AI-assisted documentation (Noa Notes)

What is Noa Notes?

To ease the burden of medical documentation, we optionally use the AI-assisted assistance system Noa Notes in our practice. Noa Notes records the doctor-patient conversation, filters medically relevant content (e.g. symptoms, diagnoses, treatment recommendations) and automatically creates a structured entry for the patient file from it. Recordings are deleted after processing — only the documentation text reviewed and approved by the physician is stored in the practice software.

Responsible for data processing within the practice remains NeuroPraxis Kleinmachnow. The provider Jameda GmbH (now Docplanner) is a processor pursuant to Art. 28 DSGVO.

Voluntariness — your consent is required

The use of Noa Notes is carried out exclusively with your prior explicit consent (Art. 9 para. 2 lit. a DSGVO). You are informed about it before the conversation and explicitly asked whether you agree to its use.

You can object at any time:

• Before the conversation: Simply tell us that you do not wish the AI documentation to be used — you will not suffer any disadvantages. The documentation is then carried out manually by the physician as usual.
• During the conversation: You can have the recording stopped at any time.
• After the conversation: You can revoke your consent at any time with effect for the future. Audio recordings that have already been deleted cannot be reversed; the documentation entry resulting from it can be removed from the patient file at your request (unless statutory retention obligations conflict).

The revocation does not affect the lawfulness of the processing carried out up to the revocation.

What data is processed?

• Audio recording of the conversation between physician and patient during the consultation
• Text derived from the audio recording (transcript, which is filtered for medically relevant content)
• Structured documentation entry, which the physician reviews, corrects if necessary and approves

The documentation entries generated in this way contain special categories of personal data within the meaning of Art. 9 DSGVO (health data).

Legal bases

• Art. 9 para. 2 lit. a DSGVO — explicit consent for the processing of special categories of personal data
• Art. 9 para. 2 lit. h DSGVO in conjunction with § 22 para. 1 no. 1 lit. b BDSG — processing for purposes of health care and medical diagnostics
• Art. 6 para. 1 lit. a DSGVO — consent for the recording as such

Processor and data location

Jameda GmbH (part of the Docplanner group since 2024)
Landsberger Straße 110, 80339 München, Germany
Website: noa.ai/de

Data processing:

• The audio and text processing takes place on servers in Germany or the European Union
• A data processing agreement (DPA) pursuant to Art. 28 DSGVO has been concluded with Jameda (Jameda’s general DPA terms can be found at jameda.de/auftragsdatenverarbeitung)
• Jameda is ISO/IEC 27001 certified (information security management) — according to the BSI C5 equivalence regulation equivalent to C5 Type 2 (Cloud Computing Compliance Criteria Catalogue of the Federal Office for Information Security — requirements catalog for eHealth providers)
• All Jameda employees are bound to data secrecy and to the confidentiality obligation pursuant to § 203 StGB (persons contributing to a professional secrecy holder pursuant to § 203 para. 4 StGB)

Technical implementation:

• The speech recognition is based on OpenAI Whisper and is operated on Jameda’s own servers in the EU. During recording, partial segments are sent for transcription every 30 seconds so that the transcription can take place in real time
• The AI-assisted summary uses the Microsoft Azure OpenAI Service — the processing takes place in the EU; according to the provider, the USA serves exclusively as a back-up solution (secured via the EU-U.S. Data Privacy Framework, see below)
• Data transmission between the practice and Noa Notes is exclusively TLS-encrypted
• Audio data is automatically deleted after processing

Sub-processors

Jameda uses the following sub-processors for the operation of Noa Notes:

International data transfer

Data processing generally takes place in Germany or the EU. For the Microsoft Azure OpenAI Service, there is a back-up solution in the USA. This data transfer is secured by the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission pursuant to Art. 45 DSGVO). A routine transfer of personal data to the USA does not take place.

Deletion and retention period

The specific deletion periods and processes on the provider’s side are governed in the data processing agreement (DPA) with Jameda (jameda.de/auftragsdatenverarbeitung). We will provide you with the relevant excerpt upon request.

Confidentiality and special protective measures

The physician and all employees of the practice are subject to medical confidentiality pursuant to § 203 StGB. Jameda is integrated into the confidentiality obligation as a “contributing person” pursuant to § 203 para. 4 StGB. This means: passing on conversation content to Jameda for the purpose of AI-assisted documentation is legally covered, as long as you have consented and the data is necessary for treatment documentation.

No training with patient data

Jameda does not use patient data to train AI models. The recordings and transcriptions are used exclusively to provide the documentation service and for quality assurance. Neither Jameda nor AWS routinely access the conversation content.

No automated decision-making — not a medical device

Noa Notes does not make automated decisions within the meaning of Art. 22 DSGVO. The system merely creates a documentation proposal — the medical assessment, diagnosis and treatment decision is made exclusively by the physician. Every entry created by the AI is reviewed by the physician before being transferred to the patient file.

Noa Notes is not a medical device and does not constitute medical advice or diagnosis. It is exclusively a tool for documenting consultations.

Your rights

With regard to the data processed with Noa Notes, you have all rights as a data subject pursuant to Art. 15–22 DSGVO (information, correction, deletion, restriction, data portability, objection) as well as the right to revoke consent pursuant to Art. 7 para. 3 DSGVO. You can find details in the general privacy policy.

Further information from the provider: noa.ai/de
Noa Notes terms of service: Terms of service (PDF)
Data processing agreement (DPA): jameda.de/auftragsdatenverarbeitung