Skip to main content
Famulor
Confidentiality for medical and dental practices
Use this guide to prepare documents for a medical or dental practice in Germany, Austria, or Switzerland. It covers the case where you operate a white-label phone assistant for the practice and process data under its instructions.

Agree on contracts and access

  1. Practice → reseller. The practice can contract with you. Agree on the terms for processing and the applicable confidentiality obligations.
  2. Reseller → Famulor. Get the practice’s prior approval to engage Famulor as a subprocessor. Pass the relevant data protection and confidentiality obligations to Famulor in your agreement. Discuss how those obligations reach any further service providers that need access.
  3. Access and retention. Before the assistant goes live, record the call data it processes, who needs access, and how long the data is kept. The practice checks the requirements for processing patient data and granting access to professional secrets.
In Germany and Austria, Article 28 GDPR governs the processing agreement, prior written authorization of subprocessors, and the transfer of data protection obligations to them. In Switzerland, Article 9 FADP sets the requirements for processing by a processor.

Professional secrecy by country

Germany

Under section 203(3) and (4) of the German Criminal Code, a practice may give service providers involved in its work access to secrets to the extent their tasks require it. Make sure the people involved, including any further people they engage, are bound to secrecy as required.

Austria

Section 54 of the Austrian Medical Act applies to physicians, and section 21 of the Dental Practitioners Act applies to dentists. Both provisions also cover assistants. The practice checks whether the planned access falls within the role of an assistant or requires a separate basis for disclosure.

Switzerland

Professional secrecy under Article 321 of the Swiss Criminal Code also covers assistants. The practice checks which service providers can act in that capacity and whether disclosure requires consent or another authorization. The practice also checks that outsourcing is compatible with its confidentiality obligations and authorizes any further processors in advance. Article 9 FADP · FDPIC guidance on disclosing patient data

Request an agreement or countersignature

If you contract directly with Famulor, request your DPA in the Legal section of your Famulor account. Contact Famulor Support to discuss an addendum or countersignature for the reseller arrangement. Give the country of the practice, the parties to the contracts, and the planned data access. The country declarations for direct customers and their conditions are in the Trust Center.