GDPR checklist: Safely implementing an AI phone assistant in the Arztpraxis
The 11 points doctors should clarify before go-live: AVVs, TOMs, sub-processors, EU storage, recording, emergency escalation, and more.
Dr. techn. Alireza Fasih ·
An AI phone assistant answers calls, books appointments, and relieves your practice team – around the clock. But before it goes live in your practice, a justified question arises: Is all of this GDPR-compliant and secure?
We hear this question daily from doctors. That is why we have compiled the most important points you should clarify with your provider before go-live – as a practical checklist. And we will directly answer how Servus KI solves each individual point.
Why a data protection checklist before go-live?
Particularly sensitive data is generated in an Arztpraxis (medical practice) – health data according to Art. 9 GDPR. Anyone using an external service that processes this data remains responsible as the practice. A short, structured review before starting protects you legally and builds trust with your patients.
The 11 points you should clarify
1. Auftragsverarbeitungsvertrag (AVV)
Demand an AVV (Data Processing Agreement) according to Art. 28 GDPR. Servus KI acts as a data processor and provides the contract for signature during onboarding.
2. Technische und organisatorische Maßnahmen (TOMs)
Have the protective measures described to you. At Servus KI, these include encryption in transit and at rest (AES-256-GCM for access credentials), access control according to the need-to-know principle, and strict tenant separation per practice. You can receive detailed documentation of the TOMs (Technical and Organizational Measures) upon request.
3. List of Sub-Auftragsverarbeiter
Ask which service providers are involved and where they are located. Servus KI relies on EU processing – including Hetzner (Germany), LiveKit (Germany), Microsoft Azure OpenAI (within the EU Data Boundary), and Deepgram (EU endpoint). You can find the complete list of Sub-Auftragsverarbeiter (sub-processors) in the privacy policy.
4. Where are audio and transcripts stored?
The data should not leave the EU. At Servus KI, audio and transcripts are processed within the EU; the database runs in Germany, and operations are restricted to the EU via region pinning.
5. Can the recording be turned off?
You should decide for yourself whether recordings are made. At Servus KI, audio recording can be deactivated per agent – upon request, only a transcript or nothing at all is stored.
6. Storage duration and deletion periods
Clarify how long data is kept. The storage duration is configurable at Servus KI and is determined together with you according to the principle of data minimization.
7. Emergency escalation
A phone assistant must be able to handle urgent matters. Servus KI recognizes indications of emergencies and escalates according to your rules – for example, by forwarding the call to the team or providing a clear reference to emergency services (144 in Austria, 112 EU-wide).
8. No diagnosis, no medical advice
An AI assistant must not provide medical assessments. At Servus KI, a firm principle is embedded: no diagnosis, no advice – instead, a referral to the practice or emergency services.
9. Test number and audit logs
Insist on a testing option and traceable logs. Servus KI can be tested live at any time via the demo number +43 720 112963, and every call is logged in the dashboard with a timestamp, duration, and transcript.
10. Connection to calendar and PVS
The assistant should fit into your existing workflows. Servus KI can be connected to common scheduling and PVS (practice management systems) and books appointments directly into the calendar according to your rules.
11. Notice to patients
Transparency is mandatory – and builds trust. Upon request, the greeting from Servus KI includes a clear notice such as, "You are speaking with a digital phone assistant."
Conclusion: Data protection is not an obstacle, but part of the solution
A well-chosen AI phone assistant not only meets these requirements – it demonstrably makes your practice more privacy-friendly because workflows become documented and traceable. It is crucial that your provider relies on EU hosting, provides an AVV, and knows clear boundaries.
You can find all answers at a glance on our Data Protection & Security page.
Would you like to test Servus KI in your practice, or do you have questions about the AVV, TOMs, and the connection to your PVS? Speak with us – we will accompany you from the first question to a secure go-live.