Identity and access
Map every administrator, service account, API key, organization boundary, and support-access path. Verify least privilege and removal procedures in the deployment you operate.
Healthcare deployment review
Review the complete healthcare deployment
zlicx documents how call data moves through the platform. Your compliance posture still depends on how you deploy and operate it, which providers process data, which agreements are in place, and whether the full system passes security, privacy, operational, and legal review.
India
Patient data under the DPDP Act
For clinics, hospitals, and labs in India, the Digital Personal Data Protection Act, 2023 governs how patient personal data is collected, used, and retained. Review your obligations with your legal team before any call handles patient information.
- Tell callers what is recorded and why, and record their consent where it is required.
- Collect only the details the call needs, and set retention periods for recordings and transcripts.
- Redact sensitive details from stored call logs, and limit who can open recordings.
- Consider an Enterprise self-hosted deployment if patient data must stay on your own infrastructure in India.
Review the system, not a slogan
Six areas every healthcare team should validate
Call-data lifecycle
Trace call metadata, transcripts, recordings, knowledge sources, logs, and exports from creation through backup, retention, deletion, and recovery.
Provider chain
Review LiveKit, telephony, speech, model, storage, email, and observability providers. Data handling and agreement requirements extend beyond zlicx itself.
Runtime safeguards
Test redaction, retention, secret handling, URL validation, tenant isolation, auditability, and failure behavior against your threat model and deployment configuration.
Operational evidence
Document risk assessments, access reviews, incident response, workforce procedures, vendor reviews, change control, and the evidence needed for your own audit program.
Legal and contractual review
Determine whether BAAs or other agreements are required with every relevant party. Have qualified privacy, security, and legal reviewers approve the production design.
Shared responsibility
Know which layer owns each control
zlicx platform
Defaults, data models, permissions, logs, retention jobs, integrations, and the update process.
Your deployment
Cloud accounts, network controls, databases, object storage, secrets, backups, observability, availability, and access administration.
Voice and AI providers
LiveKit, carrier, speech, model, embedding, vector, and other services that can receive or process call data.
Your organization
Policies, workforce access, risk analysis, incident response, consent, notices, vendor management, contracts, and audit evidence.
Production gate
A practical pre-launch checklist
Adapt this list to your risk assessment, jurisdiction, call flows, provider contracts, and internal control framework.
- Gate 01
Classify the data each call flow can collect, infer, store, or disclose.
- Gate 02
Document the zlicx plan and deployment, configuration, providers, regions, and subprocessors in scope.
- Gate 03
Obtain and review required provider agreements before processing regulated data.
- Gate 04
Configure authentication, authorization, network boundaries, encryption, logging, backups, and key rotation.
- Gate 05
Set retention and deletion rules for transcripts, recordings, logs, knowledge sources, exports, and backups.
- Gate 06
Test tenant isolation, redaction, deletion, restoration, incident response, and provider failure paths.
- Gate 07
Publish recording, consent, caller-identification, and escalation procedures appropriate to each jurisdiction.
- Gate 08
Complete security, privacy, legal, and operational approval before production use.
Start with a deployment review
Map your call-data flows, document the gaps, and involve the right legal and security owners before regulated production use. Consult the HHS guidance on HIPAA and cloud computing when reviewing provider responsibilities and agreements.