Privacy Policy

Last updated 1 November 2026

Who we are

Matilda is an AI telephone receptionist service operated by Apex Systems Global (sole trader, Brisbane QLD), “we”. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Contact: apex.systems.global@gmail.com.

Two groups of people

• Practices that sign up to Matilda (the “practice”).
• Callers who ring a practice and speak to Matilda.

For a caller, the practice is the organisation they are dealing with. We handle caller information on the practice’s behalf to provide the service, and only for that purpose.

What we collect

From practices: practice name, address, opening hours, services, price estimates, a contact name, phone number and email address, and the email address for call summaries.

From callers: a recording and transcript of the call, the caller’s phone number, and whatever the caller tells Matilda, typically name, reason for calling, how urgent it is, and preferred times. Callers may mention health information (for example a sore tooth). That is sensitive information under the Privacy Act. Matilda only asks for what is needed to arrange a callback, and she does not give health advice.

Call recording and AI notice

Every call starts with Matilda saying she is an AI assistant and that the call may be recorded for quality and training purposes. A caller who does not want to be recorded can say so or end the call and ring the practice another way. Laws on recording conversations vary by state and territory; the opening notice is how callers are told and given the chance to object.

Why we use it

• To answer the call and send the practice a summary so they can call the patient back.
• To run, secure and improve the service (for example checking that Matilda behaved correctly).
• To contact practices about their account.

We do not sell personal information and do not use caller information for marketing.

Who we share it with, including overseas (APP 8)

We use service providers to run Matilda. They may store or process information outside Australia, including in the United States and Europe:

• Vapi (voice platform: call handling, recording, transcripts), United States
• Twilio (telephony and phone numbers), United States
• OpenAI (language model that understands the call and decides what to say), United States
• Deepgram (speech-to-text), United States
• Microsoft Azure (text-to-speech, Matilda’s voice)
• Netlify (website, sign-up and contact forms and the service that processes call summaries), United States
• Brevo (sends the summary email to the practice), European Union

We take reasonable steps to make sure these providers handle information consistently with the APPs, including using providers with published security and privacy terms. We share a caller’s information with the practice they rang, and we disclose information otherwise only if the law requires or the person agrees.

How long we keep it

Call recordings and transcripts are stored by our voice provider and automatically deleted within 14 days. A clinic can ask us to delete them sooner. The practice may also keep the summary emails under its own record-keeping duties.

Security

Access is limited to what is needed to run the service, accounts use access keys kept out of public code, and data travels over encrypted connections. No system is perfectly secure. If a data breach is likely to cause serious harm we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.

Automated decision-making

Matilda is an AI that decides how to respond during a call and flags how urgent a call seems. She does not make decisions that significantly affect a person’s rights or access to care. A person at the practice reviews each call summary and follows up.

Marketing and the Spam Act

We send marketing emails only to people who have ticked the optional opt-in box (or otherwise clearly agreed). Every such email identifies us and has an unsubscribe link, and we action unsubscribes within 5 business days. Service emails about a practice’s account are not marketing.

Access, correction and complaints

Callers and practices can ask to see or correct the information we hold, or ask us to delete it, by writing to apex.systems.global@gmail.com. For a call, tell us the number you rang from and roughly when, so we can find it; we may refer you to the practice. We aim to reply within 30 days. If you are unhappy with how we handled a privacy matter, contact us first. You can then complain to the OAIC at oaic.gov.au.

Cookies and website

This site does not use advertising or analytics cookies. Our hosting provider keeps standard server logs. The browser demo loads a script from esm.sh only when you start the demo, and then connects to Vapi.

Changes

We will update this page when our practices change and show the date at the top.