1. Security Commitment
At Resewaro Technologies Inc., the security and privacy of clinic information are foundational to our platform architecture. We build our autonomous voice AI and clinical scheduling software with straightforward technical controls to safeguard clinic data.
2. Infrastructure & Canadian Data Residency
- Canadian Data Residency: Resewaro’s core production databases and appointment scheduling servers are hosted within certified Canadian data centres
- Data Sovereignty: Clinic schedules, patient records, and call logs remain in Canada and are not transferred across international borders for persistent storage.
- High Availability: Multi-zone infrastructure design with continuous monitoring and automated disaster recovery failover.
3. Cryptographic Safeguards
| Layer | Standard | Implementation Details |
|---|---|---|
| Data in Transit | TLS 1.3 / HTTPS | All REST API traffic, administrative dashboard WebSockets, and database network links are secured via TLS 1.3 with automated HSTS. |
| Data at Rest | AES-256 | All persistent database tables, encrypted patient fields, backups, and disk volumes are encrypted using AES with 256-bit keys. |
| Telephony Streams | SRTP / TLS | Real-time audio transport utilizes Secure Real-Time Transport Protocol (SRTP) and WebSockets over TLS to prevent line interception. |
| Webhooks | Ed25519 Signatures | Inbound carrier webhooks are verified cryptographically via public key Ed25519 signatures with timestamp drift rejection. |
4. Healthcare Data Agreements & Governance
Information Manager Agreements (IMA): Resewaro executes formal, binding Information Manager Agreements (IMAs) or Business Associate Agreements with healthcare practices and clinic custodians upon request prior to processing live appointment schedules.
Data Processing Addenda: We provide standardized Data Processing Agreements covering purpose limitations, confidentiality obligations, audit rights, and prompt breach notification protocols.
Anti-Spam & Telecommunications Standards: All automated outbound telephone confirmations and SMS notifications adhere strictly to applicable telecommunications regulations and patient consent frameworks.
5. Principle of Ephemeral Voice & Minimal Data Collection
- Ephemeral Voice Processing: When a patient speaks with Resewaro AI, real-time voice packets are streamed ephemerally through our Speech-to-Text engine. Raw voice audio is discarded immediately following call termination.
- Zero AI Model Training on Patient Data: Resewaro explicitly prohibits and prevents the use of clinic data, patient names, or appointment notes to train commercial foundation LLMs.
- Least-Privilege PMS Integration: When connecting to clinic EHR systems, Resewaro accesses only calendar availability and booking slots. Resewaro does not extract clinical charts, diagnostic images, or billing records.
6. Access Control & Operational Governance
- Role-Based Access Control (RBAC): Clinic staff accounts are segmented into tiered roles (Owner, Practitioner, Receptionist) with strict least-privilege permissions.
- Multi-Factor Authentication (MFA): Enforced across all internal administrative access and engineering environments.
- Immutable Audit Logging: All appointment bookings, cancellations, staff modifications, and AI voice interventions are recorded in tamper-evident database audit logs.
- Automated Daily Backups: Point-in-time recovery with encrypted continuous backups retained in isolated cloud storage.
7. Security Office Contact
For security assessments, vendor audits, or to request our standard Canadian Information Manager Agreement (IMA):
Security & Compliance Office
Resewaro Technologies Inc.
Edmonton, Alberta, Canada
Email: security@resewaro.com