The questions your governance colleagues will ask, answered first.
Clinical safety, information governance and equality of access are not a compliance exercise bolted on at the end. They decided how CliniCall was built.
An operational tool, not a medical device.
This is a deliberate boundary, not a legal convenience. CliniCall exists to manage appointments: to confirm them, move them, and offer freed slots to other patients. It does not triage, diagnose, advise on symptoms, or make any clinical decision.
The clinical judgement about who should be seen, how soon, and by whom stays entirely with your service. CliniCall carries out that judgement as configured rules — it never forms one.
This holds for inbound calls too. Front Door takes the details a receptionist would take and hands the caller to a clinician as a structured summary. The clinician triages; CliniCall does not. It then calls the patient back with whatever the clinician decided.
Give clinical advice · assess symptoms · triage · prioritise patients on clinical grounds of its own · move an appointment without the patient agreeing · continue a conversation that has become clinical · make a decision your rules do not allow · write to your systems without that write being explicitly enabled and logged.
Safe by construction, and provable afterwards.
Safety in an appointment system is mostly about what the system refuses to do on its own, and about whether you can reconstruct what happened.
Your rules, enforced
Which appointment types may be moved, which must never be moved automatically, who is offered a freed slot first, and how urgency and vulnerability are handled — all configured by your clinical team and applied consistently.
Escalation before error
Distress, confusion, a clinical question, an unexpected answer or an unclear outcome all end the automation and route to a person with full context, rather than to a best guess.
Clinical risk management
We work through clinical risk management with your clinical safety officer as part of deployment, including hazard identification, mitigations and a safety case appropriate to an administrative system.
Safe mode by default
A new deployment starts with calls requiring manual approval. Automation is widened deliberately, at your pace, once your team has watched it work.
Complete audit trail
Every contact attempt, patient response, rule applied, override taken and write-back made is timestamped, retained and exportable. If a patient asks what happened, you can answer.
Contained blast radius
Configurable calling windows, per-patient contact limits and a cap on simultaneous calls. Any campaign can be paused instantly by your team.
The minimum data, held in the right place, for the right time.
- Lawful basis and DPIA
- Deployments are grounded in a data protection impact assessment agreed with your IG team before any patient is contacted, with your organisation as data controller and D Analytics as processor under a written agreement.
- Data minimisation
- We take what is needed to manage an appointment: identifier, name, contact details, consent and communication preferences, and the appointment itself. No clinical record content, no diagnoses, no notes.
- No identifiers in links
- Secure links sent to patients carry no patient-identifiable information and expire. A forwarded message does not expose a patient record.
- Hosting and residency
- UK-hosted by default, with deployment inside your own infrastructure available where your governance requires it.
- Model training
- Patient data is not used to train general-purpose models. Conversation behaviour is changed through versioned configuration that you can inspect.
- Retention
- Retention periods are set with you, defaulting to the shortest period that supports operational audit, with deletion on request and at contract end.
- Call recording
- Off unless there is a confirmed legal and policy basis agreed with your organisation. It is never assumed.
- Assurance
- We work through DTAC, your local security assurance and the relevant data security toolkits with your team as part of onboarding, at the point in the process where they belong.
How the platform is actually built.
Statements of fact about the system, not certifications. Where we hold an accreditation we will name it; where we do not, we say so rather than implying one.
- Encryption in transit
- All traffic between patients, the platform, and your systems is encrypted with TLS. No patient data crosses a network in the clear.
- Encryption at rest
- Databases and backups are encrypted at rest, and backups are held in the same jurisdiction as the live data.
- Access control
- Role-based access for your staff, individual named accounts rather than shared logins, and least-privilege access for our own team — granted for a purpose and removed afterwards.
- Secrets and credentials
- Integration credentials are held server-side only and are never exposed to a browser. They are rotatable, and rotating them does not require a redeployment.
- Separation
- Each deployment is logically separated, with its own configuration and its own data. A production clinical instance does not share infrastructure with demonstration environments.
- Audit
- Every contact attempt, patient response, rule applied, override and write-back is logged with a timestamp, retained for the agreed period, and exportable.
- Independent testing
- Penetration testing is arranged ahead of any deployment that requires it, with the report and the remediation shared with your security team.
- Assurance
- We complete DTAC, your local security assurance and the relevant data security toolkits with your team as part of onboarding, and will answer any security questionnaire you use.
The patients hardest to reach are the point.
Digital-first appointment tools tend to work best for the patients who were least likely to miss an appointment anyway. That is the wrong end of the problem.
CliniCall leads with voice because voice reaches people that apps and portals do not: older patients, patients without smartphones, patients with low digital confidence, and patients who simply do not open messages from unknown numbers.
- Existing channels continue. Letters and current processes are not switched off.
- Opt-out respected. A patient who does not want automated contact is contacted the way they always were.
- Not tied to English. The conversation layer supports other languages where a service needs it.
- Always a person available. Asking for a human ends the automation immediately.
Patients are told at the start of the conversation that they are speaking with an automated appointment service from their clinic, in plain language, and can ask for a person at any point. We do not think a service should have to guess.
Patient-facing wording is agreed with your communications and IG teams before anything goes out.
What services ask us first.
Is CliniCall a medical device?
No. CliniCall is an operational and administrative tool for scheduling and patient communication. It is not a clinical or diagnostic medical device, it does not offer clinical advice, and it never makes clinical decisions. Where a conversation moves towards anything clinical, it stops and hands over to a person.
Does Front Door triage patients?
No, and it is designed so that it cannot. Front Door answers the practice phone and captures the information needed to book an appointment — the same details a receptionist would take. Each caller is then presented to a clinician as a structured summary, and the clinician decides who is seen and when. CliniCall makes no clinical judgement at any point. Once the clinician has decided, the platform calls the patient back to tell them their appointment.
Is patient data safe?
Deployments are grounded in consent and a data protection impact assessment from day one. Secure links carry no patient-identifiable information, data is handled in line with UK GDPR and NHS data standards, and we collect the minimum needed to manage an appointment — no clinical record content.
Is patient data used to train AI models?
No. Patient data from a deployment is not used to train or improve general-purpose models. Any change to how conversations are handled is made through versioned configuration that your team can see, not by learning from your patients.
Will it integrate with our existing systems?
CliniCall is designed to read and write directly to NHS scheduling systems, and we are in discussion with established NHS systems providers. Integration is scoped with you during the pilot, and a pilot can start on a controlled export and write-back path while that work is done.
Does it replace our reception team?
No. CliniCall takes the repetitive reminder, chasing and rebooking calls off your team so they can deal with the patients in front of them. Any conversation can hand off to a person, and your team keeps full visibility and override at every step.
What happens if the AI gets it wrong?
The system is built to fail towards a human rather than towards a wrong answer. Unclear outcomes are recorded as unclear and routed to staff, conversations outside the configured rules are escalated, and every contact, decision and write-back is logged and exportable for audit.
What about patients who are digitally excluded?
CliniCall is deliberately not digital-first. Voice calling is a first-class channel precisely because it reaches patients that app-and-portal approaches do not, existing letters and channels continue unchanged, and patients can opt out and still be contacted the way they always were.
Do patients know they are speaking to an automated service?
Yes. Patients are told, in plain language, at the start of the conversation, and can ask for a person at any point.
How quickly can we start, and what does it cost?
Setup typically takes days rather than months. We run free pilots with a small number of selected services, with no long-term commitment, so you can measure the impact before you invest.
Bring your IG colleagues to the first call.
We would rather answer the hard governance questions at the start than discover them at the end. Send the questions ahead and we will come prepared.