The revFADP (the new Federal Act on Data Protection) has been in force since 1 September 2023. For a medical or dental practice, it has not turned everything upside down, but it has made explicit obligations that often remained implicit. Here, in concrete terms, is what it asks of a practice, and the questions to ask before adopting an artificial intelligence tool.
This article gives an overview; it does not replace legal advice tailored to your situation.
Sensitive data by nature
Health data is "sensitive personal data" within the meaning of the FADP. It therefore requires enhanced protection. These rules come on top of professional secrecy under Art. 321 of the Swiss Criminal Code and cantonal health laws, which in particular govern how patient records are kept and retained.
What the law asks of the practice
Inform patients. When you collect data, you must state who processes it, for what purpose, and to whom it may be disclosed. A clear privacy notice, handed out or displayed at the practice and published on your website, meets this obligation.
Keep a record of processing activities. The FADP provides for a record of processing activities. Companies with fewer than 250 employees are exempt, unless they process sensitive data on a large scale. When in doubt, keeping a simple record is good practice.
Assess the risks. When processing presents a high risk for patients, a data protection impact assessment must be carried out before it is put in place.
Protect data by design. The law requires technical and organisational measures appropriate to the risk (access, encryption, backups), and default settings that limit processing to what is necessary.
Report breaches. A data leak or loss that is likely to result in a high risk must be reported as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC).
Respond to access requests. A patient may ask what data you hold about them. The response is in principle free of charge and must be given within 30 days.
Put processors under contract. If a provider processes data on your behalf (practice software, hosting provider, AI tool), it must be bound by a contract, and you must make sure it guarantees the security of the data.
Control transfers abroad. Data may only be disclosed abroad to a country whose legislation ensures adequate protection, or subject to appropriate safeguards, for example standard contractual clauses.
Finally, certain intentional breaches (information, right of access, processing by third parties, cross-border transfers, security) are punishable by a fine of up to CHF 250,000, imposed on the responsible individual and not on the company.
The questions to ask an AI tool
A documentation assistant processes the core of the record: what the patient says during the consultation. Before adopting one, four questions are enough to sort the options:
- Where is the data stored and processed? In Switzerland, or elsewhere?
- Does the AI model run at the provider's, or at a third party's? A consultation sent to a large foreign AI provider is a transfer abroad.
- Are consultations used to train models? And if so, with what consent?
- Is a data processing agreement provided?
Aida's answers
Aida MD and Aida Dental data is stored and processed in Switzerland, with an ISO 27001-certified hosting partner, and encrypted at rest and in transit. Our AI models run on our own servers in Switzerland: no clinical data is sent to OpenAI, Google or Anthropic. We never use your data to train a model without your written consent, and our data processing agreements are ready to sign.
One clarification: the messages Aida Desk exchanges with your patients via WhatsApp and SMS go through the providers of those services, like any messaging.
Where your patients' data lives, how it flows, and our contracts to download: the Trust Center.