Clinics and practices: booking by AI assistants and patient data — what to ask before you connect anything

This guide covers administration only: how appointments get made. It makes no medical claims and is not legal advice. Your national data-protection authority and your professional body are the right places to confirm what applies to you.

Why clinics need extra care

Under the GDPR, data concerning health is a special category of personal data, listed in Article 9 (see the regulation on EUR-Lex). Even a booking can reveal health information: the name of a clinic, a specialist, or a reason for the visit. Treat the whole appointment trail as sensitive until your data-protection advisor tells you otherwise.

Seven questions to ask before you connect anything

1. What exactly does the tool receive? List every field. If it takes free text, assume patients will type symptoms into it. Prefer a form with fixed options (service, time, contact) and no "reason for visit" box.
2. Who is the processor, and is there a contract? A supplier that handles personal data for you is generally a processor, and the GDPR (Article 28) calls for a written agreement with it. Ask for it before signing up, not after.
3. Where is the data stored and processed? Ask for the country, and whether any AI model providers or sub-processors outside the EU are involved. Get the list of sub-processors.
4. Is patient data used to train models? Ask for a plain yes or no, in writing.
5. How long is it kept, and can you delete or export it? You need to be able to answer a patient's request to see or erase their data.
6. Who can see what? Ask about staff access, logs and what is recorded when an assistant or a phone line handles a call.
7. Do you need a data protection impact assessment? Article 35 requires one for certain high-risk processing. Whether yours qualifies is a question for your data-protection advisor, and it is better asked before the tool goes live.

Practical settings that reduce risk

• Separate scheduling from clinical records. A booking tool should not be where clinical notes live.
• Minimise. Collect the least data you can: no date of birth, no identification number, no reason for visit unless you truly need it to schedule.
• Be clear with patients. Say in the privacy notice how bookings are made, including by automated assistants or phone systems, and who receives the data.
• Calls. If a phone assistant answers, check whether calls are recorded or transcribed and what notice or consent your country requires. If in doubt, switch recording off.
• Agents booking for patients. When software books for a person, confirm the booking with the person themselves by a channel you trust, and do not exchange clinical details through the agent.
• Reminders. A reminder that names a specialty can disclose health information if someone else sees the phone. Keep wording neutral.

What to put in a short written policy

1. Which channels may be used to book (phone, web form, assistants).
2. Which fields are collected, and which are never collected.
3. Who the processors are and where the data sits.
4. How long booking data is kept.
5. Who to contact about a patient's data request.

For related points on reminders and cancellation rules, see our guide on no-shows, deposits and reminders.