How we handle your data.

The service is provided by R P PIKUL Ltd, trading as Pikul Agency and Pikul AI, a company registered in England and Wales under company number 10568899, with its registered office at Ealing Cross, 1st Floor, 85 Uxbridge Road, London W5 5TH. We are registered with the Information Commissioner’s Office, reference ZC192233. Data protection contact: info@pikul.agency.

What the service does with data

Pikul Front Desk is an AI receptionist. It answers your business’s enquiries over WhatsApp, email, Instagram, Messenger, web chat, SMS and Telegram, qualifies them and books appointments. It answers only from information you approve, collects the minimum needed to book (name, contact details, enquiry topic), and hands anything sensitive or uncertain to your team.

Administrative use only. For healthcare clients it is configured not to discuss conditions or symptoms: it books the appointment and leaves the medicine to your clinicians.

Who owns the data

You do, 100%. You are the data controller; Pikul Agency acts as your processor, and our platform providers as sub-processors, under our written Data Processing Agreement, which forms part of every service agreement. On exit, your data is returned to you or deleted, at your choice, within 30 days, and cleared from the platform’s backups within 90 days.

Where data lives

• Platform data (contacts, conversations, appointments) is hosted primarily in the European Union. The data-processing agreement lists every sub-processor and where it processes data.
• AI processing and message transport run through our AI providers and the carriers for the channels you connect, under approved transfer safeguards and terms that prohibit training on your data.
• The full sub-processor list, with purposes, locations and transfer mechanisms, is Annex A of the Data Processing Agreement and is provided on request, together with a transfer risk assessment.

Security measures

• Access to client data is restricted to named individuals, with two-step sign-in on every system and least-privilege permissions. Data is encrypted in transit.
• Your data is never used to train AI models, ours or anyone else’s. The assistant answers only from the knowledge base you approve.
• If an answer is ever wrong, we correct the approved information and review the conversation with you.
• You own your domain, website and content, and everything is documented as we go, so your own team or any supplier you choose can take it over at any time.
• Breach notification: we alert you without undue delay once we become aware, then give you the information you need for your own notification duties, with updates as they become available.
• Our technical and organisational security measures are written down and available on request. You own your data throughout, and wherever possible your channels, numbers, domains and accounts are set up in your own name.

Compliance posture

• Built for UK GDPR: controller and processor roles set out in a written Article 28 agreement, with data subject requests forwarded to you without undue delay.
• Patient enquiries are treated as sensitive by design, and as special category data under UK GDPR where a message discloses health information: minimum collection, no symptom probing, immediate handover to your team, and transcripts handled as enquiry data, not clinical records.
• New sub-processors are notified to you in advance with a right to object, and audits and inspections are supported, as set out in the Data Processing Agreement.
• Outbound built with PECR in mind: the assistant sends service messages (confirmations, reminders); marketing goes out only with consent or soft opt-in.
• Data retention follows your policy: the system is configured to your retention periods, not ours.

For hospitals and regulated providers

Hospitals and hospital groups have their own governance to satisfy before a patient goes near the service. This is what comes with a hospital engagement, and when.

• Input for your own clinical safety review, before a patient uses the service.
• Input to your DPIA, prepared with your DPO before go-live.
• Article 28 processor terms, with the full sub-processor list and a transfer risk assessment.
• Conversation records hosted primarily in the EU. Message content is processed only to deliver the service, never to train a model, and anything a patient volunteers about their health is routed to your team as an enquiry record, not acted on.
• Built never to give clinical advice. Anything clinical, urgent or sensitive goes to a person, and the patient is told what to do in the meantime.
• On websites we build, a surgeon on our advisory board advises on clinical content, and your own clinicians sign off every treatment page before it goes live.

Several sites, one Pikul Front Desk

One Pikul Front Desk can answer for every location. Each site has its own knowledge, diary and handover contacts, and your team sees every conversation in one inbox. Multi-site access, routing and reporting are scoped individually and confirmed in your written quote.

Urgent and clinical handovers go to the roles and hours your team sets, with a second recipient and a holding message for the patient agreed before go-live. The rota, the acknowledgement rule and what happens during an outage are written into your service specification.

Insurance and documents

Professional indemnity and cyber insurance are in place, and certificates are available on request. Our written policies and our providers’ security summaries are available on request. If your governance requires a deployment-scoped external security test, we can commission one as part of your project.

Questions

Email info@pikul.agency. You will get answers in writing, and anything we can’t do, we will say so.

Request the DPA and security pack