AI voice agents for telehealth in the UK sit beside a GP practice's framework phone system and handle administrative calls such as booking and call-back requests. They tell patients they are an automated assistant and keep a route to reception. Clinical safety and DSPT paperwork come with them, and call data stays in the UK only when self-hosted there.
Key Takeaways
- Keep the practice number with your framework supplier and divert calls to the agent.
- Patients hear that it is an AI and can always ask for reception.
- UK servers keep call data in the country only if the models run there.
Most virtual receptionist suppliers are not on the framework UK practices must buy telephony from. We cover where an AI receptionist fits in general practice, keeping the practice number with your supplier, lawful basis, clinical safety and keeping call data in the UK with Dograh. It builds on our guide to voice AI in healthcare.
Where an AI receptionist fits in general practice
In UK general practice, the phone is still how many patients get a telephone appointment, a call-back from a GP or a slot with the nurse. An AI voice agent can take the administrative side of those calls, such as booking and moving appointments or taking call-back requests in the patient's own words. It does not give clinical advice or decide who is seen first. AI voice agents for telehealth covers how these calls run with a US provider, and the UK version changes the rules around them more than the calls themselves.
The clearest local guidance so far comes from one commissioner. NHS North East London's advice to practices on virtual receptionists is one ICB's advice, not national policy, but it lists the questions any practice will face. It ends on the principle that the tool should complement access to care, not replace it.
Keep the practice number with your supplier
The GP contract requires practices to buy telephony from the Better Purchasing framework and to report call data on eight metrics, and the ICB notes that most virtual receptionist suppliers are not on that framework. It also asks practices to think carefully before porting the practice number to a third party.
So keep the practice number with your framework telephony supplier and have it divert calls to the agent over SIP or Asterisk. Ask your supplier whether it supports that and what forwarding costs. The practice's call reporting stays with the system it already uses, and the agent answers only the calls diverted to it.
The ICB also tells practices to seek assurance on service levels, such as 99.9% uptime in core surgery hours, and to agree a continuity plan for when a supplier goes down. Divert to the agent at chosen times or for chosen call types, so that reception can take every call back with one change on the practice's own phone system.
Lawful basis, and telling patients it is an AI
Health data is special category data under the UK General Data Protection Regulation (UK GDPR). For calls that are part of care, practices generally rely on Article 9(2)(h), which covers processing for health or social care, rather than on the patient's consent. Some supplier guidance tells practices to collect explicit consent for an AI receptionist. What patients need from the call itself is a clear notice and a route to a person. GDPR for voice AI covers the wider rules.
Being open with patients is a separate duty. Write the practice name and a plain line such as "You're speaking with the surgery's automated assistant" into the Greeting Text on the Start Call node. Allow Greeting Interruption is on by default, and a patient who talks over the opening can cut it short. Switch it off on that node so the full line plays every time.
The route to a person sits on every call. A patient who says they want reception is put through by Transfer Call, which works on Twilio, Telnyx, Plivo, Cloudonix and Asterisk ARI. Dograh rings reception first and connects the patient only when someone answers. If nobody picks up, the agent stays on the line and takes a call-back request instead.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Clinical safety and NHS assurance
The ICB asks each practice to make sure the agent meets the Digital Technology Assessment Criteria (DTAC) and the clinical safety standard DCB0129, which the supplier carries. The practice, as the deploying organisation, covers its own side under DCB0160. Call recordings must be handled to information governance and cyber security standards, with ISO 27001 and Cyber Essentials named. A supplier holding NHS patient data also completes the Data Security and Protection Toolkit (DSPT). AI voice agents for hospitals and health systems in the UK covers the DPIA and the processor contract.
Clinical safety is also a prompt question. The agent books appointments and takes messages, and a fixed Transition Speech on an emergency pathway says: "If this is a medical emergency, please call 999 now." Urgent questions that are not emergencies go to NHS 111 or the duty doctor's call-back list, never to the model's own judgment.
Keeping patient call data in the UK
Self-hosted in a UK data centre, every saved copy stays in the country, from the three recordings and the transcript of each call to the call record with its extracted fields. The audio during the call is the harder part. The speech and language models sit in a separate layer from the platform that runs the call, so a hosted model provider receives the patient's voice wherever it runs. Patient audio stays in the UK only when those models run on UK servers as well. The voice AI data residency checklist walks through each copy.
Nothing is deleted on a timer, since there is no retention setting, so your records retention schedule decides how long recordings stay and your own process deletes them. Before go-live, set ENABLE_TELEMETRY=false and remove POSTHOG_API_KEY, because a self-hosted install sends anonymous usage telemetry by default.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
On cost, self-hosted Dograh has no per-minute platform fee, but servers, model keys and phone minutes still cost money, and Dograh Cloud charges a 1¢-a-minute platform fee. Article 9 and the clinical safety duties both turn on your own setup, so confirm the lawful basis and the assurance plan with your data protection officer or counsel before the first patient call.
Start with one administrative call, such as appointment changes, diverted at set times. It proves the divert, the reception route and the paperwork before the agent takes anything busier.
Glossary
- Better Purchasing framework
- The NHS England framework GP practices buy their telephony from under the GP contract. Framework systems report call data the contract requires, which is why the practice number stays with them.
- DCB0129 and DCB0160
- The NHS clinical safety standards for health IT. DCB0129 applies to the supplier that builds the system and DCB0160 to the organisation that deploys it, such as a GP practice.
- Special category data
- The UK GDPR's class of sensitive data, including health. It needs a condition under Article 9 on top of a normal lawful basis, generally 9(2)(h) for care.
- DSPT
- The Data Security and Protection Toolkit, the NHS self-assessment that organisations with access to NHS patient data and systems complete to show they handle it securely.
