AI patient calls under GDPR: a data-flow checklist for clinics

The short answer

A clinic can use an AI assistant for administrative patient calls, but the safe starting point is the task and its data flow, not the technology label. Booking, moving or cancelling an appointment can be kept narrow. Even then, a caller may volunteer symptoms or other health information, so the workflow must be designed for special-category data before the first live call.

Define which details the assistant may ask for, where each record goes, who may see it, how long it remains and which sentence stops the routine flow. The clinic also needs an applicable GDPR Article 6 lawful basis and, where health data is processed, an Article 9 condition. The exact basis depends on the service and national law, so this article is an implementation checklist, not legal advice.

• Explore Anahera Med for patient-call coordination
• Review Anahera security and privacy controls

Map the call before choosing the tools

Write down the minimum data and the permitted action for each call moment. This exposes unnecessary questions and makes acceptance evidence concrete. The example is deliberately administrative; a clinic should adapt it to its own procedures and system of record.

Treat audio, transcripts, summaries and bookings as separate records

One call can create several records: audio, a transcript, a generated summary, an appointment update and technical logs. They do not need the same purpose, access list or retention period. Decide separately whether audio is needed at all. A useful audit trail can often retain the action, timestamp, rule version and system confirmation without keeping the full conversation.

Keep the caller's source words distinct from generated summaries. Limit the summary to what the next authorised person needs, and make corrections possible without erasing the source or audit event. If a transcript is retained, include it explicitly in access, deletion, export, incident and supplier procedures.

• Design identity checks before appointment changes

Explain the AI at the start and keep a usable human route

For direct interaction, Article 50 of the EU AI Act requires people to be informed that they are interacting with an AI system unless this is obvious. The Commission's guidance says the information should be clear and distinguishable from the start of the first interaction. These transparency duties apply from 2 August 2026.

A spoken notice should be short enough to understand and should not hide the way to reach a person. The caller needs to know who operates the service, that it is AI, what the immediate task is and how to stop or transfer. A recording notice, where recording is used, is a separate message tied to the clinic's actual recording practice.

Model scenario: a cancellation turns into a health concern

Model scenario, not a customer case: a patient calls to cancel tomorrow's visit and then says they are experiencing severe breathing difficulty. The assistant stops the cancellation script and follows the clinic's approved urgent or emergency route. It does not diagnose, calculate an urgency score or reassure the caller that waiting is safe.

Once the safety route has been handled, the appointment may be updated only if the approved workflow says that this task should continue. The record should show the trigger, the route used, whether a person accepted the handoff and the separate status of the cancellation. This avoids turning one generated note into both a clinical judgement and a scheduling confirmation.

Give each role only the access it needs

Reception, the clinical team and supplier support do not need the same view. Reception may need identity and booking status. A clinician may receive information through an approved handoff. Technical support may need an error identifier without the conversation. Map controller and processor responsibilities to the real service, including model, transcription, telephony and hosting providers.

Use role-based access, logged support access and redaction where it reduces exposure. Set retention by record type and purpose, then test deletion and export rather than accepting a platform default. A shorter transcript period does not help if the same details remain indefinitely in summaries, logs or copied case notes.

Six acceptance tests before launch

1. Start an ordinary call and confirm the AI notice is heard before personal data is requested. 2. Book a routine appointment and verify that only approved fields reach the system of record. 3. Volunteer symptoms and confirm the script stops, no diagnosis or urgency score is generated, and the approved handoff is owned.

4. Run the recording-off path and verify which transcript, summary and technical events still exist. 5. Use a proxy caller or wrong recipient and confirm that no patient detail is disclosed before the approved check. 6. Test access, retention, deletion and export for every record type, including a failed supplier-support case.

Keep administration separate from medical AI

This checklist covers the data flow around an administrative patient-call assistant. It does not classify every clinical use of AI. If the system interprets symptoms, recommends treatment, determines urgency or influences access to care, the intended purpose and regulatory analysis change materially.

Keep the boundary visible in prompts, permissions, tests, contracts and staff training. A narrow assistant can still be useful: it handles repeatable administrative work, records an honest outcome and brings a person into the conversation when the request crosses the approved line.

• Compare administrative reception with medical AI under the AI Act