Key points
- Munich had 1,612,429 registered residents at the end of 2025, and 30.6% of them held a passport other than a German one, from 191 countries in all.1
- Bavaria counted 73,631 working doctors at the end of September 2025, and 38.86% of doctors in Bavarian practices were employed.2
- The BayLDA's AI checklist asks a practice to enter each AI use in its record of processing and to check whether a data protection impact assessment is needed.5
- Since 1 October 2025 every care provider in the statutory system must use the ePA and fill it with findings and doctors' letters.6
- wai is built to connect to the ePA. We set up your clinic's connection with you.
Summary
A Munich practice can use AI for notes and patient messages in 2026 once each use is in its record of processing, the need for an impact assessment is checked and documented, and health data enters the tool only on a valid legal basis, as the Bavarian data protection authority's checklist sets out. Practices in the statutory system also fill the ePA with findings and letters.
Munich practices now finish the day with every letter signed and filed, and with the evening's enquiries from patients of 191 nationalities already drafted for the morning. Bavaria has its own data protection authority and its own medical chamber, and both have published clear expectations. The Bavarian rules come first here, then a demo built on a Munich evening.
Part of the QM-RL hub, with the framework explained, a readiness checklist and 7 guides.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee an evening enquiry from a Munich family become an approved reply, a booking with a deposit in euros and, after the visit, a signed letter ready for the ePA, in fifteen minutes with a clinician who uses wai daily.
| Body or law | Rule | What to ask | How wai meets it |
|---|---|---|---|
| BayLDA, AI checklist | Each AI use in the Article 30 record, and the need for an impact assessment checked | Which personal data enters the tool, and on what legal basis | Patient data never used to train models, and every access logged |
| BayLDA, section 38 BDSG | Data protection officer once 20 or more people regularly process data automatically | Who at the vendor answers the officer's questions | Subprocessors named with their agreements, and 30 days notice before any change |
| Bayerische Landesärztekammer | Ten years minimum, 30 years recommended for liability | How long records are kept and how they are exported | Every message, draft and signature logged and exportable |
| ePA, mandatory since 1 October 2025 | Findings and doctors' letters filled for each treatment | How signed letters reach the patient's ePA | wai is built to connect to the ePA, set up with the practice |
| GDPR Article 9 | Health data processed only on a valid exception | Where data is hosted | Records hosted in the clinic's own country, set up with the clinic |
The private care market in Munich
Munich grew by 8,653 people in 2025 to 1,612,429 registered residents, a rise of 4.5% over ten years.1 Of those residents, 492,935 held no German passport, and the city's statistics office counts 191 citizenships.1
Across Bavaria the medical chamber counted 73,631 working doctors at the end of September 2025, up from 71,737 a year earlier.2 Nearly four in ten doctors in Bavarian practices, 38.86%, now work as employees.2
The rules a Munich practice works under
Private practices in Bavaria answer to the Bayerisches Landesamt für Datenschutzaufsicht, the BayLDA. Its guidance for medical practices says a data protection officer must be named once at least 20 people regularly work with automated processing of personal data, and everyone counts, including part-time staff, trainees and freelancers.4
The BayLDA's checklist for AI, dated 24 January 2024, asks a practice to record each AI application in its Article 30 record of processing, with a separate entry for each purpose, and to check and document whether an impact assessment under Article 35 is needed.5 It also asks the practice to document which personal data goes into the tool, and notes that health data needs consent or an exception under Article 9(2) of the GDPR.5 The consent form template covers the patient's side.
Doctors in Bavaria are members of the Bayerische Landesärztekammer. Its guidance on treatment records sets ten years as the professional minimum and recommends keeping the record for 30 years where possible, because liability claims can arise that late.3 Records of radiation treatment are themselves kept for 30 years.3
The ePA, Germany's electronic patient record, has been mandatory for care providers since 1 October 2025. Providers fill it with the data the law sets for each treatment, such as findings and doctors' letters, and private insurers may offer their members an ePA too.6 wai is built to connect to the ePA. We set up your clinic's connection with you.
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic. wai is compliant with these rules and built for clinics in Munich. Every subprocessor is named, with thirty days notice before any change.8
The languages Munich patients write in
The largest groups without a German passport at the end of 2025 held Turkish (39,620), Croatian (35,780), Italian (28,759) and Ukrainian (27,176) citizenship, followed by Bosnian, Greek, Austrian and Indian.1 Many families write to the practice in the language they speak at home.
wai works in any language, and a member of the team approves each reply before it is sent.7
What a demo shows in Munich
The demo starts with an email sent at 21.40 by a son in Schwabing asking whether his mother can see the internist before her flight home at the end of the month. wai files it in the mother's thread, reads the internist's busy times from Outlook, Google Calendar or Apple Calendar and drafts a reply in his language with two open mornings. The receptionist approves it at 7.45.
The booking link takes a deposit in euros through the practice's own Stripe account, and the practice stays the merchant of record. After the visit the internist edits and signs the drafted note and the letter to the mother's own doctor, and the signed letter is ready for her ePA. A missed call from the son that afternoon becomes a drafted text the team approves.
For hospital groups, insurers and public bodies in Bavaria
Hospital groups and private insurers in Munich can have a system of their own built on wai, under their own brand, with data rights and exit terms agreed in the contract. Each build starts with one pathway and the measures that decide it. The organisations page sets out the model.
Where to start
First, add an entry for each AI use to the record of processing and document the impact assessment check, as the BayLDA checklist asks.5 Second, count the people who work with patient data, including trainees and freelancers, to see whether a data protection officer is due.4
Third, settle the keeping period with the vendor, using the chamber's 30-year recommendation as the benchmark.3 Fourth, list which signed letters go to the ePA and who sends them.6 More on sign-off is in who signs an AI clinical note.
Bring last month's enquiries and your ePA workflow, and we show the week running on wai.
Frequently asked questions
Who supervises data protection for a Munich private practice?
Does a Munich practice need a data protection officer?
Yes, once at least 20 people regularly work with automated processing of personal data, counting part-time staff and freelancers.4
Does the practice need an impact assessment before using an AI scribe?
The BayLDA checklist asks the practice to check and document whether one is needed under Article 35, and to record the AI use in its record of processing.5
Is the ePA mandatory for Munich practices?
Since 1 October 2025 all care providers in the statutory system must use the ePA and fill it with the data the law sets, such as findings and letters.6 wai is built to connect to the ePA. We set up your clinic's connection with you.
How long should a practice keep records in Bavaria?
At least ten years, and the Bayerische Landesärztekammer recommends 30 years where possible because of liability claims.3
Can patients write in their own language?
Yes. wai works in any language, and nothing reaches the patient until someone at the practice has approved the draft.7
Sources
- 1Statistisches Amt der Landeshauptstadt München, 2026Münchner Statistik, 1. Quartalsheft 2026, Demografie der Münchner Bevölkerung 2025Read 15 October 2026Read source
- 2Deutsches Ärzteblatt, 2025Anteil angestellter Ärzte in bayerischen Praxen bei fast 40 Prozent (reporting Bayerische Landesärztekammer figures)Read 15 October 2026Read source
- 3Bayerische Landesärztekammer, 2026BehandlungsdokumentationRead 15 October 2026Read source
- 4Bayerisches Landesamt für DatenschutzaufsichtDatenschutzbeauftragter im medizinischen Bereich (Auslegungshilfe)Read 15 October 2026Read source
- 5Bayerisches Landesamt für Datenschutzaufsicht, 2024Datenschutzkonforme Künstliche Intelligenz, Checkliste mit Prüfkriterien nach DS-GVORead 15 October 2026Read source
- 6Bundesministerium für Gesundheit, 2026Die elektronische Patientenakte (ePA) für alleRead 15 October 2026Read source
- 7wai, 2026wai changelog, intake answered by voice in any languageRead 15 October 2026Read source
- 8wai, 2026Security at waiRead 15 October 2026Read source
Every Munich letter signed and filed before the last patient leaves.
Fifteen minutes with a clinician who uses wai daily, on your own enquiries, calendar and ePA workflow. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits