Key points
- Law 8968 lists health data among sensitive data and allows its processing for diagnosis and care when done by health staff bound by professional secrecy.1
- Article 14 of Law 8968 lets a database transfer data only with the patient's express and valid authorisation, and PRODHAB enforces the law for private and public bodies.12
- Santa Ana canton counted 58,020 people in the 2022 census, with Pozos its largest district at 17,516.5
- Health establishments operate under a sanitary operating permit from the Ministry of Health, processed under Executive Decree 44509-S.3
Summary
A clinic in San José or Santa Ana can use AI for notes and patient messages in 2026 when patients are told how their data is used, transfers have express authorisation and a clinician signs every note. Law 8968 and PRODHAB set the data rules, and the Ministry of Health issues the clinic's operating permit.
Clinics from central San José to Pozos now answer the evening's WhatsApp messages before the first appointment, and doctors finish their notes between patients. Costa Rica's data protection law, Law 8968, and its agency PRODHAB set clear terms for AI in that work.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoWatch a WhatsApp message sent from Pozos at 8:50pm become an approved reply and a booked appointment, in fifteen minutes with a clinician who uses wai daily.
| Body or law | Rule | What to check | How wai meets it |
|---|---|---|---|
| Law 8968, article 5 | Tell patients about the database, its purposes and recipients before collecting data | Is the privacy notice sent before intake | The team adds the notice to the first reply before approving it |
| Law 8968, article 9 | Health data is sensitive, processed for care by staff bound by secrecy | Who can open each patient record | Role-based access enforced in the database |
| Law 8968, article 14 | Transfers need the patient's express and valid authorisation | Which outside parties receive data | Subprocessors named with thirty days notice |
| PRODHAB | Enforces Law 8968 for private and public bodies | Whether any database needs registration under article 21 | Every message, draft, approval and signature logged and exportable |
| Ministry of Health, Decree 44509-S | Sanitary operating permit for the establishment | Permit date and renewal | Records hosted in Costa Rica, set up with the clinic |
| Colegio de Médicos y Cirujanos | Professional college and the Code of Medical Ethics | Each doctor's standing with the Colegio | Every note stays a draft until the doctor signs it |
The private care market in San José and Santa Ana
Santa Ana, the ninth canton of San José province, counted 58,020 people in the 2022 census run by INEC, according to the municipality.5 Pozos is its largest district at 17,516, followed by Santa Ana district at 13,186, Uruca at 9,423 and Piedades at 9,393.5
The municipality describes Pozos and Brasil as districts with a high concentration of business parks and shopping centres, and places Santa Ana district third of 490 districts on the national social development index, with Pozos fourteenth.5 The Colegio de Médicos y Cirujanos de Costa Rica is the doctors' professional college, and each establishment works under a sanitary operating permit from the Ministry of Health.43
The rules a clinic in San José and Santa Ana works under
Law 8968, the law protecting people in the processing of their personal data, sets the core rules. Article 5 requires the clinic to tell patients, before collecting their data, about the database, its purposes, who will receive the information and how to exercise their rights.1
Article 9 classes data on health among sensitive data and prohibits processing it, with an exception for prevention, diagnosis, care, treatment or the management of health services when done by health staff bound by professional secrecy.1 Article 14 allows a database to transfer data only when the patient has expressly and validly authorised it.1
PRODHAB, the Agencia de Protección de Datos de los Habitantes, is attached to the Ministry of Justice and Peace and enforces the law for private persons and companies as well as public bodies.12 Article 21 requires databases kept for distribution, dissemination or sale to register with it, and article 31 treats processing without a required registration as a very serious breach.1
The Ministry of Health issues the sanitary operating permit, and its guidance places permits, authorisations and accreditations under Executive Decree 44509-S.3 The Colegio de Médicos y Cirujanos publishes the Code of Medical Ethics and the profession's other rules.4
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic. wai is compliant with these rules and built for clinics in San José and Santa Ana. Every message, draft, approval and signature is logged and exportable, and each subprocessor is named with thirty days notice before any change.7
The languages patients write in
Article 76 of the Constitution makes Spanish the official language of the nation and charges the State with keeping the national Indigenous languages alive.6
wai works in any language, with intake answers given by voice in Spanish, English or the patient's own language.8 Each reply is drafted in the language the patient wrote in, and a person at the clinic approves it before it goes.
What a demo shows in San José and Santa Ana
The demo opens on a WhatsApp message sent at 8:50pm from Pozos. A man asks whether he and his wife can both see the internist on Friday morning before work. wai reads the doctor's busy times from Google Calendar, Outlook or Apple Calendar and drafts a reply in Spanish offering two adjoining open times. The receptionist approves it at 7:30am.
Before approving, the receptionist adds the clinic's privacy notice, so both patients are told how their data will be used before anything is collected, as article 5 asks.1 Reminders go out on Thursday, and a cancellation is offered to the waitlist.
A call missed during the morning traffic becomes a drafted text for the front desk to send. In the consultation wai drafts the note, the doctor reviews and signs it, and codes come from the signed note for the insurer's claim, ready for the team to check.
For hospitals, insurers and public institutions in Costa Rica
Private hospitals, insurers and public institutions can commission a system built on wai for one defined pathway, with records hosted in Costa Rica. Ownership, data and model rights are agreed in the contract, as described on the organisations page.
Where to start
First, update the privacy notice to cover recording the consultation for an AI note and confirm the clinic's sanitary operating permit is current.13 The consent form template gives wording to adapt into Spanish.
Second, list every transfer of patient data and check each has the patient's express authorisation, as article 14 requires.1 Third, export a week of WhatsApp enquiries and missed calls from both San José and Santa Ana and bring them to a fifteen-minute demo.
Bring a week of WhatsApp enquiries from Santa Ana and San José patients and watch each one drafted for your team to approve.
Frequently asked questions
Is health data sensitive under Costa Rican law?
Yes. Article 9 of Law 8968 lists data on health among sensitive data, and allows processing for diagnosis and care by staff bound by professional secrecy.1
Who enforces data protection for clinics in Costa Rica?
Does a clinic need patient authorisation to share data with a supplier?
What permit does a clinic in Santa Ana need?
A sanitary operating permit from the Ministry of Health, processed under Executive Decree 44509-S.3
Where does wai host a Costa Rican clinic's records?
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic. For a clinic in San José or Santa Ana, that country is Costa Rica.
Does wai answer patients by itself?
No. wai drafts each reply, a person at the clinic approves it, and the doctor signs every note.8
Sources
- 1Procuraduría General de la República, SINALEVI, 2011Ley 8968, Protección de la Persona frente al Tratamiento de sus Datos PersonalesRead 15 October 2026Read source
- 2PRODHAB, 2026Agencia de Protección de Datos de los Habitantes (PRODHAB)Read 15 October 2026Read source
- 3Ministerio de Salud de Costa Rica, 2026Ministerio de Salud de Costa Rica, preguntas frecuentes sobre permisos de funcionamientoRead 15 October 2026Read source
- 4Colegio de Médicos y Cirujanos de Costa Rica, 2026Colegio de Médicos y Cirujanos de Costa Rica, normativasRead 15 October 2026Read source
- 5Municipalidad de Santa Ana, 2026Datos generales del cantónRead 15 October 2026Read source
- 6Tribunal Supremo de EleccionesConstitución Política de la República de Costa RicaRead 15 October 2026Read source
- 7wai, 2026Security and trustRead 15 October 2026Read source
- 8wai, 2026wai changelog, intake answered by voice in any languageRead 15 October 2026Read source
Every enquiry from San José and Santa Ana answered by morning, and every note signed before the next patient.
Fifteen minutes with a clinician who uses wai daily, on your own WhatsApp enquiries. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits