A receptionist that books only when the caller says yes. The rules live in code.

Nothing about a patient until the caller proves who they are.

The caller gives a full name and a date of birth. The backend normalises both, hashes them with a key the model never sees, and looks the pair up. Letters such as ø, ł and ß are folded to their base forms so a name is found however it is spelled on the phone. If 2 patients share a name and birth date, the assistant refuses to guess and offers a callback from staff. 3 failed attempts end the identity check, and every tool that reads or writes patient data refuses until a match exists. The model learns the caller's first name and that it may proceed. It never sees the record.

The calendar is the only source of openings.

When the caller asks for a time, the backend searches real availability: the clinic's hours and holidays, each provider's schedule, the visit type's length, and bookings already on the calendar, earliest first across providers. It returns 3 openings and remembers them by id. The model may say them in its own words, in English or Spanish, but it can propose only one of those ids. Dates and times are resolved in the clinic's time zone, including the days daylight saving changes, in code that is tested across the days the clocks change.

Consent is the caller's words, after the read-back.

Before any write, the backend stages the change and hands the model a read-back to speak. It records the moment the read-back was said. The confirmation check then runs on what the caller said after that moment, with the latest answer winning, so "hmm, maybe" followed by a clear "yes" is a yes, and a "yeah" said before the read-back never counts. Sounds the transcriber marks in brackets are stripped, because a cough is not a word. A yes counts only in the languages the clinic offers, and a hedge in any language blocks it. The first test call from the browser taught us that rule: a noise tag landed right after a clear yes, and the old code treated it as the latest answer.

A phrase list, on purpose.

A missed emergency is the one failure this product cannot have, so the guardrail is a reviewed phrase list, and it errs towards false positives. It runs on a rolling window of the caller's recent words on every transcript fragment, because "chest" and "pain" can arrive separately. Every language pack is checked on every call, whatever the clinic has switched on. On a match, any pending change is dropped, the request in flight is superseded so a slow result cannot speak over the script, writes are refused for the rest of the call, and, when the clinic has enabled it, the on-call line is rung a few seconds later. The word "emergency" on its own is handled too: "it is not an emergency" is the one negation the code honours.

2 walls between clinics, and ciphertext at rest.

Every query filters on the clinic. Then PostgreSQL filters again: every table that holds clinic data carries a Row Level Security policy, forced so even the table owner cannot bypass it, and every request runs as a role that sets the clinic for its own transaction only. A query with no filter at all returns nothing from another clinic, and a test proves it. Names, dates of birth, phone numbers, transcripts, notes and summaries are encrypted in the application with AES-256-GCM before they reach the database; lookups use keyed HMACs. The logger redacts patient fields and phone numbers before a line is written, and every read of a transcript or request writes an audit row in the same transaction as the read.

Answers from the clinic's own documents, with a citation, and a refusal for anything medical.

A practice uploads its FAQ, insurance list, parking directions and prep instructions. Documents are chunked and embedded, and a question is answered from a hybrid search: the top 20 vector matches and the top 20 full-text matches, fused by reciprocal rank, keeping 4. Full text finds names and exact words such as "Cigna" or "Suite 3"; vectors find the rest. The answer carries the passage it came from, and a question the documents do not answer gets a callback offer rather than a guess. A medical question is refused in code before any search runs, in both languages, and the caller is offered a callback.

Live coaching, signed webhooks, and an MCP server that can read but never book.

The front desk sees every call as it happens: captions, each tool step and its result, and a note box. A coaching note such as "offer Thursday afternoon" reaches the assistant mid-call, lives only in memory, and changes none of the rules. Staff can take the call or end it, and the audit log keeps who did what. When a call ends, a worker writes a summary from the transcript, checked against a schema, and flags calls that need a look. Events go out to n8n, Zapier or Make as Standard Webhooks, signed, with no names or transcript text, and no patient ids unless the clinic switches them on, delivered from a worker that checks the destination address against private ranges first and switches off an endpoint after repeated failures. Other AI agents can connect over MCP with a scoped key to read the schedule and close requests. There is no tool that books or cancels.