Healthcare Compliance

Security for Medical Practices

How we protect patient data with privacy-by-design architecture

Download Security Architecture (PDF)
ISO 27001

About ISO 27001 Certification

Transparent Disclosure

AIAgens services run in ISO 27001 certified datacenters in Switzerland and the EU. Our internal security policies are written to the ISO 27001:2022 framework and are actively followed, and our key technology providers hold SOC 2 Type II certifications.

What We Offer

  • ISO 27001 aligned policies
  • Voice AI provider SOC 2 Type II certified; datacenter ISO 27001 certified
  • GDPR & Swiss FADP compliance
  • EU Data Residency
  • Data Processing Agreement available

Legal Basis

  • Swiss FADP does not require ISO 27001
  • Requires 'adequate technical measures'
  • Voice AI provider holds SOC 2 Type II; datacenter holds ISO 27001
  • Art. 321 CP auxiliary compliance
Privacy by Design

Zero Audio Retention Architecture

Voice audio is never recorded — only booking data is retained

No Call Recording

Voice conversations are never recorded or stored

Real-Time Processing

Voice data processed in-memory and immediately discarded

Appointments Only

Only scheduling data stored (date, time, name)

Data Processing by Product

Medical Triage Routing: processes conversation data to match patients with practitioners based on specialty recognition. Does not provide clinical assessments or medical diagnoses.

Swiss Law

Swiss Legal Framework

Regulation Requirement Status
nLPD/FADP Adequate technical and organizational measures Compliant
Art. 321 CP Professional secrecy for healthcare auxiliaries Compliant
GDPR EU data protection regulation Compliant
Swiss-US DPF Sub-processors DPF certified (payments, Voice AI, calendar/OAuth) Certified Providers

Art. 321 CP - Auxiliary Status

Under Swiss criminal law, IT service providers are recognized as 'auxiliaries' of healthcare professionals. This means we are bound by the same professional secrecy obligations as your staff, with criminal penalties for violations.

EU AI Act

EU AI Act Compliance

Classification under Regulation (EU) 2024/1689

Product Classification Requirements Status
AI Concierge
Appointment scheduling only
 Not High-Risk Art. 50 transparency (AI disclosure) Implemented
Medical Triage Routing
Intelligent appointment routing
 Standard AI System Transparency obligations (Art. 50 EU AI Act) Under Evaluation

AI Act Classification

Standard AI system for administrative appointment routing. Not clinical decision support. Transparency obligations under Art. 50 EU AI Act apply. The system routes patients to appropriate practitioners based on specialty recognition — it does not assess clinical urgency or make medical decisions.

Data Retention

Data Retention Policy

Clear retention periods by data type and product

Data Type AI Concierge Medical Triage Routing Legal Basis
Voice Audio Zero (audio never stored) Zero (audio never stored) Privacy by Design
Conversation Transcript Zero retention (real-time processing only) Zero retention (real-time processing only) nLPD Art. 6 / Quality assurance
Clinical Notes (E2E encrypted) N/A Per provider agreement (E2E encrypted) Healthcare regulations (controller)
Appointment Data Per Google Calendar Per Google Calendar Customer controlled
Audit Logs 1 year 10 years OPDa Art. 4

Audio, Transcript and Clinical Notes: Distinction

Voice audio: the audio signal is never recorded or stored by AIAgens. Transcripts: AIAgens operates with zero retention — conversation data is processed in real-time and never stored. Long-term retention in the patient record is the healthcare provider's (controller's) responsibility. E2E clinical notes: encrypted with the provider's key, stored in zero-knowledge mode — only the provider can decrypt them.

Patient Consent

Medical Consent Framework

Granular consent framework for Swiss healthcare compliance (nLPD Art. 6, Art. 321 StGB)

Call Recording Consent

Explicit permission to record voice calls for quality and medical documentation (Art. 179ter SCC, nLPD Art. 6)

Routing Data Consent

Processing of conversation data for intelligent appointment routing to match patients with the appropriate practitioner.

Transcript Storage Consent

Permission to store encrypted conversation transcripts for medical records (GDPR Art. 9(2)(h))

All consent is freely given and revocable at any time. Withdrawal does not affect the lawfulness of prior processing.

Application Security

Application-Layer Security

OWASP-aligned controls protecting your data

SQL Injection Prevention

Parameterized queries with column whitelisting across all database operations

Cross-Site Scripting (XSS) Prevention

innerHTML escaping, SVG upload blocking, and Jinja2 template output protection

Path Traversal Protection

Filename sanitization prevents directory traversal attacks

Upload Size Limits

Maximum request size of 10MB enforced at application level

Webhook Signature Verification

All inbound webhooks verified via HMAC-SHA256 or JWT signatures (Voice AI, Gmail, WhatsApp, Calendly, SES/SNS)

PII Masking in Logs

Email addresses and sensitive data automatically redacted from application logs

Rate Limiting

Upload endpoints limited to 5-10 requests per hour to prevent abuse

TOM

Technical & Organizational Measures

Complete security controls per nLPD/FADP Art. 8 and OPDa

Measure Implementation Standard
Encryption at Rest AES-256-GCM NIST SP 800-38D
Encryption in Transit TLS 1.3 RFC 8446
E2E Medical Notes RSA-2048 + AES-256-GCM (Hybrid) Zero-Knowledge
Access Control Role-based access + TOTP MFA NIST AC-2
Audit Logging Immutable hash chain, 10y retention OPDa Art. 4
Multi-Tenant Isolation PostgreSQL RLS Row-Level Security
Session Security Max 3 concurrent, 24h timeout OWASP
Voice Zero Retention Real-time processing only Privacy by Design
Data Residency 100% EU (Germany) GDPR Art. 44
DDoS Protection Rate limiting + DDoS protection L3/L4/L7
Backup GPG-encrypted, daily, EU-only 3-2-1 Rule
Transcript Encryption at Rest AES-256-GCM NIST SP 800-38D
Routing Data Encryption AES-256-GCM NIST SP 800-38D

Our Third-Party Voice AI Provider (EU) holds SOC 2 Type II and HIPAA certifications

EU-Only Infrastructure

Healthcare Stack

EU-only infrastructure for medical practices

Service Provider type Location Data Retention
Voice AI Third-Party Voice AI Provider (EU) EU Never stored
Calendar Google Calendar (customer's own account) EU (Belgium) Per provider policy
Email Transactional email provider Switzerland 30 days
Hosting Hosting provider — ISO 27001 certified datacenter EU (Germany) Account duration
Payments Payment processor (EU) EU (Ireland) Legal requirement

The complete list with the legal names of each sub-processor is available on request, under a signed NDA: contact dpo@aiagens.ch. For the DPA: legal@aiagens.ch.

Third-Party Compliance

Google Calendar & Swiss Regulations

How we ensure compliance when integrating with Google services

Data Privacy Framework

Since September 2024, Switzerland formally recognizes the Swiss-US Data Privacy Framework. Google is DPF certified, making data transfers legally compliant without SCCs.

DPF Certified

EU Data Residency

We configure all accounts with EU data residency (Belgium). Your calendar data never leaves the European Union.

EU (Belgium)

E2E Encryption

Medical notes are encrypted with the doctor's public key before saving to Calendar. Only the doctor can decrypt with their private key.

Beyond Compliance

Zero-Knowledge Medical Notes

We go beyond legal requirements with end-to-end encryption

How It Works

  1. 1 AI collects patient symptoms during the call
  2. 2 Data encrypted with doctor's public key (RSA-2048)
  3. 3 Encrypted text saved to Google Calendar
  4. 4 Only doctor can decrypt with private key + PIN

Technical Specifications

Encryption RSA-2048 + AES-256-GCM
Private Key Device only (never server)
PIN Protection PBKDF2-SHA256 (100k iter)
Architecture Zero-knowledge
Result: True Zero-Knowledge

Neither Google, nor AIAgens, nor any third party can read the medical notes. Only the doctor with their private key and PIN can decrypt the information.

Google Cloud Certifications

ISO 27001 ISO 27017 ISO 27018 SOC 1/2/3 C5 (Germany) HDS (France)

Technical Security Measures

Enterprise-grade protection

Encryption

TLS 1.3 in transit, AES-256 at rest

EU Data Center

ISO 27001 certified infrastructure in Frankfurt

Access Control

Role-based access, need-to-know principle

24/7 Monitoring

Real-time threat detection and alerting

Audit Trails

Immutable logs of all system access

Daily Backups

GPG-encrypted daily backups with 90-day retention. Conversation data: zero retention by default. Long-term retention of medical data (10-20 years) is the responsibility of the doctor as Controller.

Contractual Commitments

What we offer in writing

Data Processing Agreement

GDPR Art. 28 compliant DPA with standard contractual clauses

Confidentiality Clauses

Art. 321 CP aligned confidentiality obligations

Breach Notification

We notify you without undue delay of any security incidents

Data Deletion

Guaranteed data erasure upon contract termination

Questions?

Our team is ready to address your specific security requirements

Contact Security Team View Trust Center