Last updated: 17 September 2026
Safety and Compliance
Optavius is workflow automation for specialty care practices. It answers calls, books and moves appointments, gives order status and routes patients. It does not diagnose and never overrides clinical judgment. Every pathway, every decision and every escalation is documented and auditable. This page describes how safety, data protection and clinical governance are built in.
1. Scope statement
Optavius handles administrative patient interactions: navigation, scheduling, order status, reminders and follow-up. It provides no medical advice. When a caller describes symptoms, the agent applies the practice's own protocol to decide how urgently a person needs to be seen and by whom, and it hands over to staff whenever the protocol or the caller asks for it.
2. Escalation principles
Red-flag symptoms trigger immediate escalation to clinical staff, with the transcript and a short summary. When the agent is uncertain, it routes to a human rather than guessing. Safety comes before automation, always.
- Red-flag symptom lists are defined and approved by the practice's clinical lead.
- Urgent cases are transferred live during opening hours and escalated by phone or message outside them.
- Callers can reach a person at any point by asking for one.
3. Complete audit trail
Every decision the agent takes is logged. Each call has a full transcript with structured data: reason for calling, actions taken, outcome and any escalation. Pathways are versioned, so the practice can see which rules applied to any call at any time.
4. Human oversight
Flagged cases land in a review queue in the console. Pathways go live only after the practice's clinical governance has approved them, and edge cases are handled by people, not by the agent.
5. Data handling and security
Healthcare-grade security for all patient data, with encryption, access controls and compliance built in.
- Encryption in transit and at rest.
- Role-based access with audit logging.
- Configurable retention policies per practice.
- HIPAA compliant data handling with a signed Business Associate Agreement for US practices.
- GDPR compliant processing for practices in the EU, with a data processing agreement.
- Controls aligned with SOC 1 and ISO 27001, and readiness for the EU AI Act.
6. Transparency by default
Patients always know what they are talking to.
- Callers are told they are speaking with an AI assistant.
- Hand-offs to human staff are announced clearly.
- Full transcripts are available to the practice, and to patients on request through the practice.
7. Clinical governance
We work with the practice's clinical leadership to design pathways that meet its governance standards.
- Pathways are co-designed with the practice's clinical leadership.
- All routing rules are reviewed and approved before deployment.
- Pathways are audited and updated regularly.
- Escalation chains are documented and known to the team.
8. Questions about compliance
Our team is happy to discuss your requirements and to share our security and compliance one-pager for your procurement team. Write to legal@optavius.com or book a demo.