Barbarik AI, Ethical AI Usage Policy

Last updated: July 2026

1. Our Commitment

Barbarik AI Private Limited builds and deploys voice-first AI agents across healthcare, government, financial services, agrochemical, and consumer-facing industries. Because our agents interact directly with real people on behalf of our clients, often around sensitive matters such as health, payments, and personal data, we hold ourselves to clear ethical standards for how our AI systems are designed, deployed, and monitored.

This policy applies to every AI agent, voice bot, or automated calling system built or operated by Barbarik AI, regardless of the client, vertical, or use case. It is informed by internationally recognized frameworks, including the OECD AI Principles and the NIST AI Risk Management Framework, as well as applicable Indian law, including the Digital Personal Data Protection Act, 2023, and sector-specific regulatory guidance such as the RBI's Responsible Business Conduct Directions for financial institutions.

2. Core Principles

Transparency. Every AI agent identifies itself as an automated system at the start of an interaction, unless a live human agent is already present. We do not design agents to impersonate humans without disclosure.

Fairness and non-discrimination. Our agents are built and tested to treat all users consistently, regardless of language, accent, gender, religion, or any other personal characteristic. We actively test for and correct biased behavior in scripts, prompts, and model outputs.

Human oversight. No AI agent we deploy makes final, high-stakes decisions autonomously (for example, denying a claim, confirming a legal or financial outcome, or making a medical determination). These decisions always route to a human, or the agent is limited to information-gathering and scheduling functions.

Explainability. For any deployment involving a financial, health, or legal outcome, we can explain in plain terms why an AI agent took a given action, such as why a call was flagged, escalated, or routed a certain way. This explanation is available to the client and, where required by law, to the affected individual.

Data privacy and minimization. Our agents collect only the data necessary to complete the task they are designed for. Personal data (names, phone numbers, health information, payment details, financial status) is handled in line with applicable law, including the DPDP Act, 2023, and client-specific data handling agreements.

No coercive or manipulative design. Our agents do not use pressure tactics, threats, deceptive framing, or emotionally manipulative language to influence a user's decisions. This applies with particular strictness to any use case involving payments, collections, or financial outcomes.

Respect for user autonomy. Users can request to speak with a human agent at any point. Users can opt out of future automated calls, and that preference is honored and logged.

Protection of vulnerable individuals. Our agents are designed to recognize and respond appropriately to signs of financial distress, medical vulnerability, or personal hardship, and to pause, soften, or escalate an interaction rather than continue a scripted flow regardless of context.

Security and robustness. Our AI systems are built and maintained with security as a first-order requirement, not an afterthought. We treat resistance to misuse, manipulation, and unauthorized access as part of what makes an agent trustworthy, alongside fairness and accuracy.

Accountability. Every deployment has a named internal owner at Barbarik AI responsible for that agent's behavior, monitoring, and issue resolution.

3. Calling and Interaction Standards

• Agents contact users only within legally permitted hours for the relevant use case and jurisdiction. For financial and collections-related calling in India, this means no contact before 8:00 AM or after 7:00 PM, and no contact on Sundays or notified public holidays, in line with RBI guidance.
• Agents do not contact a user during a declared bereavement, major festival, or period of illness, where this is known.
• Agents do not continue outreach on a matter that is the subject of a pending, unresolved complaint with the client.
• Agents do not make repeated, back-to-back calls to a user who has not answered or has declined to engage.
• Agents never contact a user's family members, employer, or personal contacts to pressure or locate them, and never use contact lists, location data, or photos collected for one purpose to support collection or recovery efforts.
• Call scripts are reviewed before deployment to remove language that could be read as threatening, shaming, or coercive.
• If a user expresses distress, confusion, or requests escalation, the agent is designed to hand off to a human rather than continue the automated flow.
• All calls are logged, and logs are retained for audit and dispute-resolution purposes, in line with the client's data retention requirements.

4. Data Handling

• Data collected or processed by our agents is encrypted in transit and at rest.
• Access to call recordings, transcripts, and user data is limited to personnel who need it to deliver or support the engagement.
• Data is not used to train models for purposes outside the scope agreed with the client, without separate written consent.
• Data is retained only as long as necessary for the engagement and applicable legal requirements, and is deleted or returned per client agreement upon request.
• Data gathered for one stated purpose (for example, scheduling or verification) is never repurposed for an unrelated use, such as pressure tactics in a collections context, without the user's informed consent.

5. Model, System, and Vendor Safeguards

• Agent scripts, prompts, and conversation flows are reviewed prior to go-live for each deployment.
• We monitor deployed agents for drift in behavior, unexpected responses, or degraded performance, and maintain a process to pause or correct an agent if issues are identified.
• Systems are periodically assessed for security vulnerabilities, and known issues are remediated on a defined timeline based on severity.
• Where third-party AI models, platforms, or telephony providers are used, we evaluate them against these same principles, including their data handling practices and security posture, before integrating them into a deployment.

6. Governance and Training

• A named individual at Barbarik AI is accountable for ethical AI practice across deployments, and serves as the point of contact for client compliance reviews.
• Personnel who write, configure, or supervise AI agent scripts and flows receive training on these principles, applicable regulatory requirements, and how to recognize and escalate potential harms.
• This policy and related internal practices are reviewed at least annually, or sooner if a relevant law or regulation changes.

7. Environmental Responsibility

We consider the computational and environmental cost of the AI systems we deploy, and favor efficient models and infrastructure where they meet client requirements, consistent with the sustainability commitments in the OECD AI Principles.

8. Grievance Redressal

Any user, client, or partner who believes a Barbarik AI agent has acted inappropriately, unfairly, or outside these principles can raise it through the relevant client's support channel or directly with Barbarik AI. Complaints are reviewed, and corrective action is taken where warranted.

9. Review

This policy is reviewed periodically and updated as our deployments, regulatory obligations, and industry standards evolve.

---

Barbarik AI Private Limited, New Delhi, India