AI phone assistant for home care: six things to settle first

Health data sets care apart from every other trade

Health data is banned first and permitted second. Article 9(1) GDPR prohibits processing it at all; it becomes lawful only through an exemption in paragraph 2, such as explicit consent under point (a) or care in the health and social sector under point (h). The Saturday evening call in which a daughter describes how her mother is doing sits inside that.

Criminal law sits on top. Section 203(1) no. 1 of the German Criminal Code covers doctors, pharmacists and members of other health professions whose title requires state-regulated training. Where a service employs such staff, paragraph 3 applies: passing information to a contributing party is not disclosure, but only as far as that party's work requires. Paragraph 4 then makes that party punishable for passing a secret on.

This concerns 15,500 home care services as of 31 December 2023, serving close to 5.7 million people assessed as needing care.

Since 2 August 2026 the caller has to be told

The disclosure duty is new and already live. Article 50(1) of the AI Act requires providers to build AI systems meant for direct interaction with people so that those people learn they are dealing with an AI system. It can be left out only where that is obvious to a reasonably observant person. Article 113 sets the general date of application at 2 August 2026.

On its wording the duty binds the provider, not the care service. The service carries it anyway, because its name is the one spoken on the line: ask for the greeting in writing, then listen to it on a test call. "You are speaking to Paula from the office" fails the article. "You are speaking to an AI assistant of the care service" passes.

Anyone running AI in a business also carries the literacy duty in Article 4. What that proof looks like on one page is in proving AI literacy.

Six points before the line is diverted

Work through this list before the diversion goes live. Every point names a provision you can quote back at the vendor. If one comes back as reassurance rather than text, the vendor is not fit for a care service, however good the voice sounds.

• 1. A processing agreement carrying all eight duties from Article 28(3) GDPR, above all processing on documented instructions only, and deletion or return at the end.
• 2. A named list of sub-processors including whoever operates the language model, plus the Article 28(2) duty to notify you of any change.
• 3. Processing and storage inside the EU, promised in the contract. Schwester Gerda states as a vendor that it operates solely within the EU; get that into the agreement, not just onto a web page.
• 4. A number as the retention period for transcripts and callback notes, 30 days for example, derived from storage limitation in Article 5(1)(e) GDPR.
• 5. A written confidentiality undertaking for the contributing party and its staff, with notice of criminal liability under Section 203(4).
• 6. The Article 50 greeting at the start of the call, and an escalation rule: on an emergency keyword the assistant stops and transfers to the on-call phone.

Three fields are enough, anything more is too much

Data minimisation is the cheapest defence here. Article 5(1)(c) GDPR demands a limit to what the purpose requires, and nobody needs a diagnosis in order to ring somebody back. Schwester Gerda states that it records name, phone number and the request as specified by the customer; that specification is yours to write.

Define the requests as closed categories, not free text. If a caller volunteers a diagnosis anyway, the standing instruction to the vendor is that free text from the call is neither stored nor emailed. These six categories covered every call type Schwester Gerda lists:

• Prescription or referral missing
• Move or cancel an appointment
• Carer reporting sick
• Query from a medical practice
• Family question about scheduling
• Urgent, on-call staff needed

Recording is the costliest default setting

An audio recording without consent is a criminal offence. Section 201(1) of the Criminal Code punishes recording another person's non-public spoken word with up to three years in prison or a fine, and using or sharing such a recording alike. A notice in the greeting, followed by the caller carrying on, is treated in practice as consent; without the notice there is none.

For a care service the calmer setting keeps no audio and stores only the structured result. Ask the vendor whether audio storage switches off without losing the feature. If audio is unavoidable, you need the greeting and the retention period from point 4, and the recording must not reach the shared mailbox as an attachment.

If text from such calls later goes into an AI tool, redact it first. Our free redaction tool runs in the browser; what masking does and does not achieve is in the piece on four patterns and one limit.

At 725 minutes the cheapest plan changes

The switching point can be calculated exactly. Ruf Paula lists three plans as a vendor: Solo at 99 euros a month for 150 minutes plus 1.00 euro each after that, Team at 199 euros for 350 minutes plus 0.80 euro, Premium at 499 euros for 1,000 minutes plus 0.50 euro, no setup fee. Set Team equal to Premium (199 plus 0.80 times the minutes above 350, against 499) and the lines cross at 725 minutes a month, or 290 calls of 2.5 minutes.

Schwester Gerda states setup from 1,499 euros and 299 euros a month: 5,087 euros in the first year, or 423.92 a month, against 5,988 for Premium. The 901 euro gap carries a caveat, because the variable charge there is quoted only on request.

The honest limit shows up against wages: 725 minutes are 12.08 hours, and at the minimum wage of 13.90 euros that is 167.96 euros of gross pay against a 499 euro plan, a factor of 2.97. An answering machine costs less once and keeps quiet about nothing. Justifying the assistant by saved wages during office hours has the sum backwards; it earns its keep at night, at weekends and out on the round.

What I would do in your place

I would start with the night shift, not with office hours. In practice: a second number that reception diverts to outside office hours and during rounds, carrying the six categories and the transfer rule to the on-call phone. The main number stays with a person during office hours.

Yes, if the service must be reachable outside office hours, takes more than roughly eight calls a day, and runs software the callback note drops into as a task. No, if the callers are mostly very old patients with hearing difficulties or a strong dialect, if the on-call rota is not reliably staffed, or if any of the six points is missing in writing. Then an answering machine with a clear greeting is the right interim answer.

What splitting the numbers looks like in another trade is in our piece on car dealerships; the route from call to scheduling software is in physiotherapy practices.

Common questions

Does the service need a data protection impact assessment? Article 35(3)(b) GDPR names large-scale processing of special categories explicitly. If the assistant systematically takes down health details, it is due. If it stops at name, number and category, the case-by-case test in paragraph 1 fits on a page.

May the assistant take a carer's sick note? Yes, that is employment data, not a patient's secret. The reason for the illness has no place in the form, because that falls back under Article 9.

The prices are vendor list prices as of 25 September 2026, not negotiated terms.

The next step

Make three test calls before you sign. First: a missing prescription, giving only your name. Second: "My mother is doing badly, I need somebody", timing the seconds until the on-call phone rings. Third: volunteer a diagnosis, then check the log for it.

Then hold the log against the six categories. If it carries free text nobody asked for, point 4 is still open. You can hear what such an assistant sounds like in our AI phone demo, and setup including the paperwork sits under our AI phone assistant service.