DentalX Back to home

Austria Annex

ANX-AT · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 74bbd1fd429ca8e625c36ae0b4727c3f810641f7ebfd75bcd8e4b8ab23e38a64

Austria — ANX-AT: Austria Annex

Document ID: ANX-AT · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]] Language: English, with a German courtesy copy [[TO CONFIRM: German translation]]. English controls. Applies to: Clinics established in Austria, together with the MDPA and the EEA Transfer Module (TM-EEA). Terms defined in the MDPA have the same meaning here.

1. Professional secrecy (Dentists Act, § 21)

1.1 The dentist's secrecy. Dentists, and the persons who assist them, are bound by professional secrecy under § 21 of the Dentists Act (Zahnärztegesetz, "ZÄG").

1.2 Flow-down to VstreamX. VstreamX is a person who assists the Clinic in its practice by providing DentalX. It therefore binds itself and its personnel to an obligation of secrecy equivalent to that of § 21 ZÄG in respect of all information about the Clinic's patients (MDPA clause 5.3). That obligation:

  • is permanent; and
  • survives the end of this Agreement.

1.3 Sub-processors. VstreamX's Sub-processors are bound by the confidentiality obligations in their data processing terms, as MDPA Schedule 3 records, and the Clinic Data is protected in their hands by the encryption in MDPA Schedule 2. VstreamX does not represent that they are bound by § 21 ZÄG or an equivalent professional secrecy. [[TO CONFIRM: Austrian counsel's view that this suffices for § 21 ZÄG]]

2. Transmission of health data (Health Telematics Act 2012)

2.1 The Clinic's duty. When the Clinic transmits health data electronically, the Gesundheitstelematikgesetz 2012 ("GTelG") requires it to ensure the following:

  • the identity of the persons involved;
  • the integrity of the data; and
  • the confidentiality of the data, by encryption.

2.2 DentalX's settings. For Austrian Clinics, DentalX:

  • (a) transmits all data between browsers and the Service by TLS;
  • (b) sends health documents to patients and third parties by secure, expiring link rather than as an email attachment, where the GTelG requires it [[TO CONFIRM: product setting for Austrian Clinics: links instead of PDF attachments for health documents]]; and
  • (c) relies on email or WhatsApp only for appointment reminders that contain no health data beyond the appointment itself.

[[TO CONFIRM: Austrian counsel's view on whether TLS email transport meets the GTelG for direct patient communication]]

3. Documentation and retention (ZÄG, § 19)

3.1 The Clinic's duty. The Clinic keeps its documentation, including X-rays and models, for at least 10 years (§ 19 ZÄG).

3.2 DentalX's default. DentalX's default for Austrian Clinics keeps records for 10 years, and does not auto-delete clinical records.

4. ELGA and e-prescriptions

DentalX does not connect to ELGA or the e-Rezept system. Its prescriptions are not electronic prescriptions in the national system.

5. Security breaches

VstreamX's notice within 24 hours (MDPA clause 9) allows the Clinic to notify the Data Protection Authority within 72 hours.

Items to confirm before publication (Austria)

  1. Publication date.
  2. The German courtesy translation.
  3. The product setting for Austrian Clinics that sends health documents by link instead of PDF attachment (§2.2(b)).
  4. Austrian counsel's view on whether TLS email meets the GTelG for patient communication (§2.2).
  5. Austrian counsel's view on the Sub-processors' confidentiality (§1.3).