbound Calling, Recording, and Consent

Because our core service involves automated outbound phone calls and call recording, the following applies:

Business User responsibility for consent. Business Users are solely responsible for ensuring they have a lawful basis to have OpBench place automated calls to each contact they upload — including compliance with the Telephone Consumer Protection Act (TCPA), applicable Do-Not-Call registries, and any state-specific telemarketing/robocall laws. Business Users represent that they will not upload contacts who have opted out of such calls or revoked consent.

Call recording and AI disclosure. OpBench records calls and makes the recordings and transcripts available to the Business User. Business Users are solely responsible for giving any notice that a call is placed or answered by an AI system or is being recorded, and for obtaining any consent that applicable law requires. Several US states (including California, Florida, Illinois, Massachusetts, Pennsylvania, and others) require the consent of all parties to a recorded call.

Calling hours. Business Users are responsible for scheduling calls only during the hours permitted by law in the Call Recipient's location, including the TCPA's general 8am to 9pm local-time window.

Opt-out handling. Call Recipients may ask not to be called again by telling the AI agent during the call or by contacting the Business User directly. When the Service detects an opt-out request, the number is added to that Business User's Do Not Call list and excluded from future calls from that Business User's account, and unclear requests are flagged for the Business User's review. Business Users can also add numbers to their list manually. Suppression lists are kept separately for each Business User and are not shared across Business Users.

Information We Share With Third Parties

We use the following service providers (subprocessors) to operate the platform. Each receives only the data necessary to perform its function:

We do not sell personal information, and we do not share it with advertisers or unrelated third parties. We may disclose information if required by law, subpoena, or valid legal process, or to protect the rights, safety, or property of OpBench, our users, or others.

Healthcare Data and HIPAA

Some Business Users are healthcare providers or entities covered by HIPAA, and the appointment data they upload — including patient names, phone numbers, and appointment/service details — may constitute Protected Health Information (PHI).

If you are a HIPAA-covered entity or business associate, a signed Business Associate Agreement (BAA) with OpBench is required before you upload any PHI to the platform. Contact contact@opbench.com to execute a BAA prior to onboarding.

OpBench maintains [CONFIRM STATUS: signed BAAs / HIPAA-eligible enterprise agreements] with subprocessors that may handle PHI on our behalf, including [Vapi] and [OpenAI]. Where a subprocessor does not offer a HIPAA-eligible service tier, we do not route PHI to that subprocessor. [This statement must reflect your actual subprocessor agreements — confirm before publishing.]

Where a BAA is in effect, its terms control the handling of PHI to the extent they conflict with this Policy.

If you are subject to Ontario's PHIPA or another jurisdiction's health privacy law, you remain responsible for your own compliance obligations; OpBench will cooperate in good faith with reasonable compliance requests.

Canadian Privacy Law (PIPEDA and Provincial Laws)

If you are located in Canada, the following applies in addition to (not instead of) the rest of this Policy.

Federal law — PIPEDA. In provinces and territories without substantially similar private-sector legislation, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs our handling of personal information. We collect, use, and disclose personal information only with appropriate consent (which, for appointment-confirmation calls, is generally obtained by the Business User's existing relationship with the Call Recipient) and only for purposes a reasonable person would consider appropriate in the circumstances. Under PIPEDA, individuals have the right to access their personal information, request correction of inaccuracies, and withdraw consent (subject to legal or contractual restrictions), and may complain to the Office of the Privacy Commissioner of Canada if unsatisfied with our response.

Provincial private-sector laws. In British Columbia, Alberta, and Quebec, provincial private-sector privacy legislation applies instead of PIPEDA to organizations operating within those provinces (British Columbia's PIPA, Alberta's PIPA, and Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25). These laws impose obligations broadly similar to PIPEDA, with some additional requirements described below for Quebec specifically.

Quebec — Law 25. If you or your patients/customers are located in Quebec, additional requirements apply, including:

• A designated Privacy Officer responsible for personal information protection (by default, our most senior officer, unless another role is designated) — [CONFIRM AND NAME THE ROLE];
• A Privacy Impact Assessment before any transfer of personal information outside Quebec, confirming the receiving jurisdiction provides adequate protection;
• The right for individuals to request de-indexing or cessation of dissemination of their personal information in certain circumstances;
• Mandatory notification to the Commission d'accès à l'information (CAI) and affected individuals for incidents presenting a "risk of serious injury";
• Documents and communications intended for Quebec residents must be available in French. [CONFIRM: Is a French version of this Policy, the Terms, and the calling script/disclosure available or planned? This is a firm requirement under Quebec's Charter of the French Language (Bill 96) if you are actively serving Quebec-based clinics/customers, not just an accessibility nicety.]

Cross-border data transfer. Personal information collected through the Service — including from Canadian Business Users and Call Recipients — is transferred to, stored, and processed in the United States by us and by our subprocessors (see the subprocessor table above). While in the United States, this information may be accessible to US government authorities under US law (such as the CLOUD Act). By using the Service, Canadian users acknowledge this cross-border transfer. Where required (including under Quebec's Law 25), we will complete a documented assessment confirming this transfer provides comparable protection before it occurs. [CONFIRM this assessment has actually been done, or flag it as an implementation task rather than stating it as complete.]

Provincial health privacy laws. Canadian healthcare customers are typically subject to provincial health-specific privacy legislation rather than PIPEDA/PIPA alone, including but not limited to: Ontario's Personal Health Information Protection Act (PHIPA), Alberta's Health Information Act (HIA), Manitoba's Personal Health Information Act (PHIA), Nova Scotia's Personal Health Information Act, and Quebec's Act respecting health and social services information. If you are a healthcare provider or custodian/trustee under any such law:

• You acknowledge that OpBench acts as your service provider/agent/processor with respect to personal health information, and a written agreement meeting the applicable law's requirements (e.g., a PHIPA "agent" agreement, or the equivalent under your province's health privacy statute) is required before you upload personal health information. Contact contact@opbench.com to put this in place before onboarding.
• Breach notification to the applicable provincial health privacy regulator (e.g., Ontario's Information and Privacy Commissioner) and to affected individuals will follow the timelines and process required under your province's law, which may differ from the HIPAA and PIPEDA timelines described elsewhere in this Policy.
• You remain responsible for determining which provincial law(s) apply to your organization and for ensuring the appropriate agreement is in place; OpBench will cooperate in good faith with reasonable compliance requests specific to your province.

United Kingdom Privacy Law (UK GDPR and DPA 2018)

If you or your patients/customers are located in the United Kingdom, the following applies in addition to (not instead of) the rest of this Policy.

Legal basis for processing. For each purpose described in "How We Use This Information" above, we rely on one of the following legal bases under the UK GDPR: performance of our contract with the Business User; our (or the Business User's) legitimate interests in confirming appointments and reducing no-shows, balanced against the Call Recipient's rights; or compliance with a legal obligation. [CONFIRM AND FINALIZE which basis applies to which specific activity — this must be precise, not generic, under UK GDPR.]

Special category data. Health information (including appointment type/reason where it reveals health information) is "special category data" under Article 9 UK GDPR and requires an additional, specific condition for processing beyond the general legal basis above — typically the Call Recipient's explicit consent, or processing by/under the responsibility of a health professional subject to a duty of confidentiality. [CONFIRM which condition applies and document it — this is a distinct, higher bar than for ordinary personal data and is not satisfied merely by having a legal basis for general processing.]

Automated decision-making. Under Article 22 UK GDPR, individuals have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our design — routing any call involving a question, ambiguous response, or reschedule request to human review — is intended to ensure no such solely-automated decision is made about a Call Recipient. [CONFIRM this human-review safeguard is actually implemented as described, since it is the basis for treating Article 22 as not triggered.]

International data transfers. Personal data from UK-based Business Users and Call Recipients is transferred to and processed in the United States. This transfer relies on [CONFIRM MECHANISM: the UK-US Data Bridge / Data Privacy Framework extension, if our US subprocessors are certified under it; otherwise the UK's International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum, executed with each relevant subprocessor]. This must be confirmed and documented before any UK personal data is processed — it is not optional infrastructure.

Breach notification. In the event of a personal data breach affecting UK individuals, we will, where required, notify the UK Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, and will notify affected individuals directly where the breach is likely to result in a high risk to their rights and freedoms.

UK representative. [CONFIRM: If GenAI Ventures has no UK establishment, Article 27 UK GDPR / DPA 2018 generally requires appointment of a UK representative as a point of contact for the ICO and data subjects. Name that representative here once appointed, or confirm an establishment-based exemption applies.]

Data Protection Officer. [CONFIRM: Large-scale processing of special category (health) data may require appointment of a Data Protection Officer under Article 37. Confirm whether this threshold is met and, if so, name the DPO and provide contact details here.]

Your UK rights. In addition to the rights described elsewhere in this Policy, UK individuals have the right to: access their personal data; request rectification of inaccurate data; request erasure ("right to be forgotten"); restrict processing in certain circumstances; object to processing based on legitimate interests; and receive their data in a portable format where technically feasible. You may exercise these rights by contacting contact@opbench.com, or by contacting the party using OpBench to place your call in the first instance. You also have the right to lodge a complaint with the ICO at ico.org.uk.

UK healthcare data. If you are a UK healthcare provider (e.g., an NHS body or private clinic), you remain responsible for compliance with the UK GDPR, the Data Protection Act 2018, and any applicable NHS data security/confidentiality requirements (e.g., the NHS Data Security and Protection Toolkit, where relevant to your organization). A written data processing agreement meeting Article 28 UK GDPR requirements is required before you upload any patient data — see "Relationship to Terms of Service" below.

Voice Data

Call recordings and derived voice data may be considered biometric or voice-identifying information under certain state laws (for example, Illinois' Biometric Information Privacy Act). [CONFIRM: Does OpBench extract voiceprints or perform voice-based identification/authentication? If not, state that explicitly here, since that significantly reduces exposure under these laws. If recordings are only stored/transcribed and not used for voice matching, say so directly.]

Data Storage, Security, and Retention

Personal information (names, phone numbers, email addresses) is encrypted at rest and in transit (TLS).

Call recordings are stored on Vapi's infrastructure and accessed via secure, access-controlled links.

Uploaded appointment files are retained for [CONFIRM PERIOD] and are accessible only to the uploading Business User and authorized OpBench personnel.

Call recording audio is available for 14 days from the call date. Call logs, transcripts, summaries, and call outcomes are retained for as long as the Business User's account is active, or longer where required under a BAA, and are handled after termination as described below.

Upon account termination, data is retained for 30 days (or longer if required under a BAA) and then deleted, unless a Business User requests earlier deletion or export.

In the event of a security incident involving personal information or PHI, we will notify affected Business Users without unreasonable delay and in accordance with applicable law, including HIPAA's breach notification timelines (generally within 60 days of discovery for PHI) where applicable.

Google API Data Usage

OpBench's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you connect Google Calendar, OpBench requests access to your calendar (to check availability and to create, update, and delete appointment events on your behalf) and to your Google account email address (to identify the connected account). We use this data only to provide the scheduling features of the Service. We do not use data received from Google APIs to develop, improve, or train generalized or foundational AI/ML models. You can disconnect Google Calendar at any time, which removes the stored access tokens, and you can revoke access in your Google account settings.

Your Privacy Rights (US State Laws)

Depending on your state of residence, you may have rights under laws such as the California Consumer Privacy Act (CCPA/CPRA), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, and similar state laws. These may include the right to:

• Know what personal information we collect and how it is used;
• Request access to or a copy of your personal information;
• Request correction of inaccurate personal information;
• Request deletion of your personal information;
• Opt out of the sale or sharing of personal information (OpBench does not sell or share personal information for cross-context behavioral advertising);
• Not be discriminated against for exercising these rights.

How to exercise these rights:

Call Recipients should first contact the business/provider that used OpBench to place the call, as they are the party responsible for the underlying appointment relationship. If you're unable to reach them, you may contact us directly at contact@opbench.com and we will route your request or assist as required by law.

Business Users may contact us directly at contact@opbench.com.

We will verify your identity before fulfilling a request, as required by applicable law.

Data Retention Summary

Children's Privacy

OpBench's services are not directed to individuals under 18, and we do not knowingly collect personal information from children through our marketing website. [If appointment data uploaded by Business Users could relate to minor patients (e.g., pediatric clinics), address this directly — likely via the BAA/Business User's own compliance obligations rather than this policy, but flag for legal review.]

International Users

OpBench is designed for use by businesses operating in the United States, Canada, and the United Kingdom. [CONFIRM: Disclose GenAI Ventures' jurisdiction of incorporation here.] Data is processed and stored in the United States as described in the "Canadian Privacy Law" and "United Kingdom Privacy Law" sections above; this Policy does not currently address use by businesses outside the US, Canada, and UK (including the EU), and the Service should not be used in other jurisdictions until this Policy and applicable agreements are extended to cover them.

Changes to This Policy

We may update this policy from time to time. We will notify registered account holders by email of material changes at least 14 days before they take effect. The effective date at the top of this page reflects the most recent update.

Relationship to Terms of Service

This Privacy Policy is incorporated into our Terms of Service by reference. In the event of a conflict between the two regarding the handling of personal information or personal health information, this Privacy Policy controls — except that an executed BAA or Canadian provincial health information agreement takes precedence over both where applicable.

Contact

For privacy-related questions, data requests, or to request a Business Associate Agreement, Canadian provincial health information agreement, or UK Article 28 Data Processing Agreement, contact:

GenAI Ventures / OpBench contact@opbench.com www.opbench.com