1. Purpose

The purpose of this Data Security Policy is to ensure that OwlDesk’s AI receptionist services maintain the highest standards for data confidentiality, integrity, and availability. OwlDesk is committed to complying with data protection regulations and using best practices in information security to protect customer and end-user data. This policy is designed to meet the compliance requirements of HIPAA, GDPR, and SOC 2.

2. Scope

This policy applies to all employees, contractors, partners, and third-party vendors who have access to or handle data within OwlDesk. It encompasses all activities related to data collection, storage, processing, transmission, and disposal associated with OwlDesk’s AI receptionist services.

3. Data Collection and Usage

OwlDesk collects only the necessary data required to provide efficient AI receptionist services. The types of data collected may include:

• Caller information (such as name and contact details)
• Call metadata (such as time, duration, and reason for the call)
• Service-specific information (determined by client needs and legal requirements)

Data collected will be used solely for its intended purpose as defined by OwlDesk services and will not be repurposed, shared, or sold without explicit consent.

4. Compliance with HIPAA, GDPR, and SOC 2

OwlDesk partners only with vendors that are HIPAA, GDPR, and SOC 2 compliant. The organization continuously ensures that data practices align with these standards:

• HIPAA Compliance: OwlDesk adheres to HIPAA regulations by implementing access controls, data encryption, and audit mechanisms to protect health-related information. Employees are trained on HIPAA requirements, and business associate agreements (BAAs) are signed with all relevant vendors handling Protected Health Information (PHI).

• GDPR Compliance: For data subject rights under GDPR, OwlDesk ensures the lawful handling of personal data, including the rights to access, rectification, and deletion. Data subjects are informed of their rights, and data processing is conducted under documented legal bases. A Data Protection Officer (DPO) oversees GDPR compliance, and protocols are in place for data subject requests and breach notifications.

• SOC 2 Compliance: OwlDesk adheres to SOC 2 principles, particularly for security, availability, and confidentiality. We perform regular risk assessments, utilize strong authentication and access management, and have processes in place for incident response, security monitoring, and data protection.

5. Data Protection Measures

OwlDesk employs a layered approach to data security, including but not limited to:

• Access Control: Access to sensitive data is limited based on job roles and requires approval. Role-based access controls (RBAC) and multifactor authentication (MFA) are enforced.

• Data Encryption: All data, including data in transit and at rest, is encrypted using industry-standard encryption protocols.

• Regular Security Audits and Testing: Regular security audits, vulnerability assessments, and penetration tests are conducted to identify and remediate risks promptly.

• Incident Response: A formal incident response plan is in place to ensure timely action, mitigation, and resolution of security incidents. Data breach response procedures comply with HIPAA, GDPR, and SOC 2 standards, including timely notifications as required by law.

6. Third-Party Vendor Management

OwlDesk performs due diligence when selecting vendors to ensure they comply with HIPAA, GDPR, and SOC 2. All vendors are required to sign data protection agreements, undergo regular compliance reviews, and maintain certification where relevant.

7. Data Retention and Disposal

Data is retained only for as long as necessary to fulfill its intended purpose or to meet legal obligations. Secure disposal methods, such as data wiping and physical destruction of media, are employed when data is no longer required.

8. Employee Training and Awareness

All OwlDesk employees undergo data security and privacy training upon hiring and regularly thereafter. Training covers compliance requirements for HIPAA, GDPR, SOC 2, and best practices for data protection.

9. Policy Review and Updates

This Data Security Policy is reviewed annually or whenever significant changes in regulations, technology, or operations occur to ensure ongoing compliance with HIPAA, GDPR, and SOC 2 standards.

---

Effective Date: January 1st, 2024
Reviewed By: Hayden Miller
Next Review Date: January 1st, 2025