Privacy Policy

Aleras, Inc.
Effective date: November 6, 2026
Last updated: November 6, 2026

Aleras, Inc. (“Aleras,” “we,” “our,” or “us”) provides technology that allows businesses to configure and operate artificial-intelligence voice agents and related communication workflows (the “Platform”). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through our website at aleras.ai, customer accounts, demonstrations, support, and related business activities, and describes our role when business customers use the Platform to communicate with callers.

Important distinction for patients and other callers: When an AI voice agent communicates with you for a clinic, imaging center, or other business, that business generally decides why the communication occurs and what information the agent processes. Aleras generally processes that information on the business's behalf. If protected health information (“PHI”) is involved, applicable HIPAA rules and a Business Associate Agreement (“BAA”) govern Aleras's use and disclosure of PHI. Aleras's Privacy Policy does not replace your healthcare provider's Notice of Privacy Practices or a legally required notice at the time of a call.

1. Scope and our role

This Policy applies to information handled through our public websites, sales and demo activities, customer and administrator accounts, support channels, and the Platform to the extent described below. It does not govern how an independent healthcare provider or other business decides to use information it collects for its own purposes, nor does it replace that business's notices or agreements.

When we act for ourselves. For information about website visitors, prospective customers, business contacts, our accounts, billing and subscriptions, and our own communications, Aleras ordinarily determines the purposes and means of processing and acts as a controller or business under applicable privacy laws.

When we act for a customer. For call content, customer contact lists, patient appointment information, connected records, call recordings if enabled, transcripts, and workflow results that a customer directs us to process, Aleras ordinarily acts as a processor, service provider, or HIPAA business associate, as applicable. Customer contracts, any executed Data Processing Agreement (“DPA”), a signed BAA where applicable, and Applicable Law govern that processing. We may also process limited related information independently where necessary for lawful security, fraud prevention, compliance, and business administration, subject to applicable restrictions.

For questions about why a clinic or other business called you, the accuracy of its records, its consent practices, or a patient-rights request, please contact that business first. We will assist it as required by law and applicable agreements.

2. Categories of information we may collect

The categories below describe information associated with the activities and features identified. A particular person or customer may not provide all categories.

A. Identifiers and business contact information. Names, workplace, professional title, business email, telephone number, business mailing address, usernames, user identifiers, account or organization identifiers, and contact details provided in forms or communications.

B. Account and commercial information. Plan information, service subscriptions, invoices, usage and transaction histories, billing contacts, payment status, customer-service history, and information needed to administer a commercial relationship. Payment for Aleras's own subscriptions may be handled by an external billing processor. This does not mean Aleras's voice agents collect credit-card numbers from customers' callers.

C. Internet and technical activity. Internet Protocol (IP) address, browser and device characteristics, operating system, referrer, pages visited, approximate location inferred from technical signals, app and API events, access logs, security events, diagnostics, error reports, and usage metrics.

D. Customer-provided business and integration data. Agent configuration, prompts, instructions, scripts, knowledge bases, documents, integrations, CRM or scheduling records, appointment details, user permissions, and other materials the customer chooses to connect to the Platform.

E. Call and communication information. Telephone numbers, call start and end times, duration, status, routing and transfer information, caller-provided responses, and, depending on the enabled workflow, live audio, transcriptions, call summaries, stored audio recordings, messages, consent records, and workflow outcomes. A call may be processed in real time even when a permanent audio recording is not enabled. The customer determines which legally permitted content the agent is instructed to collect.

F. Potentially sensitive information. With a separately approved and contracted healthcare deployment, customer-controlled call and workflow information may include names, dates of birth, clinical scheduling details, referrals, symptoms, and other PHI. The nature of data collected in a particular interaction is determined by the healthcare provider's authorized use case. Other sensitive personal data may be restricted under our Terms or require additional authorization.

G. Communications with Aleras. Demo requests, emails, support messages, feedback, customer-success conversations, marketing preferences, and any information voluntarily provided to our representatives.

H. Audio and biometric information. The Platform may process speech audio to recognize words, synthesize responses, and route conversations. Audio is not automatically a biometric identifier, but voice analysis or identification features can implicate additional privacy laws. Any biometric identification service, if made available, would be subject to separately disclosed conditions and any legally required permissions; this Policy does not authorize the collection of biometric voiceprints for an unapproved purpose.

3. How information reaches us

We receive information (a) directly from customers, visitors, users, and business contacts; (b) from callers and other participants interacting with customer-configured agents; (c) from customers' authorized CRM, calendar, telephone, healthcare, or other integrations; (d) automatically from websites and the Platform through security, usage, and diagnostic systems; and (e) from service providers acting on our behalf. We do not assume that customer-provided information is accurate and generally do not independently verify the content of their business records.

4. How we use information

Depending on its source, context, and our role, Aleras processes information to:

• provide voice-agent services and carry out customer-authorized instructions, such as answering or routing calls, processing speech, preparing transcripts or summaries, and interacting with approved systems;
• create, authenticate, administer, bill, and support customer accounts;
• deliver demos, answer inquiries, and communicate about our business services;
• detect abuse, prevent fraud or unlawful calling, maintain availability, troubleshoot incidents, and protect the Services and their users;
• comply with applicable legal obligations, enforce contracts, respond to lawful requests, and establish or defend legal claims; and
• use non-content operational and diagnostic metrics to maintain and improve reliability and performance, and use other information for improvement only as specifically authorized by agreement and law.

Customer call data and AI model training. We do not use identifiable Customer Data, caller content, recordings, transcripts, or PHI to train, retrain, or fine-tune any AI or machine-learning model, including models specific to Aleras, without a separate written authorization specifying the intended use and any further legal permission required. We require corresponding restrictions of providers acting as our subprocessors. Live processing by an AI model to provide an agent's response is different from training that model.

We do not treat participation in a customer-directed call as permission for Aleras to market unrelated products to the caller. Uses of PHI are further limited by the applicable BAA and HIPAA.

5. How information is disclosed

We may disclose appropriate information to the following categories of recipients only as relevant to the purposes above and subject to applicable contracts and laws:

• Infrastructure and service providers: hosting, storage, telecommunications carriers, voice and AI inference systems, speech recognition and synthesis, security monitoring, analytics, communications, support, and billing providers;
• Customer and authorized personnel: the customer operating the voice agent, its approved users, and systems to which it directs data;
• Customer-selected external integrations: systems connected by Customer under its own independent agreement or credentials, for which Customer determines permissions;
• Professional advisers: legal counsel, auditors, insurers, accountants, and other advisers under appropriate obligations;
• Business transactions: potential or completed financing, restructuring, merger, acquisition, or transfer of business assets with appropriate safeguards; and
• Legal and safety recipients: courts, regulators, law enforcement, or affected parties when required or permitted by law and appropriately necessary to protect legal rights, safety, and security.

We use written restrictions on confidentiality, security, permitted processing, and AI training where required by law or contract. Subprocessors processing customer-controlled data are subject to the applicable DPA or BAA, including any required prior notice, objection rights, and downstream business-associate terms. Customers may request the current list of applicable subprocessors by emailing privacy@aleras.ai. We do not authorize vendors to use PHI for their own advertising or model training contrary to the BAA or applicable law.

6. Selling, sharing, and advertising

Aleras does not sell personal information or share it for cross-context behavioral advertising within the meaning of the California Consumer Privacy Act, and does not use identifiable patient call information for advertising. If our practices change, we will update this Policy and provide any legally required notice, consent, opt-out methods, and recognition of applicable preference signals, such as Global Privacy Control, before engaging in the new practice. We do not use a disclosure in this Policy to waive a privacy right.

7. Cookies, analytics, Do Not Track, and preferences

Our website and Platform may use cookies and similar technologies for login, security, preferences, functional operation, and website measurement. We provide a consent or preference mechanism for nonessential technologies where law requires it. Browser settings can block some cookies, but essential features may not work as intended. Marketing messages include required unsubscribe options, and we may retain suppression records needed to honor opt-outs.

Do Not Track. Some browsers transmit a "Do Not Track" (DNT) signal. Our response to DNT signals is: our website does not currently respond to DNT signals, because there is no common industry standard for doing so. If we engage in a sale or sharing of personal information to which legally recognized opt-out preference signals, including Global Privacy Control, apply, we will honor qualifying signals as required by law.

Third-party cross-site tracking. Other parties may collect information about your use of our website through cookies and similar technologies. Our website uses Google Analytics, provided by Google, to measure visits; Google may collect information about your online activities over time and across different websites, including ours. You can use the Google Analytics opt-out browser add-on or your browser settings to limit this collection.

8. Retention and deletion

We retain information for periods reasonably necessary for the purposes described and subject to applicable law, customer instructions, contracts, secure backup cycles, and legitimate preservation obligations. The following identifies the criteria used to determine retention; service-configured periods are specified in the applicable customer contract and controls:

• Customer call audio and recordings, if enabled. Customer-selected settings and the applicable Order, DPA, and BAA; longer only when legally required or a lawful preservation hold applies. Live audio need not become a stored recording merely because it is processed during a call.
• Transcripts, messages, summaries, and other Customer Data. The service term, customer-directed retention choices, contractual export/deletion terms, and legal holds or statutory requirements.
• Customer-linked contacts and integrated records. While required for the authorized integration or workflow, followed by deletion or return under the contract, subject to lawful exceptions and backup schedules.
• Account and business contact records. During the relationship and afterward as reasonably necessary for dispute resolution, contract enforcement, required accounting or tax records, and applicable limitation periods.
• Technical, diagnostic, and security logs. While needed for system protection, investigation, troubleshooting, and compliance; periods depend on log type, incident status, and documented security practices.
• Calling consent, revocation, and other regulated records. As long as required by applicable communications and recordkeeping rules or reasonably necessary for lawful enforcement or defense; relevant telemarketing records may be subject to five-year requirements.
• Website or marketing preferences and suppression records. Until preferences are changed or no longer needed, with limited records maintained as needed to prevent renewed unwanted contact.
• Backup and recovery copies. Until overwritten or securely removed through documented recovery-media cycles, subject to lawful preservation duties.

If personal information is requested to be deleted, we will assess the request in light of our role. For customer-controlled call data, we ordinarily follow the instructions of the business customer and the applicable DPA or BAA. We may need to retain limited information where required by law, for security investigations, legal claims, necessary compliance records, or residual backups. We do not treat all categories of raw call audio as subject to the same retention period as telemarketing consent evidence.

9. Security and incident response

We use administrative, technical, and organizational safeguards appropriate to the processing Aleras is authorized to perform, including measures designed to restrict unauthorized access and support incident detection and response. Binding security commitments appear in applicable customer agreements, including the DPA and BAA. No telecommunications or internet service can be guaranteed perfectly secure. We assess suspected incidents and make reports to affected customers, regulators, or individuals as required by law and applicable contracts. The timetables and responsibilities for healthcare incidents are governed by applicable HIPAA rules and the executed BAA.

10. Patient information and HIPAA

In authorized healthcare deployments, Aleras processes patient information on behalf of the healthcare organization operating the agent. Information relating to an appointment, referral, symptoms, or another healthcare interaction may qualify as protected health information (PHI), even if the agent's task is administrative. Where Aleras acts as a business associate, its processing of PHI is governed by HIPAA and the executed BAA. The healthcare organization determines the underlying care purpose and remains responsible for its clinical decisions and Notice of Privacy Practices. Aleras does not independently use patient call content for advertising or general model training. Patients seeking access to or changes to their medical records should ordinarily contact their provider; Aleras will assist in accordance with law and contract. The availability of general Platform features does not mean every deployment is authorized for PHI.

11. Voice agents, transparency, and recording choices

An AI Agent may use synthetic speech to converse with a caller and process audio in real time. Depending on a customer's configuration, the Platform may generate transcripts, summaries, routing information, or retained recordings. The deploying business ordinarily decides the communication purpose and must make legally required disclosures, obtain required recording permissions, and offer applicable opt-outs or human assistance. Certain communications concerning patient clinical information may require a disclaimer at the beginning and end under California law; other laws may apply even when the interaction concerns scheduling. A website notice is not a substitute for consent or disclosure required during a call. For questions about a particular call, please contact the business you called or that contacted you; we assist with rights requests when required.

12. Privacy rights and how to exercise them

Depending on jurisdiction and applicability, individuals may have the right to access, know about, receive a copy of, correct, delete, or restrict specified information; object to certain processing; withdraw consent when applicable; opt out of sale, sharing, or targeted advertising; limit specified sensitive-data uses; or appeal a privacy-rights decision. Applicable exceptions, verification rules, and deadlines vary. We will not unlawfully discriminate against a person for exercising an applicable privacy right.

For information Aleras controls for its own business, send a request to privacy@aleras.ai. Please provide enough detail for us to identify the information and respond securely. We may verify identity proportionately and decline a request where legally permitted, explaining any applicable review or appeal rights. For information processed for an Aleras customer—including patient call information—please contact that customer directly in the first instance. If such a request reaches us, we will route or assist with it as law and contract require. Knowledge of another person's phone number alone does not authorize disclosure of that person's data.

13. California and other U.S. privacy notices

Where the California Consumer Privacy Act (CCPA) or similar state laws apply to Aleras's independent processing, the categories described in Section 2 may correspond to identifiers, personal records, commercial information, internet or other electronic activity, audio or electronic communications information, professional information, inferences if actually generated, and sensitive personal information if processed. Sections 3–8 describe principal sources, business purposes, recipient categories, and retention criteria. We provide additional notices at the point of collection where required. Individuals may have rights to access, correct, delete, limit certain uses of sensitive information, or opt out of sale/sharing, subject to conditions and exclusions. If our actual practices involve legally regulated targeted advertising or sale/sharing of personal information, we will provide required opt-out methods and honor applicable preference signals, including qualifying Global Privacy Control signals. Authorized-agent procedures and appeal rights will be made available where required.

14. International users and transfers

The Platform is intended primarily for business use. Personal information may be processed in the United States and in other locations where our verified providers or authorized personnel operate. If the EU/UK GDPR or comparable international laws apply, Aleras's lawful basis for processing information it controls may include contract performance, legal obligations, legitimate interests such as account security, or consent where required. When we process data on a customer's instructions, that customer generally determines the applicable legal basis for its purposes. We will use applicable transfer safeguards where required, including approved contractual mechanisms and supplementary measures as appropriate. We will provide any mandated local representative or data protection officer contact information if those requirements apply to our operations. International deployment or data-residency commitments are governed by the relevant Order/DPA and must not be presumed from this Policy.

15. Automated processing

The Platform is designed to allow customers to use AI in conversations, summaries, scheduling, and other configured workflows. Outputs are not necessarily accurate and can affect real people. Aleras generally does not determine the customer's purpose or appropriateness of automated decisions about patients, applicants, borrowers, or others. Customers must meet applicable notice, assessment, human review, and individual-rights requirements for their deployed use cases. If Aleras independently uses automated decision-making technology for a legally significant decision about an individual, we will provide any specific notice, rights, or opt-out required by Applicable Law.

16. Children

Our public website and business accounts are directed to business professionals, not to children. We do not intentionally solicit children to register for their own Aleras business accounts. A healthcare or other customer may have legitimate communications involving minors; those interactions are governed by the customer's legally authorized purpose and the applicable DPA/BAA and sector-specific requirements, including parental permissions where required. Customers must not enable a minor-focused or otherwise specially regulated deployment without the necessary permission and controls.

17. Other sites, customer systems, and changes

Links to independent third-party websites and customer-managed integrations are governed by those providers' own terms and notices where they act independently. We may update this Policy as our Services, data practices, and legal duties change. We will update the dates at the top and provide additional notice or seek consent where legally required. New wording does not retroactively authorize an otherwise unlawful or unauthorized use of previously collected information.

18. Contact

Aleras, Inc.
Privacy requests and questions: privacy@aleras.ai
Business mailing address: 2810 N Church St STE 89863, Wilmington, DE 19802
Website: aleras.ai

If your inquiry concerns records from an interaction with a healthcare provider or other customer, please identify that business (without sending unnecessary medical information by ordinary email) so that we can direct your inquiry appropriately.