Privacy Policy
Who we are
Marla is operated by [legal entity name], ABN [ABN], of [registered address] ("we", "us"). Marla answers phone calls for dental practices when their front desk can't, and passes each call to the practice. Contact our privacy officer at [privacy@meetmarla.com.au].
Two kinds of information
Practice accounts. When a practice signs up we collect the practice's name, the login email, a password (stored only as a one-way hash), and the details the practice enters in Marla Configuration: address, hours, dentists, FAQ, emergency wording, and the email and mobile for urgent alerts.
Patients and other callers. When someone calls a practice's Marla number, we collect on the practice's behalf what the caller tells Marla: their name, callback number, why they're calling, how urgent it is, and a short summary. This can include health information, which the Privacy Act treats as sensitive. Callers are told at the start of each call that Marla is an AI receptionist and that the call is recorded and transcribed. [Confirm with your lawyer how consent is obtained and recorded, and what happens when a caller declines.]
Why we use it
- To answer the call, work out its urgency, and give the practice what it needs to call the patient back.
- To alert the practice to urgent calls. Alert emails and texts contain only a link, never patient details.
- To run, secure and fix the service.
We don't sell personal information or use patients' information for marketing.
Who we share it with
The practice the caller rang, and only that practice. Each practice's logins see only their own calls. We also use these service providers:
| Provider | What for | Where |
|---|---|---|
| Telnyx | Phone numbers, the AI voice assistant, call summaries | [United States — confirm Telnyx's processing locations] |
| Fly.io | Runs the Marla app | Sydney, Australia |
| Supabase | Stores the database | Sydney, Australia |
| Resend | Sends account and alert emails (no patient details) | [United States / Japan — confirm] |
Overseas disclosure
Some providers above process information outside Australia, including callers' voice and call content processed by Telnyx in [countries]. [Describe the steps taken under Australian Privacy Principle 8, e.g. the data processing agreement with Telnyx.]
How long we keep it
[Retention periods for call records, recordings and transcripts, and practice accounts, and what happens when a practice leaves Marla.]
Security
Data is encrypted in transit (HTTPS). Logins need a verified email and a strong password. Each practice's data is kept separate, and patient details are kept out of our application logs. [Add encryption at rest and access controls once confirmed with each provider.]
Access, correction and complaints
Patients should contact their dental practice first, since the practice is responsible for its patient records. You can also contact us at [privacy@meetmarla.com.au]. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
The early-access list
If you joined the early-access list on our home page, we hold only your email address and when you submitted it, and use it only to contact you about Marla. Ask us any time to remove it.