Status: DRAFT
TL;DR: Healthcare practices in Ireland using AI receptionists must comply with GDPR's strict rules on processing patient data — including call recordings, appointment details, and health information. Most US-based AI receptionist tools don't meet these requirements. This guide explains exactly what Irish dental practices, physios, and clinics need to check before deploying an AI phone system, and how to stay on the right side of the DPC.
AI receptionists are transforming how healthcare practices handle phone calls. They answer instantly, book appointments, triage emergencies, and never call in sick.
But there's a question most practice owners don't ask until it's too late: Where is my patients' data going?
When a patient calls your dental practice and tells an AI receptionist their name, phone number, appointment type, and insurance details — that's personal data. When they mention a toothache or a AI receptionist for medical practices condition — that's special category data under GDPR, subject to the strictest protections in EU law.
Get this wrong, and you're not just risking a fine. You're risking your patients' trust and your practice's reputation.
Why Does GDPR Apply to AI Receptionists?
GDPR applies to any processing of personal data. When an AI receptionist:
- Records or transcribes a phone call → processing personal data
- Stores a caller's name and phone number → processing personal data
- Logs appointment details (type, time, practitioner) → processing personal data
- Notes any health-related information → processing special category data (Article 9)
It doesn't matter whether the AI is cloud-based or on-premises. It doesn't matter whether a human ever listens to the recording. The moment data is captured, GDPR applies.
The Irish Data Protection Commission (DPC) has been clear: AI tools in healthcare are not exempt from data protection law. In their 2025 guidance on AI and Fundamental Rights, the DPC specifically flagged automated telephone systems in healthcare as an area of increasing concern.
What Are the Biggest GDPR Risks with AI Receptionists?
Cross-Border Data Transfers
This is the #1 risk for Irish practices. If your AI receptionist is provided by a US company, there's a strong chance that call data — including recordings, transcriptions, and patient details — is processed on US servers.
Since the Schrems II ruling invalidated the EU-US Privacy Shield, transferring personal data to the US requires:
- Standard Contractual Clauses (SCCs) with a supplementary Transfer Impact Assessment
- Or the new EU-US Data Privacy Framework (DPF) certification
Many smaller AI companies haven't completed either. That means every patient call processed through their system could be an unlawful data transfer.
The DPC has issued fines totalling €2.8 billion since 2018, with Meta's €1.2 billion fine in 2023 specifically for unlawful US data transfers. Healthcare practices aren't Meta-sized, but the principle — and the enforcement appetite — is identical.
Insufficient Legal Basis
To process health data, you need one of the legal bases in Article 9(2). For healthcare AI receptionists, the most likely bases are:
- Explicit consent (Article 9(2)(a)) — The patient actively agrees to AI processing
- Healthcare provision (Article 9(2)(h)) — Processing necessary for healthcare delivery, by or under the responsibility of a health professional
Relying on "legitimate interest" alone is not sufficient for health data. Your AI provider should help you document which legal basis applies and how consent is obtained.
Lack of Transparency
Under Articles 13 and 14, patients have a right to know:
- That they're speaking with an AI system (not a human)
- What data is being collected
- How long it's retained
- Who processes it and where
- Their rights (access, erasure, objection)
A brief statement at the start of the call — "This call is handled by an AI assistant. Your data is processed in the EU under our privacy policy." — goes a long way toward compliance.
Inadequate Data Processing Agreements
If your AI receptionist provider processes data on your behalf, they are a data processor under GDPR. You need a Data Processing Agreement (DPA) that covers:
- Scope and purpose of processing
- Data security measures
- Sub-processor disclosures
- Data breach notification procedures
- Data deletion upon contract termination
No DPA = no lawful processing. It's that simple.
What Should Irish Healthcare Practices Check Before Choosing an AI Receptionist?
Here's a practical compliance checklist:
✅ Data Residency
- [ ] Where are servers located? (Must be EU/EEA or adequate jurisdiction)
- [ ] Where are call recordings stored?
- [ ] Where does transcription happen?
- [ ] Are any sub-processors outside the EU?
✅ Legal Documentation
- [ ] Does the provider offer a GDPR-compliant DPA?
- [ ] Is there a clear privacy policy covering AI call handling?
- [ ] Is the legal basis for processing documented?
✅ Patient Rights
- [ ] Can patients request access to their call recordings/transcripts?
- [ ] Can patients request deletion of their data?
- [ ] Can patients opt out of AI handling and speak to a human?
- [ ] Are patients informed they're speaking with an AI?
✅ Security
- [ ] Is data encrypted in transit and at rest?
- [ ] Are access controls in place (who can listen to recordings)?
- [ ] Is there a data breach notification procedure (72-hour rule)?
- [ ] Are regular security audits conducted?
✅ Retention
- [ ] How long are call recordings kept?
- [ ] How long are transcriptions retained?
- [ ] Is there automatic deletion after the retention period?
- [ ] Can you configure retention periods per your practice policy?
How Do US-Based AI Receptionists Compare on GDPR?
Most US-built AI receptionist tools — including popular options like Arini and Slang AI — were designed for the American market where HIPAA (not GDPR) is the relevant regulation.
Key differences that affect Irish practices:
| Requirement | HIPAA (US) | GDPR (Ireland/EU) |
|---|---|---|
| Scope | Healthcare only | All personal data |
| Consent | Implied for treatment | Must be explicit for health data |
| Data location | No restriction | EU preferred, strict transfer rules |
| Right to erasure | Limited | Absolute (with exceptions) |
| Breach notification | 60 days | 72 hours |
| Fines | Up to $2M per violation | Up to €20M or 4% global revenue |
A tool that's "HIPAA compliant" is not automatically GDPR compliant. These are fundamentally different frameworks, and Irish practices need tools built for European data protection law.
How Does VoiceFleet Handle GDPR for Healthcare Practices?
VoiceFleet was built in Ireland, for Irish businesses, with GDPR at its foundation — not as an afterthought:
- EU data processing — All call data is processed and stored within the European Union. No transatlantic data transfers.
- Standard DPA included — Every healthcare account includes a comprehensive Data Processing Agreement, ready for your DPC audit file.
- AI disclosure — Callers are informed they're interacting with an AI assistant at the start of each call.
- Configurable retention — Set call recording and transcription retention periods to match your practice policy (default: 90 days, configurable from 30 days to 2 years).
- Right to erasure — One-click patient data deletion from your dashboard, with confirmation and audit trail.
- Encryption — AES-256 at rest, TLS 1.3 in transit. SOC 2 Type II certification in progress.
- Irish local numbers — +353 numbers for Dublin, Cork, Galway, and nationwide. Patients call a familiar local number.
- Dentally integration — Direct integration with Ireland's most-used dental PMS, keeping data within GDPR-compliant systems end-to-end.
What Should You Do Right Now?
If you're already using an AI receptionist (or planning to), take these steps this week:
- Request your provider's DPA — If they can't produce one, that's a red flag.
- Check data residency — Ask explicitly: "Where are my patients' call recordings stored?" If the answer is "US" or "we're not sure," you have a problem.
- Review your privacy policy — Does it mention AI-assisted call handling? It should.
- Add an AI disclosure — Ensure callers know they're speaking with an AI system.
- Document your legal basis — Record which Article 9(2) basis you're relying on and keep it in your GDPR compliance file.
The DPC's enforcement activity in healthcare AI is increasing. Proactive compliance is always cheaper than reactive remediation.
Frequently Asked Questions
Do I need patient consent before using an AI receptionist?
It depends on your legal basis. If you're relying on Article 9(2)(h) — processing necessary for healthcare provision — explicit consent may not be required for appointment booking. However, for call recording and transcription, explicit consent or a clear legitimate basis is strongly recommended. Always inform the caller that AI is handling the call.
Can the DPC fine a small dental practice for GDPR violations?
Yes. GDPR fines apply regardless of organisation size. While the DPC typically takes a proportionate approach, even small practices can face fines of €10,000-50,000 for systematic violations — particularly involving health data. More commonly, the DPC issues enforcement notices requiring you to stop processing until you're compliant, which effectively shuts down your phone system.
Are call recordings considered health data under GDPR?
If the recording contains any information about a patient's health condition, treatment, or appointment type — yes, it's special category data under Article 9. Even a caller saying "I need an emergency appointment for a broken tooth" creates a health data record. This is why GDPR-compliant retention and processing are essential.
What's the difference between GDPR and HIPAA for AI receptionists?
GDPR (EU/Ireland) is broader, stricter, and applies to all personal data — not just healthcare. It requires EU-based processing (or valid transfer mechanisms), explicit consent for health data, 72-hour breach notification, and gives patients an absolute right to erasure. HIPAA only covers US healthcare entities and has weaker patient rights. A "HIPAA-compliant" tool is not automatically GDPR-compliant.
How long should I keep AI receptionist call recordings?
There's no single GDPR-mandated retention period. The principle of data minimisation says you should keep data only as long as necessary. For healthcare appointment calls, 90 days is a common default — long enough to resolve disputes or verify bookings, short enough to respect patient privacy. VoiceFleet lets you configure retention from 30 days to 2 years to match your practice policy.
Protect your patients' data and your practice's reputation. Book a VoiceFleet demo to see GDPR-compliant AI reception in action — with Irish local numbers and EU-only data processing.
