Clinics handle sensitive conversations every day. RIKO is designed so you can put an AI in front of your patients with confidence - Australian-hosted, safety-first, private by design, and honest about exactly how it works.
No vague badges - just concrete choices we've made in how RIKO is built and run.
Plain English on what RIKO touches, what it never touches, and where your data lives - the kind of detail your privacy officer will want to see.
The whole flow, in one picture
When RIKO handles a booking it sends only the details the person gives the chatbot, through Cliniko's and Zanda's official, permission-based APIs - the appointment is created directly in Cliniko, while in Zanda the client record is created and your patient completes the booking in your own Zanda portal. It never reads, downloads, or stores your existing patient records, and our AI never sees them. We operate to the privacy and security standards those platforms require of their integration partners. Read why Zanda works this way →
| Data | What it is | How RIKO handles it |
|---|---|---|
| Your knowledge base | The website content and documents you choose for your bot | Stored in Australia (Sydney) |
| Bot conversations | Questions visitors ask and the answers RIKO gives | Stored in Australia (Sydney); never used to train AI models |
| Patient data | Sensitive information about your patients in Cliniko / Zanda | Never read or stored by RIKO or its AI |
| AI replies | How the bot turns your knowledge base into answers | Generated by a specialist AI provider; your data is never used to train AI models |
| Backups | Encrypted copies of your data, for recovery | Encrypted, stored in Australia (Sydney) |
| Social accounts (RISE) | The Facebook, Instagram or LinkedIn pages you connect to RISE | Access keys encrypted at rest; RISE only publishes posts you've approved - it never reads your messages or followers' data |
No. Your conversations are used to answer questions in the moment - they are never used to train AI models.
Your account data, conversation logs and backups are stored in Australia (Sydney). Backups are encrypted before they leave the server.
No. RIKO only sends the details someone gives the chatbot, through the platforms' official APIs - creating the appointment directly in Cliniko, or creating the client record in Zanda with your patient completing the booking in your Zanda portal. It never reads, downloads, or stores your existing patient records, and our AI never sees them.
RIKO is built to recognise crisis and self-harm language and respond immediately with real support options (including emergency and crisis-line details), rather than trying to handle it as a normal chat. It also alerts your team straight away so a person can follow up.
When RISE launches, connecting a social account grants it permission to publish posts only - through each platform's official login, with the access keys encrypted at rest. It writes from your website content and services, never from patient data, and nothing is published without your approval unless you switch on hands-off mode yourself.
Yes. A Master Services Agreement (MSA) and Data Processing Agreement (DPA) are available on request - just ask and we'll send them through.
Yes. You can ask us to delete an individual customer's data, or all of your data, at any time - and we action it.
No. RIKO answers questions about your practice (services, fees, hours, bookings) and escalates anything clinical or sensitive to your team. It does not provide medical, legal or financial advice.
Yes. AHPRA's advertising guidelines prohibit unregistered practitioners from making unsubstantiated claims about treatment outcomes. RIKO is designed to stay well within those guidelines - it answers questions about your practice (services, fees, how to get started) and never makes clinical claims, promises outcomes, or gives health advice. If a question goes beyond what your content covers, it escalates to your team rather than guessing.
Book a free 20-minute call and we'll walk your team through exactly how RIKO handles your clinic's and patients' data - and send over the MSA/DPA if you need them.