Privacy Policy
How Sada collects, stores and processes business and client information.
Last updated 10 August 2026
1. Who we are
Sada is a product operated by Sada AI Limited, a company registered in England and Wales (company number 17391979), with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom.
For any privacy questions or to exercise your rights, contact us at hello@trysada.ai.
2. The two different roles we play, please read this first
This policy covers two distinct situations, and your rights differ depending on which applies to you.
Where we are the data controller. When you visit our website, enquire about Sada, or sign up as a customer, we decide how and why your data is used. This policy governs that relationship in full.
Where we are a data processor. When one of our customers (a dental practice, clinic, or other business) uses Sada to contact their own leads and patients, that business is the data controller. They decide who is contacted and why. We process that data strictly on their documented instructions, under a written data processing agreement.
If you have been contacted by Sada on behalf of a business, that business, not us, is the controller of your data. You should direct requests about your personal data to them in the first instance, though we will assist them in responding, and you can always contact us at hello@trysada.ai if you are unable to reach them.
3. Data we process as a controller
| Category | Examples | Lawful basis |
|---|---|---|
| Account data | Name, business email, phone, job role, company details | Contract performance |
| Billing data | Billing address, VAT number, payment records (card details are handled by Stripe, we never see or store them) | Contract performance; legal obligation |
| Usage data | Logins, feature use, support tickets, error logs | Legitimate interests, operating and improving the service |
| Marketing data | Enquiry details, marketing preferences | Consent; legitimate interests for existing customers |
| Website data | IP address, browser type, pages visited, cookie data | Consent for non-essential cookies; legitimate interests for essential |
4. Data we process as a processor, on behalf of our customers
When a customer uses Sada, we process the following on their instructions:
- Lead and patient contact details: name, phone number, email address, postal address, date of birth
- Enquiry data: the treatment or service enquired about, the marketing channel or campaign it came from, the date of enquiry
- Call recordings and transcripts: audio recordings of calls made by our AI agent, and written transcripts of those calls
- Message history: WhatsApp and SMS messages sent and received
- Appointment data: booking times, practitioner, treatment, appointment status
- Payment records: deposit amounts, payment status and references (card details are handled by Stripe directly and never reach our systems)
- Health-related information: including the treatment a person has enquired about or booked, and anything they disclose during a call
Special category data. Information about dental or medical treatment is health data, which is special category data under UK GDPR and requires additional protection. We process it only on the documented instructions of our customer, who is responsible for establishing an appropriate lawful basis and Article 9 condition for processing. We apply access controls, encryption, and tenant isolation designed to protect this data, and we do not use it to train AI models.
5. Call recording
Calls made through Sada may be recorded and transcribed for quality assurance, staff training, dispute resolution, and to create an accurate record of what was agreed.
Our AI agent discloses at the start of each call that the call may be recorded. Our customers are responsible for ensuring that recording is lawful in their circumstances, that appropriate notice is given, and that recordings are handled in line with their own privacy notice.
If you do not wish to be recorded, you may say so during the call or ask to be contacted by another method, and we will pass this to the practice.
6. Automated calling and AI
Calls made through Sada are made by an artificial intelligence voice agent, not a human. The agent identifies itself as an AI assistant at the start of every call.
The AI does not make decisions that produce legal or similarly significant effects about you without human involvement. It books appointments and answers general questions; it does not diagnose, does not give medical or clinical advice, and does not decide whether you are suitable for any treatment. Clinical decisions are always made by a qualified professional at the practice.
If you would prefer to speak to a human, tell the agent and it will arrange for the practice to contact you directly.
7. Marketing calls and messages, your right to object
If you have been contacted by Sada on behalf of a business, that business is responsible for having a lawful basis to contact you, including any consent required under the Privacy and Electronic Communications Regulations (PECR).
You can opt out at any time. Tell the agent during a call, reply to any message asking to stop, or contact the practice directly. Opt-outs are recorded on a suppression list and applied immediately. You will not be contacted again through Sada by that business.
We also honour the Telephone Preference Service (TPS) and Corporate TPS registers as required by law.
8. Who we share data with
We use a small number of carefully selected service providers to deliver Sada. Each is bound by contractual terms requiring appropriate security, confidentiality, and compliance with data protection law, and each processes data only on our instructions.
These providers fall into the following categories:
- Cloud hosting and database providers, storing application and customer data
- Voice and telephony providers, placing and receiving calls, and delivering WhatsApp and SMS messages
- Speech and language processing providers, converting speech to text, generating speech, and powering the AI assistant's conversational ability
- Payment providers, processing deposits and subscription billing
- Email delivery providers, sending confirmations, receipts, and notifications
- Analytics and advertising data providers, retrieving campaign performance data on behalf of our customers
- Professional advisers, such as accountants and legal advisers, where necessary
Customers: a complete, named list of our sub-processors is provided as part of our data processing agreement, and is available to customers and prospective customers on request. We will give reasonable notice before adding or replacing a sub-processor.
Anyone else: if you would like to know which specific providers process your personal data, contact us at hello@trysada.ai and we will tell you.
We may also disclose data where required by law, to establish or defend legal claims, or to a buyer in connection with a sale or restructuring of our business.
We do not sell personal data, and we do not use customer or patient data to train AI models.
9. Where your data is held, and international transfers
Our primary data storage, including our application database and our own copies of call recordings and transcripts, is hosted in the European Union, in Ireland. The United Kingdom recognises the EU as providing an adequate level of protection, so this transfer does not require additional safeguards.
Some of our other service providers are based outside the UK and the EU. Where personal data is transferred to them, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, and we carry out transfer risk assessments where required.
You can request more information about the safeguards in place by contacting hello@trysada.ai.
10. How long we keep data
| Data | Retention |
|---|---|
| Customer account and billing records | Duration of contract, then 7 years (tax and accounting requirements) |
| Lead and patient data processed for a customer | As instructed by that customer; deleted or returned within 30 days of contract termination unless we are legally required to retain it |
| Call recordings | 90 days |
| Call transcripts and summaries | 12 months |
| Marketing suppression and opt-out records | Retained indefinitely, because we need them to continue honouring the opt-out |
Call recordings and transcripts are held in our own EU-hosted storage. Recordings are deleted after 90 days and transcripts after 12 months. Recordings are also processed by our voice provider, whose copy of both is deleted after 90 days.
11. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, strict tenant isolation so one customer cannot access another's data, role-based access controls, credential encryption, audit logging of administrative actions, and regular review of access rights.
No system can be guaranteed completely secure. We maintain an incident response process and will notify affected customers and, where required, the ICO of any personal data breach within the timescales required by law.
12. Your rights
Under UK GDPR you have the right to access your data; to have inaccurate data corrected; to erasure in certain circumstances; to restrict or object to processing; to data portability; and to withdraw consent at any time where processing is based on consent.
To exercise these rights where we are the controller, contact hello@trysada.ai. We will respond within one month.
Where we are acting as a processor for one of our customers, please contact that business directly. We will support them in responding to you.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
13. Cookies
Our website uses essential cookies necessary for it to function, and, with your consent, analytics cookies that help us understand how the site is used. You can manage your preferences through our cookie banner or your browser settings. See our Cookie Policy for full details.
14. Changes to this policy
We may update this policy from time to time. Material changes will be notified to customers by email or through the application. The date at the top shows when it was last revised.