Privacy Policy

This Privacy Policy describes how Insito Health, Inc. (“Insito,” “we,” “us,” or “our”) collects, uses, and shares personal information in connection with Resia: the website at resia.work (the “Site”), the Resia customer portal and APIs (the “Platform”), and the voice and messaging services we provide through them (together, the “Services”).

Resia is a business product. Our customers are organizations that use the Platform to place and receive calls and text messages through AI agents. Because of that, we handle personal information in two different roles:

Data we collect for ourselves. We decide how to use information about Site visitors, customer accounts, and billing. For this data, we act as the business (the “controller” under some laws), and this Policy governs.
Data we process for our customers (“Customer Content”). When a customer uses the Platform to communicate with people, we process the resulting data — phone numbers, call recordings, transcripts, and messages — on the customer’s behalf and under the customer’s instructions. For this data, we act as a service provider (a “processor” under some laws). The customer’s agreement with us, including any data processing addendum, governs that data, and the customer — not Insito — decides why it is collected and how it is used.

If you received a call or text from an AI agent powered by Resia, see Section 3.

1. Information We Collect

A. Site visitors

We keep collection on the Site to a minimum:

Page-view analytics. We measure aggregate page views using Vercel Web Analytics. This measurement sets no cookie and does not identify individual visitors.
Analytics and session replay (PostHog). We use PostHog, a product-analytics service, to understand how visitors use resia.work so we can improve it. PostHog collects information such as the pages you view, the links and buttons you interact with, your approximate location, your referral source and campaign (UTM) parameters, and your device and browser details. It uses cookies and similar local-storage technologies to assign a pseudonymous identifier so we can recognize returning visitors and measure usage over time. PostHog also records a pseudonymized replay of your session — mouse movement, clicks, and navigation — to help us diagnose usability issues; the text you type into form fields is masked and not captured. This data is processed by PostHog, Inc. (United States) on our behalf.
Visitor identification. We use RB2B to identify companies and, where available, people who visit the Site. RB2B uses cookies and similar technologies to associate visits with information held by it or its data partners. This can include an email address or an online profile. Visit data can include your IP address, pages viewed, referral URL, device and browser details, and approximate location. Matched profiles can include a name, email address, employer, job title and LinkedIn profile. We use this information to understand interest in Resia and contact potential customers. Section 8 explains how to opt out through RB2B and request deletion of information we hold. We keep RB2B off when your browser sends Global Privacy Control, an opt-out preference signal.
Butler chat cookie. When you start a Butler chat, we set a required cookie to confirm that your browser can access that chat. The cookie contains the chat identifier, an expiry time and a server signature. It expires after one day. It does not enable visitor identification.
Demo requests. The Get $RESIA form passes your name and email address to Cal.com to create a booking. The Get a call now form collects your email address, phone number, time zone and optional SMS consent. We store these details and the resulting communications in Resia. We store consent records in Twenty, our customer relationship system. The demo workflow uses this information to call you and, only with recorded consent, send texts. Cal.com also holds booking information under its own privacy policy.
Server logs. Our hosting providers keep standard technical logs (such as IP address, browser type, and pages requested) to operate and secure the Site.

B. Account and organization data

When you create a Resia account, you sign in with a supported identity provider (currently Google or GitHub). We receive and store your name, email address, and a stable identifier from that provider. We also collect:

Organization details. The organization name you choose and the email addresses of teammates you invite.
Credentials and security data. API credential names and hashed secrets, sign-in and access records, and an audit log of account changes.
Compliance registration details. If you register a brand or messaging campaign for text messaging (for example, US 10DLC registration), the business details you provide — such as legal name, address, tax identifier, and contact information — which we submit to our carrier and the applicable messaging registry.
Correspondence. Messages you send us for support, sales, or anything else.

C. Billing and usage data

We meter your use of the Services — call minutes, messages sent, phone numbers held, and agent workflow runs — and maintain a ledger of the resulting charges. Payments are processed by Stripe, our payment processor, which receives your payment details; we do not store full payment card numbers ourselves.

D. Customer Content and communications data

When a customer directs the Platform to communicate, we process on the customer’s behalf:

Recipient information. Telephone numbers of call and message recipients, participant names for multi-party calls, and any information the customer supplies as inputs to an agent (which may include names, appointment details, or other facts about recipients).
Call data. Call audio recordings (where the customer has enabled recording), transcripts, AI-generated summaries and analysis, and call metadata such as time, duration, and outcome.
Message data. The content of outbound and inbound text messages, chat transcripts, delivery status, AI-generated summaries and analysis, and opt-out records.
Agent configurations. The prompts, scripts, knowledge bases, and workflow configurations the customer creates.

The customer is responsible for having a lawful basis to submit this information and to direct these communications, as set out in our Terms of Service.

2. How We Use Information

We use the information described above to:

Provide, operate, maintain, and support the Services, including routing calls and messages through telecommunications carriers;
Set up and administer accounts and organizations;
Meter usage, calculate charges, bill, and collect payment;
Register brands and campaigns with carriers and messaging registries where required;
Secure the Services, and detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service;
Comply with law, regulation, carrier and registry requirements, and legal process, and respond to lawful requests;
Communicate with you about the Services, including service notices, security alerts, and billing;
Send marketing communications about our products, which you can opt out of at any time; and
Create de-identified and aggregate data, as described in our Terms of Service, to operate, evaluate, and improve the Services. Where source data includes personal information, we de-identify it before this use, and we do not attempt to re-identify it.

We do not sell Customer Content. We disclose Site visitor data to RB2B for the visitor identification described in Sections 1 and 4. Section 8 gives the RB2B network opt-out links and explains how to request deletion.

Mobile information. We do not sell mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every category of sharing described in this Policy; that information is not shared with any third party. We disclose a phone number you give us only to the vendors that carry a message or a call for us, and only so that it can be delivered.

We use Customer Content only to provide the Services to the customer, to secure the Services, to prevent or address fraud, abuse, or legal risk, and as otherwise permitted by our agreement with the customer.

3. If an AI Agent Called or Texted You

Two different things can bring a call or a text from us, and who is answerable for it differs between them. Read whichever paragraph describes yours.

3.a Messages you asked us for

If you asked us for a demo call or for text messages at resia.work, then Insito Health, Inc. is the sender. We chose the wording, we decided when to send it, and we are answerable for it. No customer of ours is involved.

A demo call request does not by itself give permission for texts. The demo form offers an optional checkbox for AI calls and texts. The checkbox starts empty. We send follow-up texts only when you select it and we successfully record your consent. You can also request texts at resia.work/sms-opt-in, through an optional checkbox that starts empty. Both forms submit without SMS consent. Consent is not a condition of a purchase. Reply STOP to stop texts. Reply HELP for help. Our Messaging Terms explain message frequency, charges and how to stop messages.

When you do tick it we keep a record — your name and number, the exact words shown to you, and when you agreed — because we have to be able to show it. When you leave it empty we record that too, in the same place and in as many words, so that the absence of an agreement is never mistaken for one.

3.b Messages from a business that uses Resia

Resia provides communications technology to businesses. If an AI agent called or texted you, a business — our customer — chose to contact you, decided what the agent would say, and controls the resulting data. Insito processes that data as the business’s service provider.

Who to contact. Requests about the communication or your data — including access, deletion, and questions about why you were contacted — should go to the business that contacted you. If you contact us instead, we will refer your request to that business and support its response as our agreement with it requires.
Stopping text messages. Reply STOP to any text message to opt out of further messages from that sender. Reply HELP for help. We maintain opt-out records so that further messages to your number from that sender are blocked.
Recording. Calls may be recorded, transcribed, or monitored where the business that placed or received the call has enabled those features. The business is responsible for providing any legally required notice and obtaining any legally required consent.
Voice data. We do not use call audio to identify individual speakers, and we do not create voiceprints or other biometric identifiers from call audio.

4. How We Share Information

We share personal information only as described here:

Service providers and subprocessors. We use third-party providers to deliver the Services, bound by contract to use the information only to provide services to us. These include cloud infrastructure (Google Cloud, in United States regions), website hosting and analytics (Vercel), product analytics and session replay (PostHog, Inc., in the United States), demo scheduling (Cal.com), payment processing (Stripe), speech-recognition providers, speech-synthesis providers, and large language model providers (including Anthropic, OpenAI, and Google). Some AI models run on infrastructure we operate ourselves.
Website visitor identification. We disclose the Site visit data described in Section 1 to RB2B for visitor identification. RB2B can associate that data with information from its own database and data partners. Its handling of that information is described in the RB2B Privacy Policy. Our website code does not pass demo form fields, SMS consent records or Customer Content to this integration.
Telecommunications carriers and registries. To route calls and deliver messages, we share communications data — including phone numbers, call audio in transit, and message content — with telecommunications carriers (including Telnyx) and messaging registries. Carriers process some of this data as independent controllers for their own legal obligations, such as billing and fraud prevention, under their own privacy policies.
At the customer’s direction. We disclose Customer Content as the responsible customer instructs.
Legal compliance and protection. We may disclose information when we believe in good faith that the law requires it, or that disclosure is necessary to comply with legal process, enforce our agreements, or protect the rights, property, or safety of Insito, our customers, call and message recipients, or the public.
Business transfers. If Insito is involved in a merger, acquisition, financing, or sale of assets, personal information may be disclosed and transferred as part of that transaction. We will require the receiving party to honor the commitments in this Policy or give you notice as required by law.
De-identified and aggregate data. We may share data that does not identify you and cannot reasonably be used to identify you.
With your consent. We share for any other purpose you consent to.

5. Data Retention

Site analytics and visitor profiles. Vercel analytics are aggregate. RB2B visitor profiles can identify a person or a company. We keep those profiles for as long as reasonably necessary for the purposes in this Policy, subject to applicable deletion rights. RB2B cookies expire according to its cookie reference; the longest listed duration is one year. We retain any previously saved visitor-identification preference in your browser until you clear site data. RB2B retains its own records under its Privacy Policy. PostHog analytics and session-replay data, including the pseudonymous identifier it sets, are kept for as long as reasonably necessary for the purposes in this Policy, subject to applicable deletion rights.
Demo requests. Cal.com holds booking data under its policy. We keep demo workflow data and consent records for as long as reasonably necessary to respond to your request, provide the demo and meet applicable legal obligations.
Account and organization data. Kept for the life of the account, and afterward as needed for legal, billing, audit, and dispute purposes.
Billing and usage ledgers. Kept as required for tax, accounting, and audit purposes.
Call recordings. Deleted no later than twelve (12) months after the call.
Transcripts and other communications data. Retained for as long as reasonably necessary to provide the Services, unless the responsible customer requests deletion of specified data or a signed agreement with the customer sets a different retention period. We may retain data as required for legal, regulatory, audit, or dispute-resolution purposes.
Opt-out records. Kept for as long as needed to honor the opt-out.
Backups. Encrypted backups persist for a limited period after deletion from live systems.
De-identified data. May be retained indefinitely.

Customers may request deletion of specified Customer Content at any time, as described in our Terms of Service.

6. Security

We maintain an information security program with administrative, technical, and physical safeguards appropriate to the Services, including encryption of Customer Content in transit and at rest, role-based access controls, logging, and personnel screening and training. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify affected customers without undue delay after confirming a security incident affecting Customer Content.

7. Health Information and Other Regulated Data

The Services as offered under our standard Terms of Service are not intended for protected health information subject to HIPAA or other data subject to sector-specific legal protection, unless we have signed a separate written agreement covering it — such as a Business Associate Agreement. Where such an agreement exists, its terms govern that data to the extent of any conflict with this Policy.

8. Your Rights and Choices

Visitor identification and cookies. To opt out of the RB2B network, visit the RB2B network opt-out page. RB2B also provides an international data opt-out page. Contact us at [email protected] to request access or deletion of visitor information we hold. We keep visitor identification off when your browser sends Global Privacy Control, an opt-out preference signal. The network opt-out and Global Privacy Control options described above apply to RB2B; they do not turn off the PostHog analytics and session replay described in Section 1. To exercise your rights over the PostHog data we hold — including access or deletion — contact us at [email protected].
Marketing. You may opt out of marketing emails using the unsubscribe link in any marketing message or by contacting us at [email protected]. We will still send service and billing communications tied to your account.
Account information. Customers can review and update organization and member information in the portal, or by contacting us.
State privacy rights. Depending on where you live, you may have rights to know, access, correct, delete, or receive a portable copy of personal information we hold about you as a business, and the right not to be discriminated against for exercising those rights. You can opt out of Site visitor identification as described above. We honor recognized opt-out preference signals such as Global Privacy Control where they apply.
How to exercise rights. Email [email protected] or write to the address in Section 12. We will verify your identity before acting, respond within the time applicable law requires, and explain any denial. You may appeal a denial by replying to our response, and you may also contact your state attorney general or supervisory authority.
Requests about Customer Content. If your request concerns data a customer controls — for example, a call a business placed to you — we will refer the request to that customer, as Section 3 describes.

9. Children

The Services are for business use and are not directed to individuals under 18. We do not knowingly collect personal information from children under 13 through the Site or the Platform. If you believe a child has provided us personal information, contact us at [email protected] and we will delete it.

10. Processing in the United States

We are based in the United States and process personal information in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those of your jurisdiction. Where applicable law requires a transfer mechanism for international transfers, we will implement one; contact us at [email protected] for details.

11. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes we will provide notice on the Site, through the Services, or by email before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

12. Contact Us

Insito Health, Inc.
56 Broad Street, STE 14277
Boston, Massachusetts 02109
Email: [email protected]