Medisch beroepsgeheim & discretie

1. Legal framework

Professional confidentiality is established in Article 458 of the Penal Code, which binds any person who becomes privy to a secret by reason of their status or profession.

For healthcare providers, the Law of 22 August 2002 on patients' rights applies: Article 14 guarantees the patient's right to respect for their medical secret, and Article 15 permits disclosure of information only under strictly defined circumstances.

For funeral care, information about the deceased remains personal data under the GDPR, and the funeral director receives this information by virtue of their profession — therefore the confidentiality obligation of Article 458 of the Penal Code applies in full.

2. Our position as processor

NovaDesk acts as a processor on behalf of the practice or funeral centre that is the data controller (Art. 28 GDPR). We never decide on the content of care or funeral arrangements; we act solely on the instructions of the practice.

Our employees are contractually bound by confidentiality, and for them the confidentiality obligation of Article 458 of the Penal Code applies in full. The practice or funeral centre remains itself the holder of the professional secret.

3. Our commitments

We have designed the service so that the professional confidentiality of your practice is respected:

• No human supervisor listens in on calls — neither during the pilot nor afterwards, unless the practice explicitly requests this in writing;
• Encryption of data in transit (TLS) and at rest;
• Restricted, role-based access to systems, with logging of every access;
• Processing only within the European Union, subject to transfers with appropriate safeguards per Art. 46 GDPR;
• No call, transcript or recording is used to train generic language models without your prior written consent;
• Pilot recordings and transcripts are deleted by default 30 days after the end of the pilot;
• All subprocessors (hosting, telephony, calendar) are bound by a data processing agreement in accordance with Article 28 GDPR.

4. Triage and forwarding

Our triage is a first filter, not medical or funeral advice. If an acute complication is suspected — including vascular occlusion, hematoma or a death notification — the system immediately forwards the caller to the on-call staff or the on-duty funeral director. Diagnosis, decision-making and all follow-up remain with the attending physician or the competent funeral director. The content of a forwarded call is subject to the same professional confidentiality.

5. Exceptions to professional confidentiality

Professional confidentiality is not an absolute barrier: the Law of 22 August 2002 provides exhaustive exceptions, and only those apply:

• on explicit and motivated request of the judicial authority;
• in the event of an urgent threat to public health or to the life of the patient or third parties;
• in the event of a dispute regarding work disability;
• with the explicit and written consent of the patient, including for the benefit of a third-party payer;
• after the death of the patient: the heirs or the person designated by the patient exercise the relevant rights.

NovaDesk never invokes these exceptions on its own initiative. Any disclosure is made solely on explicit, written instruction from the practice or funeral centre acting as data controller. NovaDesk never informs third parties on its own initiative.

6. Data breaches

If a security incident presents a risk to the rights and freedoms of data subjects, NovaDesk notifies the Data Protection Authority at the latest 72 hours after becoming aware of it (Art. 33 GDPR) and informs the data subjects if the risk is high (Art. 34 GDPR). The practice is informed immediately. NovaDesk maintains a register of processing activities in accordance with Art. 30 GDPR.

7. Data processing agreement

With every practice we sign a data processing agreement in accordance with Article 28 GDPR, specifying the purposes, retention periods, security measures and subprocessors (including hosting, telephony and calendar integration). A template agreement is available on request via yannick@novadesk.be.

8. Transparency towards callers

The practice or funeral centre remains responsible for informing patients, clients and callers about the use of an AI receptionist (Arts. 13 and 14 GDPR). NovaDesk provides a standard text and collaborates on this transparency: the caller may request to speak to a human at any time, and such a request is immediately honoured.