How we handle your data.

The service is provided by R P PIKUL Ltd, trading as Pikul Agency and Pikul AI, a company registered in England and Wales under company number 10568899, with its registered office at Ealing Cross, 1st Floor, 85 Uxbridge Road, London W5 5TH. We are registered with the Information Commissioner’s Office, reference ZC192233. Data protection contact: info@pikul.agency.

What the service does with data

Pikul Front Desk is an AI receptionist. It answers your business’s enquiries over WhatsApp, Instagram, Messenger, web chat, SMS, email (in beta) and Telegram, qualifies them and books appointments. It answers only from information you approve, collects the minimum needed to book (name, contact details, enquiry topic), and hands anything sensitive or uncertain to your team.

Administrative use only. For healthcare clients it is configured not to discuss conditions or symptoms: it books the appointment and leaves the medicine to your clinicians.

Who owns the data

You do, 100%. You are the data controller; Pikul Agency and our platform providers act strictly as processors under our written Data Processing Agreement, which forms part of every service agreement. On exit, your data is returned to you or deleted, at your choice, within 30 days, and cleared from the platform’s backups within 90 days.

Where data lives

• Platform data (contacts, conversations, appointments) is hosted primarily in the European Union. The data-processing agreement lists every sub-processor and where it processes data.
• AI processing (generating replies, transcribing and translating voice notes, reading images and matching questions to your approved answers) is carried out by our AI providers and may take place outside the UK, principally in the United States and the European Union. Each transfer relies on the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses or, where the provider is certified, the UK Extension to the EU-US Data Privacy Framework. The providers are engaged under terms that prohibit training on your data.
• Message transport runs through the channel and telephony carriers for the channels you connect, in the EU and US under the same safeguards.
• The full sub-processor list, with purposes, locations and transfer mechanisms, is Annex A of the Data Processing Agreement and is provided on request, together with a transfer risk assessment.

Security measures

• Access to client data is restricted to named individuals, with multi-factor authentication on our accounts and least-privilege permissions.
• Your data is never used to train public AI models. The assistant answers only from the knowledge base you approve.
• Breach notification: we alert you without undue delay once we become aware, then give you the information you need for your own notification duties, with updates as they become available.
• Our technical and organisational security measures are written down and available on request. You own your data throughout, and wherever possible your channels, numbers, domains and accounts are set up in your own name.

Compliance posture

• Built for UK GDPR: controller and processor roles set out in a written Article 28 agreement, with data subject requests forwarded to you without undue delay.
• Health-adjacent enquiries are treated as sensitive by design: minimum collection, no symptom probing, immediate handover to your team, and transcripts handled as enquiry data, not clinical records.
• Outbound built with PECR in mind: the assistant sends service messages (confirmations, reminders); marketing goes out only with consent or soft opt-in.
• Data retention follows your policy: the system is configured to your retention periods, not ours.

For hospitals and regulated providers

Hospitals and hospital groups have their own governance to satisfy before a patient goes near the service. This is what comes with a hospital engagement, and when.

• Support for your clinical safety officer: hazard-log input for their DCB0160 assessment, before a patient uses the service.
• Input to your DPIA, prepared with your DPO before go-live.
• Article 28 processor terms, with the full sub-processor list and a transfer risk assessment covering every step that runs outside the UK.
• Conversation records hosted primarily in the EU. Message content is processed outside the UK only to deliver the service, never to train a model, and anything a patient volunteers about their health is routed to your team as an enquiry record, not acted on.
• Built never to give clinical advice. Anything clinical, urgent or sensitive goes to a person, and the patient is told what to do in the meantime.

Several sites, one Pikul Front Desk

One Pikul Front Desk can answer for every location. Each site has its own knowledge, diary and handover contacts, and your team sees every conversation in one inbox. Multi-site access, routing and reporting are scoped individually and confirmed in your written quote.

Certifications, stated plainly

We are a specialist boutique, not a 200-person vendor, and we would rather tell you exactly what is and isn’t certified than have you find out in an audit. Neither Pikul nor the platform currently holds ISO 27001 or SOC 2 certification. Our written policies and the platform operator’s security documentation are available on request. If your governance requires a deployment-scoped external security test, we can commission one as part of your project.

Questions

Email info@pikul.agency. You will get answers in writing, and anything we can’t do, we will say so.

Request the DPA and security pack