AI receptionist in a clinic: calls, appointments and GDPR, at one site or several
To stay in control, every call and every appointment at your clinic follows the same rules, whoever handles it. The most direct way is an AI receptionist that books the appointment into a free slot in your diary and passes anything that needs judgement to a person. At one site it spares you interruptions, across several it keeps a single standard, and with health data it pays to check the GDPR first.
David Zafra · · 10 min read ·
- One site and several share the same problem: the phone rings while the team is with a patient.
- With several sites there is a second one: each site ends up answering in its own way.
- The AI receptionist should write into your diary, not keep a separate one.
- Emergencies and clinical questions always go to a person on the team.
- With health data, ask any provider where the data is stored and under what contract (GDPR).
Why do a clinic's calls and appointments get into a mess?
Because the phone rings just when reception is with a patient.
In a dental clinic, whoever is on the front desk is taking a payment or confirming a treatment. In physiotherapy, the team is in a session and nobody looks at the phone. In an aesthetic clinic, a consultation is not interrupted. A call, a WhatsApp message and a notification from the booking portal all come in at once.
At one site, that is manageable because everyone knows the rules. When the second opens, something changes: each site decides in its own way how much notice is needed to cancel, what people are asked to bring or when an appointment can be moved. A client cancels her 6 pm appointment and, depending on who answers, the slot is either filled or lost.
What changes between a clinic with one site and one with several?
One site needs to answer every time. Several also need to answer the same way.
| One site | Several sites | |
|---|---|---|
| Main problem | Unanswered calls while the team is busy | Different rules depending on the site and on who answers |
| What needs deciding | Services, durations and opening hours | The same, written once for all of them |
| Phone number | The clinic's own | One line per site, or a single number that routes the call |
| Diary | One | One per site, with its own team and hours |
| What to keep an eye on | Calls answered and appointments booked | The same, per site and overall |
According to the digaclinic page, each centre can have its own line or share a single number that routes each call to the right centre. Each centre keeps its own diary, hours and team, and the dashboard shows every centre.
How do you automate appointments without breaking the diary?
With an AI receptionist that reads and writes in the diary you already use, not in a copy.
The diary is the one thing that cannot fail. That is why the AI receptionist does not keep a diary of its own: it checks for a free slot at the moment of the call and writes the appointment in before hanging up. That way it does not offer a time another patient already has.
| If you use | What it reads | What it writes |
|---|---|---|
| Doctoralia | Availability by practitioner and speciality, the length of each visit, insurers and published prices | New appointments, time changes and cancellations, and call notes |
| Gesden | The diary by surgery and practitioner, the length of each treatment, the patient's history | New appointments in the right surgery, day-before confirmations, cancellations and notes on the patient's record |
Neither one is replaced. According to its page, digaclinic does not replace Gesden, and Doctoralia remains the shop window and the public diary. If you use other software, such as Clinic Cloud or Google Calendar, there is a connection for that too.
Which calls have to go to a person?
Emergencies and anything clinical.
| The AI receptionist handles it | It goes to a person |
|---|---|
| Booking, moving or cancelling an appointment | An emergency |
| Confirming the appointment the day before | A question about a symptom or a treatment |
| Answering with the published opening hours and prices | A complaint |
| Telling the waiting list about a free slot (from Diga Growth) | Anything the clinic has not published |
According to the digaclinic page, it does not diagnose, assess symptoms or give clinical advice. It identifies emergencies and transfers them to a person on the team as quickly as possible. If it does not know something, it passes it on: it never improvises.
What does the GDPR say if an AI handles your clinic's patients?
That health data has a regime of its own, and that you must choose carefully who processes it on your behalf. This section sets out what the cited texts say; it is not legal advice.
- Article 9.1 of the GDPR prohibits the processing of, among other categories, “data concerning health”, save for the exceptions the article itself provides for.
- Under Article 28.1, where processing is carried out on behalf of a controller, the controller shall use only a processor that provides sufficient guarantees. Processing by the processor shall be governed by a contract or other legal act (Article 28.3).
- The Spanish Data Protection Agency (AEPD) adds, among other obligations, that the processor keeps its own record of processing activities. It also determines the security measures for what it processes.
Before hiring any provider, heydiga included, ask:
| Question | What heydiga states on its website |
|---|---|
| Where is the data? | Servers in the European Union; it does not transfer data outside the European Economic Area without first ensuring appropriate safeguards, such as standard contractual clauses |
| Is it encrypted? | Encrypted in transit and at rest |
| What certifications does it hold? | Spain's National Security Framework (Esquema Nacional de Seguridad), medium category (Royal Decree 311/2022), and ISO/IEC 27001:2022 |
| Are calls recorded? | Only if the business turns it on |
| Is there a data processing agreement? | Ask for it in writing: it does not appear on heydiga's public pages |
The answers in the right-hand column are the provider's own statements, not an audit. For your clinic, decide with whoever is in charge of data protection or with your adviser.
Also ask any provider: whether it uses conversations to train its models, how long it keeps them, how it handles access and erasure requests, what activity log it keeps, how it reports an incident and which sub-processors are involved.
What should you measure?
How many calls are answered and how many end in an appointment, per site and overall.
| What you measure | What it tells you |
|---|---|
| Calls answered | Whether demand gets an answer there and then |
| Appointments booked or moved | Whether calls lead to something concrete |
| Out-of-hours calls | How much demand comes in while the clinic is closed |
| Cancellations and slots refilled | Whether the diary is used to the full |
| Calls passed to a person | Whether the handover rules work |
A first step: review a week of calls
Before changing anything, note down over a normal week, at each site:
- How many calls are answered and how many are missed, by hour and by day.
- Which ones are always the same question and which ones need judgement.
- Which rules depend on who answers: cancellations, what to bring, when to arrive.
- Which diary each appointment ends up in.
If the missed calls cluster while the team is with patients, you are looking at a clinic with a busy front desk. If they cluster while the clinic is closed, see after-hours calls. And for the problem in any business, read how to stop missing customer calls.
How do you test it before signing up?
With a test diary and made-up patients. If you test it with your real diary, sign the data processing agreement first. Note how each case ends: completed, pending confirmation, passed to a person or unavailable.
| Case | What should happen |
|---|---|
| A first visit with a specific practitioner | It books it in their diary, with the length of that visit |
| A change and a cancellation | It makes them in the diary and frees up the slot |
| A slot that has just been taken through another channel | It does not offer it |
| A question the clinic has not loaded | It does not improvise: it passes it on |
| An emergency | It passes it to a person according to your protocol |
| The diary does not respond | The appointment stays pending and it alerts a person |
Depending on the speciality, also test:
| Speciality | What to test |
|---|---|
| Dental | The length of each treatment and the surgery |
| Physiotherapy | Session packs, consecutive sessions and the same physiotherapist |
| Aesthetic medicine | Whether the first appointment is an assessment and how long it lasts |
| Veterinary | The animal's species and how emergencies are passed on |
| Psychology | That it does not ask about the reason for the visit beyond what is needed to book |
One rule for any provider, heydiga included: if the diary does not respond, the appointment cannot be taken as booked.
Where heydiga fits
The AI receptionist of digaclinic, heydiga's product for health and wellness businesses, answers your clinic's calls in a natural voice. With the conversational WhatsApp add-on, it answers WhatsApp too. It works 24/7. It books according to each practitioner's and each surgery's diary, confirms the day before and, from Diga Growth, notifies the waiting list.
- For dental clinics, see the dental clinics page; for physiotherapy, the physiotherapy and rehabilitation one.
- With Doctoralia or Gesden, it writes the appointment into the diary you already use.
- Diga Start: €99 a month excl. VAT, with 500 minutes, and it includes the connection to your sector's software. Conversational WhatsApp is an add-on at €39 a month excl. VAT on any plan.
- Diga Pro, at €279 a month excl. VAT, is designed for groups with several centres and is the only plan that books across all your centres. No lock-in.
Nothing to install, no change of software and no touching the clinic's number.
Request a demo of the AI receptionist
Frequently asked questions
Does it work for a clinic with a single site?
Yes. The underlying problem is the same: the phone rings while the team is with a patient. At one site, the AI receptionist answers, books the appointment and keeps the diary up to date. Having several sites only adds that each one keeps its own diary and team.
Does it replace Doctoralia or Gesden?
No. Doctoralia remains the shop window and the public diary, and Gesden remains the clinic's management software. The AI receptionist answers the phone and writes into them.
Can it double-book an appointment?
It shouldn't: it checks availability at the moment of the call, before offering a time. If the diary changes between the call and the booking, that is the reason to review the connection with your software.
Will the patient know they are talking to an AI?
Yes. heydiga's AI receptionist introduces itself as a virtual assistant from the very start. If the patient would rather speak to someone on the team, the call is passed on.
Does it give medical advice?
No. It does not diagnose, assess symptoms or give clinical advice. It passes those questions, and emergencies, to a person on the team.
Who is accountable for patient data?
The clinic, as controller, chooses who processes it on its behalf. Ask any provider for the processing agreement in writing, and review what it states with whoever is in charge of data protection.
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 9.1, 28.1 and 28.3, Official Journal of the EU, 2016, on the BOE (opens in a new tab), Spain's official gazette.
- AEPD, “¿Qué obligaciones específicas contiene el RGPD para los encargados de tratamiento?”, FAQ, accessed 29 October 2026, aepd.es (opens in a new tab).
- Features, integrations, data protection and prices: digaclinic, Doctoralia, Gesden, dental clinics, physiotherapy and rehabilitation, privacy and pricing, accessed 29 October 2026.
How it was written: written with the help of AI tools; reviewed and verified by the heydiga team.
