Privacy policy
This page explains what personal data Tilcao handles, why, who else processes it, and how to have it deleted. There are two cases. When you visit this website or try the demo, Tilcao decides what happens to your data. When you call or message a dental practice that uses Tilcao, the practice decides, and Tilcao works for it under a written agreement.
Tilcao is the operating system for dental practices in Belgium: its AI receptionist answers patient calls and WhatsApp messages in Dutch, French and English, and books, moves and cancels appointments in the practice’s own software.
Last updated
Who is responsible for your data?
For this website and its demo, Tilcao is the controller. You can reach us at privacy@tilcao.com.
For calls, WhatsApp messages and chats with a dental practice that uses Tilcao, the practice is the controller and Tilcao is its processor under Article 28 of the GDPR. Tilcao only acts on the practice’s instructions. Questions about that data go to the practice first. You can also write to us and we pass them on.
What do we collect on this website?
Only what the site needs to work and to answer you. We do not sell it and we do not use it for advertising.
The legal basis is our legitimate interest in running and improving the site (Article 6(1)(f) GDPR). For a demo booking or an email, it is the steps you asked for before a possible contract (Article 6(1)(b)).
- Pages visited, counted with PostHog. Nothing is stored on your device, no cookie is set and no profile of you is built.
- What you type or say in the demo: the text, and for a voice demo the audio and its transcript. The demo practice is fictional, so please do not share real health details there.
- If you book a demo: your name, email address and anything you add, through Calendly.
- If you write to us: your email address and your message.
What do we handle for a dental practice?
When you call, message on WhatsApp or chat with a practice that uses Tilcao, we handle what is needed to answer you and manage your appointment, on the practice’s instructions.
Every caller hears in the first sentence that they are speaking to an AI and that the call is recorded. Tilcao never reads or writes your clinical record.
- Your phone number or WhatsApp number.
- Your name and date of birth, to find your file.
- Your appointment: type, practitioner, date and time.
- What you said the visit is about, in your own words.
- The call recording or the messages, and their transcript.
- A short summary of what was asked and what was done.
How do we use WhatsApp messages?
Messages you send to a practice on WhatsApp reach Tilcao through Meta’s WhatsApp Business Platform. We use them only to reply to you and to handle your appointment, on the practice’s behalf.
We do not use them for advertising, we do not sell them and we do not share them beyond the providers listed below. A practice only writes to you first, for example with a reminder, if you agreed to it.
Who else processes the data?
A small number of providers do part of the work, each under a data processing agreement. Our servers and database run in the EU: Google Cloud in Belgium and Supabase in Ireland.
Several providers are based in the United States, so data can be processed there. Those transfers rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.
| Provider | What it does |
|---|---|
| Google Cloud | Runs the Tilcao service, in Belgium |
| Supabase | The database, in Ireland |
| Retell AI | Phone and voice calls: speech recognition and the voice |
| Anthropic | The language model that writes the replies |
| Meta | WhatsApp messages |
| Twilio | Phone numbers and call routing |
| Vercel | Hosts this website |
| PostHog | Counts website visits, without cookies |
| Calendly | Demo bookings |
| Google Workspace |
How long do we keep it?
No longer than the purpose it was collected for needs.
- Demo conversations: while we need them to improve the demo. You can ask us to delete yours at any time.
- Demo bookings and emails: while we are in touch about them.
- Patient conversations: the periods agreed with the practice and written into its processing agreement. The recording is the first thing deleted.
- Website visits: counted without being linked to you.
What are your rights?
You can ask for access to your data, correction, deletion, restriction or a copy in a portable format, and you can object to its use. Write to privacy@tilcao.com and we answer within one month.
For data we handle for a practice, the practice answers as controller, and we help it do so within that month.
You can also complain to the Belgian data protection authority, the Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels.
How do I have my data deleted?
Email privacy@tilcao.com with the subject “Delete my data”. Tell us the phone number, WhatsApp number or email address you used, and roughly when.
We delete the recordings, messages, transcripts and summaries Tilcao holds within one month and confirm by email. If you spoke to a practice, we tell the practice and delete on its instruction. Records the practice must keep by law, such as your clinical file, live in its own systems and are not affected.
Messages in your own WhatsApp app stay on your phone. You can delete that chat yourself in WhatsApp.
How is it protected?
Data travels encrypted. Only the people who need it to run the service can access it, each bound by confidentiality, and every read of patient data is logged. The security and GDPR page has the detail.
Changes to this policy
When this policy changes, the date at the top of the page changes with it.