Where do AI call recordings go, and is recording legal for a clinic in India?

What is kept is the talk and the written log from that talk, sitting in the accounts I name at handover, for as long as those accounts keep them, heard by whoever those logins allow.

I will not stamp a dental clinic in Green Park as lawful on the back of a log. I am not a lawyer. I do not certify practices.

What is actually stored

The product you buy is an AI voice agent that answers the usual questions, takes a booking, and leaves you a written log. That log is the thing every voice page on this site already names as a transcript.

Audio is a separate question. Some tools keep the sound. Some keep only the words. I will say which, for the tool we actually use, before the number moves. I will not invent a default that fits every provider.

A name, a phone number, a time, and a spoken fee are not “just a booking”. The Digital Personal Data Protection Act, 2023 defines personal data as any data about an individual who is identifiable by or in relation to such data. A clinic call that holds a name and a number sits inside that definition.

Whether a voice agent is safe for a clinic already refused a certificate. This page is the store, the ears, and the Act in public words.

The voice build floor is Rs 25,000 on pricing. That number is the build. It is not a compliance pack.

Where it sits, and for how long

It sits in the accounts I name at handover. Those accounts are in your name. I will not keep a private copy so I can force a renewal.

I will not invent how many days a provider keeps sound. That clock is theirs. Open their setting. Write the number they show. If they will not show a number, treat that as a reason to pick another tool, not as a mystery I will fill with a guess.

When the purpose of the log is over, the Act asks a Data Fiduciary to erase personal data, subject to any law that says keep it. The MeitY text of the Act is the same statute. I will not invent a clinic retention table on top of it. Your advisor may want a stricter line. Follow them.

What happens if the AI is wrong is why you still read the log. A store you cannot open is not a store.

Who can hear it

Whoever the login allows. If the front desk, the dentist, and a cousin in Faridabad share one password, all three can hear the call. That is not encryption. That is a shared key.

I will set the first login in your name. Who you then add is your rule. I will not pretend a shared shop phone is a vault.

The caller should hear, first, that they are talking to an assistant. They will know it is an AI. I will not hide the assistant so the recording sounds like you.

Whether the agent can speak Hindi does not change where the file sits. Language is the card. Storage is the account.

What the Act actually asks, in public words

Section 2 of the Act names a Data Fiduciary as the person who determines the purpose and means of processing personal data. For a clinic call, that person is the practice, not me after handover.

Section 4 says personal data may be processed only for a lawful purpose, with consent or under the other grounds the Act lists. Section 6 says consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action.

Section 5 says a request for consent comes with a notice that names the personal data and the purpose, and that the Data Principal can access that notice in English or in a language from the Eighth Schedule.

I will not turn those sections into a script that makes a Green Park clinic “compliant”. I will tell you what we store, where the login is, and that names and numbers are personal data under the definition above. The rest is a conversation with the person who already advises the practice.

I will not invent a penalty figure. The Act has a Board and penalties. Your counsel can read those chapters. I will not recite them as a sales close.

What I will not do with the file

I will not use a clinic call as a demo for the next shop.

I will not keep a side copy after you can open the account.

I will not tell you recording is always legal in every room in India if you just add one spoken sentence. Notice and consent are in the Act. A spoken sentence may be part of your notice. It is not a certificate I issue.

A quiet practice that already writes names in a notebook still has personal data. A voice log is the same class of fact with a timestamp. Treat it that way.

What to decide before the number moves

• Whether audio is kept, or only the written log.
• Whose mail owns that login.
• Who inside the shop may open it.
• What you will say, in the first sentence, about an assistant and about a log.

Write those four lines. Then get in touch. Bring the advisor’s note if you have one. I will name the store I can see, or I will refuse the job because the card already wanders into a diagnosis.