Can a French Clinic Use an AI Phone Agent? Health Data and Recording

Short answer: possibly for the simplest calls, but check two things first. Article L1111-8 of the Public Health Code requires a host of health data on digital media to hold a certificate (the HDS certification), and we have not verified whether a clinic's appointment calls fall in that scope; we do not claim an HDS certificate, and it may rule the product out for you. And the CNIL says people on the line must be informed when calls are recorded. Recording is off by default in the product, and the agent can be kept to booking and messages without asking about symptoms.

What follows is a plain-language reading of official pages on 25 October 2026. Read the official text; this is not legal advice.

What is the HDS certification?

According to the ANS's (the French digital health agency) FAQ, the obligation applies to any entity offering a hosting service for personal health data collected during prevention, diagnosis, care or social and medico-social follow-up, whether the hosting is done for the patient or for health professionals and establishments. Both conditions must be met, and the rule applies to public and private bodies. The example the FAQ gives: a health establishment that outsources the hosting of its patient file must use a host that holds the certificate. The framework is based on ISO 27001 with additional requirements; a host without the SecNumCloud qualification that transfers data outside the European Economic Area must inform its clients.

Does a phone call about an appointment fall in that scope?

We do not know, and we did not find an official answer for phone assistants. A call that only asks "are you open on Saturday" involves no health data. A call that books a consultation for a named person with a named specialist starts to. A call in which a caller describes symptoms clearly does. That is the reason to keep the agent to the narrowest tasks, and to ask your adviser, your regional health agency or your professional body before going further.

What does the CNIL say about recording calls?

In its guidance on listening to and recording calls at work (an older page that says it is out of date and being updated, so look for a newer version):

• Recording should be occasional and proportionate to a purpose such as training, evaluation or quality, not systematic unless a law requires it.
• Employees and the people on the other end of the line, such as clients, must be told about the system, who is responsible, the purposes, the legal basis, the recipients, the retention period and their rights.
• The information comes in two steps: a spoken sentence at the start of the call, then a pointer to a website or a key for the full notice.
• The caller must be told of the right to object before the call ends.
• Recordings are kept six months at most unless a text or a special reason says otherwise.
• Staff representatives must be informed and consulted before a system is installed.

Recording is a per-agent switch, off by default. The transcript and outcome of every call are kept in any case, so ask whether you need the audio.

What can the agent safely do for a clinic?

Where is the data, and who processes it?

We support region deployments for enterprise customers. Calls are also processed partly in other countries, with speech recognition in the EU and the voice and the language model in the US, under transfer safeguards.

Do I have to tell callers it is an AI?

Article 50(1) of the EU AI Act asks that people interacting directly with an AI system are told so, unless that is obvious from the circumstances. It applies from 2 August 2026, according to a law-firm summary published on 10 September 2026; read the Regulation itself. A sentence such as "this is the automated assistant of the Clinique du Parc" covers it for most callers.

How do I start safely?

1. Ask your adviser whether your calls fall in the HDS scope, and what your professional body requires.
2. Start with opening hours, directions and out-of-hours messages only, with no symptoms asked.
3. Write the opening line: who, that it is automated, and what is or is not recorded.
4. Read the transcripts weekly for the first month.

See the France page, the healthcare voice AI page and the AI receptionist. For other kinds of business, read English-speaking customers in France.