What decides the cost of an AI receptionist for a dental office, and is it private?

With Valistix, an AI receptionist for a dental office is Get Answered, priced to your clinic's call volume on a short call or by email: a monthly fee plus a one-time setup fee, in writing on a one-page Order Form before you sign, month to month. One of our specialists builds it around your clinic: your booking rules, your new-patient questions, your after-hours line. On privacy, we sign a Business Associate Agreement (US) or our health-information agent terms, Schedule A (Canada), before any patient information is handled, and we set recording retention and scrubbing for you. Below: what decides the price, what the setup builds, and what the privacy laws in Canada and the US ask of you and of us.

What decides a dental office's price with Valistix

For a clinic, the receptionist is Get Answered. In every size it answers on your existing number, follows your script, books the appointment into your calendar, sends the patient a confirmation by text and email, puts urgent calls through, and texts and emails you a summary after every call. The bigger sizes add the follow-up that fills the chair: hang-up text back, follow-up on callers who didn't book, website chat, review follow-up and CRM links.

Your price is matched to your clinic on a short call or by email, and you see it in writing on a one-page Order Form before you sign. US clinics are billed in US$ and Canadian clinics in C$, month to month, cancel any time. At signing you pay the setup fee and your first month together; that first month runs from go-live, and after that your service bills automatically each month.

What the setup fee builds for a clinic

The setup fee is one time, charged at signing with your first month. It is where your receptionist gets made.

For health clinics, the setup also covers the privacy paperwork and controls: before any patient information is handled, we sign a Business Associate Agreement (US) or our health-information agent terms, Schedule A (Canada), and set recording retention and scrubbing for you. In the bigger sizes, the same setup builds your follow-up.

Here is everything it covers, item by item:

• A script written for your clinic. One of our specialists writes it from your kickoff call: how it greets patients, what it asks a new patient, and what it says on every kind of call, from a cleaning booking to a cracked tooth. You approve it before it answers a single call.
• Your call flows and urgent rules. Who gets a live transfer and when, what counts as urgent, which callers it tells to hang up and call 911, and when it takes a message and texts you.
• Your answers, from your own information. Your hours, services, prices and the questions patients ask most, built in so it quotes what you gave it and never guesses.
• Calendar and booking, connected. Your calendar or practice scheduling system, connected at kickoff, so it books while the patient is still on the line.
• Number forwarding, set up with you. Your number stays yours, and you can un-forward it in a minute.
• Text-message registration with the carriers (A2P 10DLC in the US), so confirmations and summaries reach phones.
• Voice and greeting, tuned to you. It answers with your clinic's name, says it is an AI and that the call is recorded, and sounds right for your practice.
• Test calls before go-live. You hear it on test calls before your patients do.
• The go-live checklist. Script approved, test calls passed, forwarding on, booking connected.
• The Seven Days promise behind it. Live within 7 business days of your kickoff call, or, if the delay is ours, the Get Answered setup fee comes back.

How to size it for your clinic

Minutes. Pull last month's inbound call minutes from your phone bill, including evenings and weekends, and bring them to your call. One of our specialists matches the size to a busy month, not an average one.

Locations. Tell us how many clinics or lines you run. A group practice is sized as one plan, and a new location can be added when it opens.

Languages. If your patients call in Spanish or French, say so, and a second language goes into your script and your quote.

Booking. 'Books appointments' can mean writing into your practice software, or sending your desk a request. With Valistix, your calendar or practice scheduling system is connected at kickoff, and you go through it on your fix-list call, 15 to 30 minutes on video with one of our specialists.

Is it private? Canada: PIPEDA and the provincial health-privacy laws

Canada's federal private-sector privacy law is PIPEDA. It defines personal information as 'information about an identifiable individual' (s.2) and requires every organization to follow the Schedule 1 principles (s.5). Principle 4.3 requires knowledge and consent, obtained before or at the time of collection (4.3.2); s.6.1 says consent is valid only if the person would understand the nature, purpose and consequences. Principle 4.1.3 keeps you accountable for information you transfer to a third party for processing, and 4.5 says keep it only as long as the purpose needs.

Recording a patient call is collecting personal information. The Privacy Commissioner's guidance on recording customer calls (updated 2018) says PIPEDA applies 'whether the customer or the organization initiates the call'; you may record only for a purpose 'a reasonable person would consider appropriate under the circumstances'; and you 'must inform the customer that they are recording a call, clearly state the purpose of the recording and ask for their consent'. A caller who keeps talking after being told the call is recorded and why has given implied consent; one who objects should be offered another way to do the task. Recordings need safeguards and a limited retention period.

Health information adds a provincial layer. The Commissioner's office lists Alberta, British Columbia and Quebec as having general private-sector privacy laws that apply instead of PIPEDA, and four provinces with health-privacy laws declared substantially similar to PIPEDA; where a province's health law hasn't been declared similar, 'PIPEDA may still apply'. Valistix serves clinics across Canada outside Quebec.

The word you'll meet in a Canadian health-privacy contract is 'agent'. Under PHIPA, the custodian is the clinic or practitioner that holds the records; the provincial Information and Privacy Commissioner's FAQ lists health care practitioners, including dental professionals, chiropractors and massage therapists, as custodians. An agent is 'any person who is authorized by a custodian to perform services or activities in respect of personal health information on the custodian's behalf and for the purposes of that custodian'. In plain words: the vendor works for you, under your rules, and you stay responsible. The custodian 'remains accountable for the personal health information in its custody or under its control, even where the agent is authorized to act on its behalf', even if the agent went beyond what you authorized. The agent must follow the Act, adopt your information practices, and tell you 'at the first reasonable opportunity' if information is stolen, lost or accessed without authority.

So the privacy question for a Canadian clinic is about the contract. Does the vendor sign agent terms that bind it to your information practices, list what it collects, say where it stores it and who processes it, set how long it keeps recordings, and commit to how fast it reports a breach? Ours is Schedule A, our health-information agent terms, signed before any patient information is handled.

Is it private? US: HIPAA and the business associate agreement

HIPAA's rules sit on the covered entity, which includes 'a health care provider who transmits any health information in electronic form' in connection with a covered transaction (45 CFR 160.103). A vendor that 'creates, receives, maintains, or transmits' protected health information for you, including for 'practice management' and 'billing' functions, is a business associate under the same section.

You may let a business associate handle PHI only if you obtain 'satisfactory assurance that the business associate will appropriately safeguard the information', documented in a written contract (45 CFR 164.502(e)). That contract is the business associate agreement, the BAA. Under 164.504(e)(2) it must require the vendor to: not use or disclose PHI other than as the contract or the law permits; use appropriate safeguards; report to you any use or disclosure not provided for by the contract, including breaches; make any subcontractors agree to the same restrictions; make PHI available for patient access and amendment; return or destroy PHI when the contract ends; and make its books and records available to the Secretary of Health and Human Services. The vendor may then use PHI only as the BAA allows (164.502(a)(3)).

One line matters to owners: if you know a vendor has a pattern of material breaches and don't take reasonable steps to cure it, or end the contract if that fails, you are out of compliance yourself (164.504(e)(1)(ii)). The BAA is the mechanism the rule uses to make your vendor answerable to you.

Does an AI receptionist touch PHI? If it takes a name, a number and 'I need a cleaning Thursday' for a dental practice, it is handling health information for a provider. Where the practice is a covered entity, the rule treats that vendor as a business associate, so have the BAA signed before go-live. Valistix signs a Business Associate Agreement before any patient information is handled.

Utah adds a state rule. Under Utah Code 13-75-103 (effective May 7, 2025), a business using generative AI in a consumer transaction must disclose that the person 'is interacting with generative artificial intelligence and not a human' when clearly asked, and someone in a regulated occupation must disclose it 'verbally at the start of a verbal interaction' when the interaction is high-risk, which includes collecting health data or giving medical advice. Ours says it is an AI in its greeting, at the start of every call, and again whenever a caller asks.

What makes a clinic's phone line private: the contract and the controls

Read the rules above again and a pattern shows. HIPAA's duties sit with the covered entity and reach the vendor through the BAA. PIPEDA keeps you accountable for information you transfer for processing. PHIPA keeps the custodian accountable for its agents. Each one points to the contract and the controls.

What we put in place with you: the signed BAA or Schedule A, retention and scrubbing set for your clinic, the provider list and storage locations set out in our Privacy Policy, and a greeting that tells every caller it's an AI and that the call is recorded.

Eight questions to ask any vendor about recordings, retention and scrubbing

Ask these before the demo ends and get the answers in the contract, not in an email.

• Do you sign a BAA (US) or health-information agent terms (Canada) before go-live, and does it cost extra or require a higher tier?
• Exactly what will the receptionist collect, and what will it never ask for: health card or policy numbers, dates of birth, diagnoses, card numbers?
• Where are recordings and transcripts stored, in which country, and which sub-processors (telephony, speech, AI) touch them?
• How long are recordings and transcripts kept by default, and can we set a shorter period?
• Can you scrub health details from recordings and transcripts, and is it automatic or on request?
• Who on your side can listen to recordings, and how is that access limited?
• How and how fast do you tell us about a breach? (A PHIPA agent must notify at the first reasonable opportunity; a BAA must require reporting.)
• When we leave, how do we export everything, how long does that take, and how do you confirm deletion?

Also ask what the greeting says. The recording notice and the AI disclosure are how callers are told and how consent is obtained. On ours, both are part of every greeting, on every call.

How Valistix handles clinic calls

Get Answered is priced to your clinic on a short call or by email, month to month, cancel any time. US clinics are billed in US$ and Canadian clinics in C$. The receptionist answers on your existing number (you forward it, and can un-forward it in a minute), follows your script, books, puts urgent calls through, takes messages, sends the patient a confirmation by text and email and you a summary, and sends a monthly report. We register your clinic with the carriers as part of setup, so texts reach phones; they name your clinic and honour STOP.

Before any patient information is handled, Canadian clinics sign our health-information agent terms (Schedule A) and US clinics sign a Business Associate Agreement. We set recording retention and scrubbing for you: recordings and transcripts are kept 90 days by default, or the period you set, up to 12 months, as our Privacy Policy describes. The receptionist sticks to bookings and the answers in your script, and gives no clinical advice. It says it is an AI in its greeting and whenever asked, and the greeting says the call is recorded. At setup we also script your clinic's reason for recording into it, such as 'so we can book you accurately', as the Canadian guidance above expects. It quotes only the prices you gave it, offers only the times you approved, sends life-safety emergencies to 911, and takes a message and texts you when a call needs you.

Recordings, transcripts, leads and patient data are yours, with a full export within 14 days of asking. And it's 30-day money-back on your first month of Get Answered: not for you in the first 30 days after go-live? Email us and the first month's plan fee comes back. Once per client; setup isn't refunded. Call (866) 413-5421 and ask for the physio clinic, or say your clinic's name and it answers as you.