Key points
- Madrid registered 3,497,277 residents on 1 January 2026, and 1,065,198 of them, 30.5%, were born abroad.1
- In the Comunidad de Madrid a health centre's operating authorisation and its registry entry are renewed every eight years, with the request filed at least three months before expiry.2
- Spain's LOPDGDD requires a data protection officer at every health centre legally bound to keep clinical histories, with individual practitioners exempt.4
- AESIA oversees AI rules in Spain, and the EU AI Act requires AI systems that interact directly with people to tell them so.67
- wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic.8
Summary
A Madrid clinic can use AI for notes and patient messages under GDPR and the LOPDGDD, with a person approving every message and the doctor signing every note. A clinic keeping clinical histories needs a data protection officer, and its regional operating authorisation is renewed every eight years with the Consejería de Sanidad.
In a Madrid clinic that runs well, the enquiry sent from Chamberí at midnight is answered at nine, and the doctor goes to dinner with every note signed. Almost a third of the city was born abroad, so those enquiries arrive in many languages, and Spanish and regional rules decide how the clinic handles them.1
Part of the Spanish autorización sanitaria hub, with the framework explained, a readiness checklist and 7 guides.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee a midnight enquiry to a Madrid clinic become an approved booking with a deposit in euros, in fifteen minutes with a clinician who uses wai daily.
| Body or law | Rule | What to ask | How wai meets it |
|---|---|---|---|
| Consejería de Sanidad, Decree 51 of 2006 as amended by Decree 205 of 2023 | Operating authorisation and registry entry renewed every eight years | When does our authorisation expire | Every action logged and exportable for the renewal file |
| LOPDGDD, Article 34 | Data protection officer at health centres that keep clinical histories | Who is our officer, and what do they need from the vendor | Subprocessors named with 30 days notice, records hosted in Spain |
| AEPD | Supervises GDPR and the LOPDGDD in Spain | Can we answer an access request from the log | Every message, draft, approval and signature logged and exportable |
| EU AI Act, Article 50, overseen in Spain by AESIA | People told when an AI system interacts with them directly | Does any AI reply leave without a person approving it | AI drafts, a person at the clinic approves and sends |
The private care market in Madrid
The city's municipal register counted 3,497,277 residents on 1 January 2026.1 Of these, 80.6% held Spanish nationality and 19.4% another, and 30.5% had been born outside Spain.1
The city keeps drawing newcomers. Close to 118,000 people registered in Madrid from abroad during 2025, and arrivals from Venezuela, Colombia, Peru, the United States, China, Ecuador and Mexico made up more than half of them.1 Each new family is a patient choosing a doctor for the first time, usually by message.
The rules a clinic in Madrid works under
Every health centre in the region needs an operating authorisation from the Consejería de Sanidad and an entry in the Registro de Centros, Servicios y Establecimientos Sanitarios, under Decree 51 of 2006.23 Decree 205 of 2023 set the renewal of both at every eight years, or four for assisted reproduction, with the request filed at least three months before the authorisation expires.2
Spain applies GDPR through Organic Law 3 of 2018, the LOPDGDD, supervised by the Agencia Española de Protección de Datos.45 Article 34 requires a data protection officer at every health centre legally bound to keep patients' clinical histories, and exempts health professionals who practise individually.4 A clinic with several doctors names its officer before the AI contract is signed.
The Agencia Española de Supervisión de Inteligencia Artificial is the public body that oversees compliance with AI rules by public and private organisations in Spain.6 Article 50 of the EU AI Act requires AI systems intended to interact directly with people to be designed so that those people are told they are dealing with AI.7 At wai, a person at the clinic approves and sends every message the AI drafts.
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic. wai is compliant with these rules and built for clinics in Madrid.8
The languages Madrid patients write in
The register shows 1,065,198 Madrid residents born abroad on 1 January 2026, and the largest flows of new arrivals in 2025 came from Latin America, the United States and China.1
wai works in any language.9 A message is read in the language it arrived in, and the drafted reply waits for a person at the clinic to approve it.
What a demo shows in Madrid
The demo opens on a specialist clinic in the barrio de Salamanca. At 23:50 a parent who moved from Bogotá in the spring writes on WhatsApp asking for a paediatric check before school photographs on Thursday, and a second message comes by email from a consultant posted to an office on the Castellana.
wai reads each paediatrician's busy times from Google Calendar, Outlook or Apple Calendar, holds two open slots and drafts both replies in the clinic's voice. The coordinator approves them at 9:00, and each patient pays a deposit in euros through the clinic's own Stripe account and receives a confirmation, a receipt and an intake questionnaire.
On Thursday the note is drafted during the visit and signed by the paediatrician. The data protection officer can export every message, draft, approval and signature from the log whenever the AEPD or a patient asks.8
For health systems, insurers and public bodies in Madrid
Hospital groups, insurers and public health bodies in the Comunidad de Madrid can have wai build a system around one defined pathway, with records hosted in Spain, every note signed by a clinician and data and exit rights agreed in the contract. Details are on the organisations page.
Where to start
First, put the authorisation's expiry date in the diary and file the renewal three months ahead.2 Second, confirm who the clinic's data protection officer is, and give them the vendor's hosting country and subprocessor list in writing.4 Third, add a line to the patient information saying that AI drafts messages and notes and that a person approves each one.
Then export last month's WhatsApp, email and web enquiries, sorted by hour, and bring them to a fifteen-minute demo. The one inbox guide shows how every channel lands in one thread per patient, and prices are published on the pricing page.
Bring a week of enquiries from WhatsApp, email and the web and watch each one drafted for your team to approve.
Frequently asked questions
How often does a Madrid clinic renew its operating authorisation?
Every eight years, or every four for assisted reproduction, with the request filed at least three months before expiry.2
Does our clinic need a data protection officer?
Yes, if it is a health centre legally bound to keep clinical histories. Doctors practising individually are exempt under Article 34 of the LOPDGDD.4
Who supervises AI in Spain?
Do patients have to be told that AI is involved?
Article 50 of the EU AI Act requires people to be told when an AI system interacts with them directly.7 With wai, every message is approved and sent by a person at the clinic.
Where would our records be hosted?
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic.8
Sources
- 1Ayuntamiento de Madrid, Estadística, 2026Revisión anual del Padrón Municipal a 1 de enero de 2026, primeros resultadosRead 15 October 2026Read source
- 2Boletín Oficial de la Comunidad de Madrid, 2023Decreto 205/2023, de 19 de julio, que modifica el Decreto 51/2006 de autorización y registro de centros sanitarios, BOCM of 25 July 2023Read 15 October 2026Read source
- 3Comunidad de Madrid, 2026Salud, Consejería de SanidadRead 15 October 2026Read source
- 4Boletín Oficial del Estado, 2018Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales, consolidated textRead 15 October 2026Read source
- 5AEPD, 2026Agencia Española de Protección de Datos, official websiteRead 15 October 2026Read source
- 6AESIA, 2026Agencia Española de Supervisión de Inteligencia Artificial, official websiteRead 15 October 2026Read source
- 7EUR-Lex, Publications Office of the European Union, 2024Regulation (EU) 2024/1689, the Artificial Intelligence ActRead 15 October 2026Read source
- 8wai, 2026Security at waiRead 15 October 2026Read source
- 9wai, 2026wai changelog, intake answered by voice in any languageRead 15 October 2026Read source
Every new family in Madrid answered by morning, every note signed by evening.
Fifteen minutes with a clinician who uses wai daily, on your own diary and payments. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits