PonteLegal and compliance
Everything the law requires, and how Ponte handles it
An AI receptionist in a clinic touches health data, artificial intelligence, telecoms and health advertising. We explain each rule in plain language, the risk for the clinic and for us, and what we do about it.
GDPR and health data
What the rule says
GDPR applies to any data that identifies a person. A booking ("implant appointment with Dr X") can reveal health information, which is a special category (Art. 9): it can only be processed under an express exception. For bookings we rely on Art. 6(1)(b) (pre-contract steps and contract) and Art. 9(2)(h) and 9(3), with art. 29 of Portuguese Law 58/2019 (health-care management, under a duty of secrecy).
Official sources: RGPD (Regulamento (UE) 2016/679) · Lei 58/2019
- We collect only what is needed to book: name, contact, appointment type, date. Never symptoms or medical history.
- Lawful basis documented in the DPIA and the data processing agreement.
- Ready-made text for your website privacy notice (script K).
Controller and processor (Art. 28)
What the rule says
The clinic decides what patient data is used for: it is the controller. Ponte processes it only on the clinic's behalf: it is the processor. Art. 28 requires a written contract (DPA) with minimum content: instructions, confidentiality, security, sub-processors, help with rights and breaches, deletion at the end, and audits.
Official sources: RGPD (Regulamento (UE) 2016/679) · EDPB, Diretrizes 07/2020 (responsável e subcontratante)
- We sign a DPA with every clinic on the same day as the contract, with annexes on processing and retention, security measures, sub-processors and contacts.
- Written commitment: we never use clinic data to train AI models, for cross-clinic analytics or for marketing lists.
- One audit a year at your choice, on 30 days' notice.
Data protection impact assessment (DPIA, Art. 35)
What the rule says
When processing uses new technology with sensitive data about potentially vulnerable people, a DPIA is mandatory before starting. The CNPD list (Regulation 798/2018) and EU guidelines confirm it for an AI voice assistant in a clinic. The DPIA belongs to the clinic, as controller.
Official sources: RGPD (Regulamento (UE) 2016/679) · Regulamento CNPD 798/2018 (lista AIPD)
- We hand over a pre-filled DPIA: processing description, 12 assessed risks and the measures for each. The clinic reviews, completes its fields and signs.
- No real call is answered until the clinic confirms in writing that the DPIA is complete.
Minimisation, retention and no audio recording
What the rule says
Data must be the minimum needed and kept only as long as necessary (Art. 5(1)(c) and (e)). Recording calls needs a legal basis and prior notice (Law 41/2004, art. 4).
Official sources: RGPD (Regulamento (UE) 2016/679) · Lei 41/2004
- By default we do not record audio: the call is transcribed in real time to handle the request, and the transcript is not kept.
- Automatic redaction of personal data in the telephony provider's technical logs.
- Automatic deletion: temporary holds up to 72 h; requests until confirmed, max 30 days; masked audit trail 12 months.
- The clinic's software remains the official agenda.
Data security
What the rule says
Art. 32 requires technical and organisational measures appropriate to the risk: encryption, confidentiality, recoverability and regular testing.
Official sources: RGPD (Regulamento (UE) 2016/679)
- Encryption in transit (TLS 1.2+) and at rest, including disks and backups.
- Daily backups with 30-day rotation, on servers in Germany.
- Minimal, logged access, and a duty of secrecy equivalent to professional secrecy for anyone with access.
Sub-processors and international transfers
What the rule says
A processor may only use other vendors with the clinic's authorisation and equivalent contracts (Art. 28(2) and (4)). Data leaving the European Economic Area needs a transfer mechanism, such as Standard Contractual Clauses or the Data Privacy Framework (Arts. 44–46).
Official sources: RGPD (Regulamento (UE) 2016/679) · Cláusulas Contratuais-Tipo (Decisão 2021/914) · EU-U.S. Data Privacy Framework (Decisão 2023/1795)
- Sub-processor list in DPA Annex III: telephony and voice (Telnyx) and hosting (Hetzner, Germany).
- We use EU regions and servers wherever the vendor offers them. To be transparent: the telephony provider is a US company and does not guarantee EU-only processing for every component (e.g. failover, support and billing); those transfers rely on Standard Contractual Clauses and, where applicable, the Data Privacy Framework.
- 30 days' notice before any new sub-processor, with a right to object.
Patient rights
What the rule says
Patients have rights of access, rectification, erasure, restriction, objection and portability (Arts. 15–22). The clinic normally answers within one month.
Official sources: RGPD (Regulamento (UE) 2016/679) · Lei 15/2014 (direitos dos utentes)
- We locate and delete a patient's data within 5 working days at the clinic's request.
- If a patient asks about their data during a call, Clara logs the request and passes it to the clinic (script I).
Data breaches: 72 hours
What the rule says
The controller notifies the CNPD within 72 hours of becoming aware of a breach (Art. 33) and informs data subjects when the risk is high (Art. 34). The processor alerts the controller without undue delay.
Official sources: RGPD (Regulamento (UE) 2016/679) · CNPD
- We alert the clinic within 24 hours, by phone and email, with the information available.
- We help with the CNPD notification and patient communication, and make no public statement without the clinic's agreement.
AI Act: always say it's an AI (Art. 50)
What the rule says
People talking to an AI system must be told so, unless it is obvious. This duty applies from August 2026 and was not postponed.
Official sources: Regulamento da IA, art. 50.º · Regulamento da IA (UE) 2024/1689
- The first sentence of every call and every written conversation says it is an AI assistant, that the call is transcribed and that the caller can speak to the team.
- The opening script is approved in writing by the clinic and cannot be removed.
Why Clara is not high-risk AI
What the rule says
AI Act Annex III lists emergency patient triage and emergency-call evaluation systems as high-risk. Under the Digital Omnibus (Regulation 2026/1744), these rules apply from 2 December 2027. Software that informs diagnostic or therapeutic decisions can be a medical device; scheduling and admission software is not (MDCG 2019-11).
Official sources: Regulamento da IA, Anexo III · Regulamento (UE) 2026/1744 (Omnibus Digital IA) · MDCG 2019-11 (software dispositivo médico)
- Clara is administrative only: clinic-approved general information, bookings, reschedules, cancellations and callback requests.
- She does no triage, does not assess symptoms or urgency, and never gives medical advice.
- Fixed rule: if someone mentions a possible emergency, she reads the 112 / SNS 24 (808 24 24 24) script and, during staffed hours, offers to transfer the call.
- The contract prohibits use for clinical triage.
Professional secrecy and human handover
What the rule says
Anyone processing health data is bound by secrecy (Law 58/2019, art. 29). Portuguese call-handling rules (DL 134/2009) call for a person to answer during business hours and for quick transfers.
Official sources: Lei 58/2019 · DL 134/2009 (atendimento telefónico)
- Patients can ask to speak to the team; during staffed hours the transfer starts within 60 seconds.
- Out of hours, Clara logs a callback request and the clinic calls back within 2 working days.
- Before revealing an existing appointment, she checks two identifiers. She never reads out clinical information.
Health advertising (Social media and Reviews)
What the rule says
Advertising health services has its own rules (DL 238/2015, enforced by the ERS): truthful information, no promised results, no pushing unnecessary treatment. The Portuguese Dental Association's code of ethics (OMD, art. 43) is stricter still: no identifying patients, no "free", no self-praise, and "specialist" only for OMD-awarded specialties.
Official sources: DL 238/2015 (publicidade em saúde) · ERS, perguntas frequentes sobre publicidade em saúde · ERS, Manual de boas práticas de publicidade em saúde · OMD, Código Deontológico (art. 43.º)
- Every post goes through a compliance check (DL 238/2015 and OMD art. 43) before it reaches the clinic.
- No patient photos, names or testimonials; no before/after; no "free consultation", promises or "best clinic".
- Nothing is published without the clinic's approval.
- Health questions in comments get a general answer and an invitation to a private channel.
Google reviews
What the rule says
Google's policies prohibit offering incentives for reviews and asking only happy customers. Portugal's unfair commercial practices law (DL 57/2008) prohibits fake or manipulated reviews.
Official sources: Google, política de conteúdo de contribuições · DL 57/2008 (práticas comerciais desleais)
- Review requests go to all patients after their visit, with no filtering and no incentives.
- Suggested replies never confirm that someone is a patient or mention treatments; the clinic approves each reply.
Reminders, recall and unsolicited marketing
What the rule says
Marketing by automated calling systems, SMS or email requires people's prior express consent (Law 41/2004, art. 13-A), with limited exceptions for existing customers and an always-available opt-out. A reminder for a booked appointment is part of the service; a recall message ("it's been 6 months") is marketing.
Official sources: Lei 41/2004, art. 13.º-A · Lei 41/2004 · RGPD (Regulamento (UE) 2016/679)
- In the pilot, Clara places no calls: reminder, recall and review calls only by written addendum with an updated DPA and DPIA.
- The Reminders & Recall module (coming soon) will separate reminders from marketing and send recall only to people who consented, with an opt-out in every message.
- In our own outreach to clinics we use no automated calls or bulk messaging.
WhatsApp and Meta
What the rule says
WhatsApp's business messaging policies require opt-in before a business starts a conversation, approved templates outside the 24-hour window, immediate respect for opt-outs and clear business identification.
Official sources: WhatsApp Business Messaging Policy
- The assistant replies to people who write first; clinic-initiated messages go only to people who opted in, using approved templates.
- It never asks for or sends clinical details by message; it hands the conversation to reception with a summary.
The pilot contract: clear terms
What the rule says
Contracts with pre-drafted clauses fall under Portugal's standard contract terms law (DL 446/85): they must be communicated and explained, and some clauses are prohibited.
Official sources: DL 446/85 (cláusulas contratuais gerais)
- Free 30-day pilot from go-live, with no monthly fee, setup fee or telecoms costs.
- Converts to a subscription only if you don't give notice by day 25; we send a reminder by day 18 and the results report by day 20.
- If go-live hasn't happened within 45 days of signing, either party can walk away at no cost.
- After that, month to month with 30 days' notice. 99.5% monthly availability target, with credits if we miss it.
- Prices exclude VAT. Health clinics are generally VAT-exempt (CIVA art. 9) and can't reclaim it, so VAT is a real cost: we always show both figures.
- Contract in Portuguese and English; Portuguese prevails; Portuguese law.
Liability: what we cover and what stays with the clinic
What the rule says
The law allows business-to-business liability limits, but not for wilful misconduct or gross negligence, or for harm to life, physical integrity or health (Civil Code art. 809; DL 446/85 art. 18). Patients' rights under GDPR Art. 82 cannot be limited.
Official sources: DL 446/85 (cláusulas contratuais gerais) · RGPD (Regulamento (UE) 2016/679)
- Each party's liability is capped at the greater of the amount paid in the last 12 months and €5,000, including during the pilot. No cap where the law doesn't allow one.
- The clinic keeps: all clinical decisions, the patient relationship, the accuracy of the information it gives us, answering the transfer line, returning callbacks within 2 working days, the privacy notice on its website and its complaints book.
- The clinic always keeps its own number and an alternative contact route; if the service fails, calls fall back to the clinic's line.
Our website: cookies and accessibility
What the rule says
Cookies and similar technologies that are not strictly necessary require consent (Law 41/2004, art. 5). Accessibility rules (DL 83/2018) apply to the public sector; we follow them as good practice.
Official sources: Lei 41/2004 · DL 83/2018 (acessibilidade web)
- This site uses no cookies, analytics or trackers, and fonts are hosted on the site itself (no requests to Google Fonts).
- Semantic structure, good contrast and keyboard navigation.
Frequently asked questions
Does Clara record calls?
Not by default. The call is transcribed in real time to handle the request and the transcript is not kept. Recording is enabled only on the clinic's written instruction, and the clinic then owns the legal basis and patient notice.
Where is the data processed?
We use EU regions and servers wherever the vendor offers them, and our technical ledger is in Germany. The telephony provider is a US company and does not guarantee EU-only processing for every component; those transfers are covered by Standard Contractual Clauses. The DPA explains it all.
Is my patients' data used to train AI?
No. It is written into the contract and we require the same of our vendors.
Can Clara tell a patient whether it's urgent?
No. She does not assess symptoms. If anyone mentions a possible emergency, she points them to 112 and SNS 24 and, during staffed hours, transfers the call.
What if Clara goes down?
Calls fall back to the clinic's line. We target 99.5% monthly availability, with credits if we miss it.
Do I need to change my number?
No. Patients call the same number; the clinic chooses whether Clara answers every call or only when the line is busy, nobody answers or after hours.
Who is the data controller?
The clinic. Ponte is the processor and handles data only on the clinic's instructions, under the DPA.
Documents available on request
- Pilot and Subscription Agreement (PT/EN)
- Data Processing Agreement, GDPR Art. 28 (PT/EN), with security and sub-processor annexes
- Pre-filled Data Protection Impact Assessment (DPIA), or a summary
- Call scripts in pt-PT (opening, emergency, handover, medical questions, privacy)
Ask for them by email: koig@mail.grokbot.com (temporary contact).