GDPR in Veterinary Practice: What You Need to Know About Pet Owners' Data and AI Tools
A veterinary practice in Germany handles personal data every day, from scheduling appointments to issuing invoices. The General Data Protection Regulation (GDPR), known as the DSGVO in German, governs how the practice may collect, use, and store this data. This overview covers the requirements that most commonly affect the practice and what you should check before granting an AI tool access to pet owners’ data.
What types of information are considered personal data?
The pet owner's name, address, phone number, and payment information are data pertaining to an identifiable individual. This information is stored in the medical records system, in the appointment records, and on every invoice sent by the practice.
According to the definition in Article 4.1 of the GDPR, personal data is any information relating to an identified or identifiable natural person. A person is considered identifiable if he or she can be identified directly or indirectly, for example, by a name, an identification number, or contact information.
Legal Basis for Processing the Data
Article 6(1) of the GDPR lists the legal grounds that make processing lawful. One of these is that the processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the data subject’s request prior to entering into a contract. Another is that the processing is necessary for compliance with a legal obligation to which the controller is subject.
Information for Pet Owners
According to Article 13(1) of the GDPR, the data controller must provide information when the data is collected from the data subject. This information includes, among other things, the name and contact information of the internship program, contact information for any data protection officer, the purposes of the processing, and the legal basis for it. It also includes information about the recipients to whom the data may be disclosed and whether the data will be transferred to a country outside the EU.
A practical approach is to compile this information in a privacy policy that the pet owner receives during their first visit or can read on the practice’s website.
When a vendor processes data on behalf of the clinic
A cloud-based medical record system or an AI tool that generates medical notes processes pet owners' information on behalf of the veterinary practice.
According to Article 28 of the GDPR, a controller that engages a processor to process personal data on its behalf may only engage processors that provide sufficient guarantees regarding appropriate technical and organizational measures. The processing must be governed by a contract that specifies, among other things, the subject matter and duration of the processing, its nature and purposes, and the types of personal data being processed. According to the article, the agreement must, among other things, stipulate that the processor may only process the data in accordance with the firm’s documented instructions, that the processor may not engage another processor without the firm’s written authorization, and that the data must be deleted or returned upon completion of the assignment.
Register of Treatments
Article 30 of the GDPR requires the data controller to maintain a record of the processing activities carried out under its responsibility, including, among other things, the purposes, categories of data subjects, and personal data, as well as, where possible, the time limits for erasure. According to Article 30(5), this obligation does not apply to companies with fewer than 250 employees. However, this exception does not apply if the processing could pose a risk to the rights and freedoms of data subjects, if the processing is not merely occasional, or if it involves special categories of personal data.
Questions to Ask an AI Tool
Before your practice begins using an AI tool for medical record-keeping, you should obtain answers to the following questions from the vendor.
- Where is the data stored, and in which country are the servers located?
- Which subprocessors are used, and how is the practice notified if they are replaced?
- How long are audio recordings and draft notes kept after the consultation?
- Is the information used for anything other than writing the internship records?
- Does the provider offer a data processing agreement that the practice can sign?
This is how Vetz describes his approach to handling tasks
Vetz listens during the conversation with the pet owner and creates a structured draft of the medical record, which the veterinarian reviews and signs. With active integration, the completed medical record is transferred to the medical record system, and Vetz explains that the integration is encrypted and GDPR-compliant. How the integration works is described in the article about Vetz and your medical record system, and more information about security measures can be found on the security page. Ask Vetz the same questions listed above and request written responses.
Vetz recommends that you inform the pet owner that AI is being used to assist with the medical record entry. This builds trust, and Vetz can provide a ready-made template that your practice can use. More information about this approach is available on the page about AI-assisted medical record-keeping, and the article on AI and GDPR for veterinarians delves deeper into data protection.
This text is an overview and does not replace legal advice or the firm’s data protection officer in specific matters.
Learn more about Vetz
Would you like to learn how Vetz handles medical records and pet owner information at your practice? Book a demo, and we’ll show you how Vetz works with your templates and your medical record system.