Privacy Policy

Last Updated: 16 June 2026

CallSara, Inc. (“CallSara,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you interact with our website (www.callsara.ai) and our services.

About the CallSara Brand

CallSara, Inc. is an AI-powered healthcare technology company. Our brand name “CallSara” is a registered trademark of CallSara, Inc. and has no connection to any pharmaceutical product, dietary supplement, herbal remedy, or any product regulated by the U.S. Food and Drug Administration (FDA) or Drug Enforcement Administration (DEA). CallSara does not manufacture, sell, dispense, distribute, or promote any drug, supplement, or regulated health product of any kind.

Scope of This Privacy Policy

This Privacy Policy applies only to information collected through our website (www.callsara.ai).

It does not apply to patient data or information processed through CallSara’s services on behalf of healthcare providers. Such data is governed by separate Business Associate Agreements (BAAs) and applicable healthcare regulations, including HIPAA. If you are a patient of a healthcare organisation that uses CallSara, please contact that organisation directly regarding your health information.

Important, What This Policy Does Not Cover

CallSara is a software and communications platform for healthcare organisations. We are not a pharmacy, telehealth provider, or drug manufacturer.

We do not sell, dispense, fulfil, or promote prescription drugs, over-the-counter medications, dietary supplements, herbal products, vitamins, controlled substances, or any product on the LegitScript Unapproved Pharmaceuticals and Supplements list.

We do not provide medical advice, diagnosis, or treatment.

Protected Health Information (PHI) processed on behalf of healthcare provider Customers is governed exclusively by the relevant BAA, not this Privacy Policy.

1. What Information We Collect and Process

1.1 Information You Provide to Us

When you interact with our website or services (e.g., demo requests, contact forms), we may collect:

Full name
Work email address
Phone number
Company or practice name
Job title or business information
Specialty and number of providers (for healthcare demo requests)

You may choose to browse parts of our website without providing personal data. We do not collect sensitive health or medical information through our website forms.

1.2 Automatically Collected Information

When you visit our website, we may automatically collect:

IP address
Device type and browser information
Pages visited, time spent, and interactions
Referring URLs and campaign parameters (e.g., Google Ads click identifiers such as gclid, UTM parameters)

1.3 Cookies and Tracking Technologies

We use cookies and similar technologies to:

Ensure core website functionality (strictly necessary cookies, always active)
Analyse user behaviour and website performance (analytics cookies, consent required in EU/UK)
Measure advertising campaign performance and conversions (marketing cookies, consent required in EU/UK)

We use the following third-party tracking technologies on our website:

Google Analytics 4, web analytics and user behaviour measurement
Google Ads conversion tracking, measures which ads lead to demo requests and sign-ups, using the gclid click identifier. When you click a Google Ad and visit our site, Google receives information about that visit.
Google Tag Manager, manages how tracking scripts load on our site
LinkedIn Insight Tag, campaign performance measurement (where applicable)

We operate Google Consent Mode v2. This means that in regions where prior opt-in consent is required for non-essential cookies (including the EU and UK), no analytics or advertising cookies are placed until you provide consent via our cookie banner. If you click “Deny,” only strictly necessary cookies are set and no data is sent to advertising platforms.

You can manage or withdraw your cookie preferences at any time via the Cookie Settings link in our site footer. Some website features may not function correctly if you disable all cookies.

1.4 Information from Third Parties

We may receive information about you from:

Marketing and analytics providers
Advertising platforms (e.g., Google Ads, LinkedIn)
Publicly available sources
Event or webinar platforms where you have registered for a CallSara event

1.5 Voice and Call Data (Platform Customers Only)

When CallSara’s voice AI platform handles calls on behalf of a healthcare provider Customer, we process call audio, transcripts, caller phone numbers, and call metadata (timestamps, duration, routing events) as a data processor acting on the Customer’s instructions. Where this data relates to an identified or identifiable patient, it constitutes PHI and is governed by the relevant BAA, not this Privacy Policy.

CallSara does not use Customer call audio, transcripts, or PHI to train general-purpose AI models without the explicit, separate written consent of the Customer.

Customers are solely responsible for obtaining all legally required consents from callers before using CallSara’s platform to record calls, place automated outbound calls, or conduct any telemarketing or patient recall activity. Applicable laws include the U.S. Telephone Consumer Protection Act (TCPA), state call-recording laws (including all-party consent requirements), and equivalent laws in other jurisdictions.

2. How We Use Personal Data

We use personal data for the following purposes:

To respond to enquiries, demo requests, and support tickets
To create and manage your account and deliver the Services you have signed up for
To process payments and manage billing
To send you product updates, feature announcements, and marketing communications (you can opt out at any time, see Section 7)
To analyse website usage and improve the performance of our website and advertising campaigns
To operate, secure, and improve our voice AI platform on behalf of our Customers
To comply with legal obligations and respond to lawful requests from authorities
To protect the rights, property, and safety of CallSara, our users, and the public

Our Lawful Basis (EEA, UK, and similar jurisdictions)

Contract, to perform services you have signed up for.

Legitimate interests, to respond to enquiries, improve our product, and run our business.

Consent, for marketing emails and non-essential cookies. You can withdraw consent at any time without affecting prior processing.

Legal obligation, where law requires us to process data.

3. How We Share Personal Data

We do not sell personal data

We may share your data with:

Service providers (CRM, cloud hosting, telephony infrastructure, AI inference, analytics, email delivery) who process data on our behalf under data processing agreements and may only use data as directed by us
Advertising platforms (e.g., Google Ads, LinkedIn) to measure campaign performance and deliver relevant ads, governed by the cookie disclosures in Section 1.3
Business partners assisting in our operations
Legal authorities where required by law, court order, or to protect the rights and safety of CallSara, our users, or the public
A successor entity in the event of a corporate sale, merger, acquisition, or reorganisation, we will notify you before data is transferred and becomes subject to a different privacy policy

All third-party service providers are required to maintain appropriate confidentiality and security measures. A list of key sub-processors is maintained at callsara.ai/legal/sub-processors and is updated when we add or change providers.

3.1 Advertising Platform Content Policy

CallSara markets its Services through third-party advertising platforms including Google Ads, which have their own content and trademark policies. CallSara may remove or modify any Customer-supplied content (including testimonials, case studies, and co-marketing materials) published on our website if, in CallSara’s reasonable judgment, that content creates a risk of disapproval or restriction under any applicable advertising platform policy. This may include removing references to Customer brand names that coincidentally match terms flagged by automated advertising policy systems. Such removal is not a breach by CallSara and will be carried out in good faith.

4. International Data Transfers

Our website and supporting systems are primarily hosted in the United States. In some cases, personal data may be processed in other jurisdictions where our service providers operate.

For transfers from the European Economic Area (EEA) or the United Kingdom to the United States or other third countries, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner’s Office to provide appropriate safeguards.

For data of residents of India, we process data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and will update our practices as implementing regulations are issued.

5. Data Security and Retention

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or misuse. These include encryption of data in transit (TLS 1.2+) and at rest, role-based access controls, multi-factor authentication for internal systems, regular security assessments and penetration testing, and incident response procedures.

CallSara maintains SOC 2 Type II certification. Contact founders@callsara.ai to request a copy of our report under NDA.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant authorities within the timeframes required by applicable law (72 hours for GDPR; without unreasonable delay under U.S. state breach notification laws).

We retain personal data only as long as necessary to:

Respond to enquiries and requests (up to 24 months from last contact unless you become a Customer)
Support website operations and analytics (up to 14 months for analytics data; up to 90 days for server logs)
Manage your account and subscription (duration of relationship plus 7 years for legal and tax records)
Comply with legal obligations, resolve disputes, and enforce agreements
Billing and payment records: 7 years from the relevant transaction

6. Cookies and Advertising

We may use third-party advertising services to deliver relevant ads and measure campaign performance. Technologies we use include Google Analytics 4, Google Ads conversion tracking, and Google Tag Manager. We may also use LinkedIn Insight Tag and similar tools.

Because our advertising platforms (including Google Ads) have automated content-scanning systems that review the pages our ads point to, we ensure that our website content, including all product descriptions, customer testimonials, and case studies, accurately represents CallSara’s software and communications services and contains no references to pharmaceutical products, dietary supplements, or other regulated health products.

You can opt out of targeted advertising via:

https://optout.networkadvertising.org/
https://optout.aboutads.info/
Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout

You can manage your cookie preferences at any time via the Cookie Settings link in our site footer.

7. Your Privacy Rights and Choices

Depending on your location, you may have the right to:

Access your personal data and receive a copy in a portable format
Correct or update inaccurate or incomplete data
Request deletion of your personal data, subject to legal exceptions
Restrict or object to certain processing, including direct marketing
Opt out of marketing communications at any time (use the unsubscribe link in any email, or contact us below)
Withdraw consent for processing based on consent, without affecting prior processing

To exercise any of these rights, contact us at:

founders@callsara.ai

We may need to verify your identity before fulfilling your request. We will respond within the timeframe required by applicable law (generally 30-45 days, with possible extension for complex requests).

8. U.S. Privacy Rights

Residents of certain U.S. states have additional rights under their state’s privacy laws. These currently include California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia, among others. Healthcare data is classified as sensitive personal information in most of these states.

These additional rights may include:

Right to know what personal data is collected and how it is used or shared
Right to request deletion of your personal data
Right to correct inaccurate personal data
Right to opt out of the sale or sharing of personal data for cross-context behavioural advertising
Right to opt out of automated profiling that produces legal or similarly significant effects
Right to be free from discrimination for exercising these rights

Requests can be submitted by email to founders@callsara.ai. California residents may also contact the California Privacy Protection Agency or the California Attorney General’s office for assistance.

9. Children’s Privacy

Our website and Services are intended for business users, specifically personnel of healthcare organisations, and are not directed at individuals under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data through our website, please contact founders@callsara.ai and we will take steps to delete that data promptly.

10. Third-Party Websites

Our website may contain links to third-party websites, integrations, or resources. This Privacy Policy applies only to www.callsara.ai and our Services. We are not responsible for the privacy practices or content of any third-party sites and encourage you to review their privacy policies before sharing personal data.

11. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or the Services. Changes will be posted on this page with an updated date.

For material changes, particularly those that affect how we use data you have already provided, we will notify you by email (if we have your address) or by a prominent notice on our website at least 14 days before the change takes effect. Your continued use of our website after the effective date constitutes acceptance of the updated Policy.

12. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please reach out to us: