RESOURCES
Security and data handling
RecallQ keeps its main patient database in Sydney, Australia. Its application servers run in Singapore and handle patient information in transit only. Named sub-processors handle specific tasks, and some operate overseas. This page summarises RecallQ's Privacy Policy, Data Processing Agreement and sub-processor list.
By the RecallQ team. Updated 30 September 2026.
Where data is handled
The main patient database is hosted by Supabase in Sydney, Australia. Some sub-processors operate overseas, in Singapore, the European Union and the United States. The live list is at https://www.recallq.com.au/legal/#sub-processors.
Sub-processors and what each receives
| Provider | What it receives | Location |
|---|---|---|
| Supabase | Database, authentication and file storage. All patient and practice data. | Australia (Sydney) |
| ClickSend | SMS delivery and inbound replies. Patient mobile numbers, SMS content and delivery receipts. | Australia |
| Resend | Recall emails to patients (email address and message content, where email sending is enabled for a practice); account emails to practices; delivery, bounce and complaint notifications; and, when RecallQ has the staff digest switched on for the service, a digest of patient replies that need attention, sent to the practice's nominated contact address (patient first and last name, the reason, a link and, for a matched patient, a reply excerpt of up to 300 characters). | United States (overseas) |
| Anthropic | Pro plan AI only. See the next section. | United States (overseas) |
| OpenAI | Backup SMS reply classification if Anthropic is unavailable (Pro plan). Shortened reply text only; no patient name, phone number or practice identity. | United States (overseas) |
| Stripe | Billing (no patient data). Practice billing contact and payment details. | United States (Stripe Australia entity; overseas) |
| Vercel | Website and portal hosting. The portal handles patient data on screen for logged-in practice staff. It can also use cookieless analytics (no patient data stored), off unless RecallQ switches it on. | United States (Sydney edge; overseas company) |
| Railway | Application servers: patient data in transit only, never stored. | Singapore (overseas) |
| Sentry | Error monitoring. Patient information is scrubbed from error reports before they are sent. | European Union (overseas) |
| Google Workspace | RecallQ's own mailboxes (contact@, privacy@, unsubscribe@). Whatever a sender includes in an email to us, including a patient's own email address on an emailed unsubscribe request. | United States or other countries (overseas) |
What is and is not sent to AI providers
AI features are on the Pro plan only, and only where enabled. There are four uses:
- Understanding a reply: the reply text, shortened to 500 characters, and whether the original message was a recall or an appointment reminder. No patient name, phone number or practice identity is attached.
- Wording recall SMS messages (never email): the practice name, days overdue and the start of the practice's own template. No patient details.
- Summarising the ROI report: the practice's overall totals only.
- Answering simple FAQ questions, only where a Pro practice turns it on and has written a FAQ: up to the last four messages with that patient (each shortened to 500 characters, with email addresses and long numbers removed), the practice's FAQ text and booking link, the practice name, today's date, and a short line of context (recall or reminder, days overdue, whether the patient has confirmed, cancelled or rescheduled, and the turn number).
Patient names, phone numbers and dates of birth are never attached, though a message may contain whatever the patient typed. AI never opts a patient out.
How long records are kept
From the Privacy Policy and the code:
- Message content (reminder and reply text) is purged once the message is more than 90 days old and, for outgoing messages, has reached a final state. Timestamps, status and an integrity hash are kept.
- Audit records are kept for 7 years, then deleted, and contain no patient names or contact details.
- Resolved operational error records are deleted after 90 days.
- Unconfirmed sign-ups are deleted after 72 hours, and checkout records after 12 months.
- Email unsubscribe links stay valid for 12 months, and an unsubscribe is honoured even after a link expires.
- Patient records are kept while the patient is active with the practice. The Data Processing Agreement adds a 30-day export window after a subscription ends and deletion within 60 days, (audit records and billing records RecallQ must keep by law are excepted). RecallQ carries out both on request.
Access controls and safeguards
The Privacy Policy and Data Processing Agreement describe:
- Tenant isolation, so each practice can access only its own data, enforced at the database level.
- Encryption in transit (TLS) and, through the database host, at rest.
- Authentication controls, including a minimum password length.
- Removal of personal information from logs and error reports before they leave RecallQ's systems.
- Internal access controls and least-privilege practices. The Data Processing Agreement adds that only people who need access have it, and they are bound by confidentiality obligations.
- Breach notice: RecallQ will notify a practice without undue delay, and within 72 hours of confirming that an incident affects its data.
The legal pages do not state any security certification or independent audit, and none is claimed here. The Privacy Policy notes that no system is completely secure.
The consent record kept at import
When a practice imports patients, it must tick a confirmation that it holds, or is entitled to rely on, each listed patient's consent. Before any patient is added, RecallQ writes a record of who confirmed it (the signed-in user), when (server time), which wording (a version and a SHA-256 fingerprint of the exact text) and, for the file upload itself, which file (a fingerprint of the upload).
The record holds no patient details and no copy of the file. Ordinary database roles cannot edit or delete it (apart from the 7-year purge), but it is not tamper-proof against someone with administrator access. It is evidence that the tick happened and changes no patient's consent or opt-out status.
Contact
Email privacy@recallq.com.au for privacy, data-processing and security enquiries, and to report a security incident. Patients who want to access, correct or delete their information should contact their own practice first.
Common questions
Where is patient data stored?
The main patient database is hosted in Sydney, Australia. Application servers run in Singapore and handle patient information in transit only. Some sub-processors operate overseas.
What does RecallQ send to AI providers?
On the Pro plan, where AI features are enabled, shortened reply text (up to 500 characters) is sent to classify a patient's SMS reply. Where a practice turns on AI replies, up to the last four messages with that patient (shortened, with email addresses and long numbers removed), today's date and a short line of recall context are also sent. Patient names, phone numbers and dates of birth are never attached.
How long does RecallQ keep message content?
Message content is purged once the message is more than 90 days old and, for outgoing messages, has reached a final state.
Does RecallQ hold any security certifications?
The Privacy Policy and Data Processing Agreement do not state any security certification or independent audit, so none is claimed here.
Ready to see this run on your patient data?
Your real patient list. Create an account without a card; recall messages start once you choose a plan and add payment details at checkout.