Create powerful appointment bookings, intake forms & patient feedback for your practice in no time — with AI, no tech skills needed

Patients still fill in intake forms on a clipboard in the waiting room, then an assistant types the data into the practice software. That costs several minutes per patient and produces typos. A digital pre-intake moves this step upstream: with the appointment confirmation you send a magic link that opens the form directly in the browser — no app, no login.

The magic link is time-limited (e.g. 7 days) and bound to the patient's email address. Anyone without email scans a QR code in the practice and fills the form on their own smartphone instead of the clipboard. Intermediate states are saved, so an interruption is no problem.

Hosting is in Germany (Hetzner Falkenstein), backups run in the EU, no US cloud provider sits in the path. That is not only GDPR-compliant but spares you the Schrems II discussion at every audit. Patient data is stored encrypted and can be deleted automatically after the retention period.

Article 7 GDPR requires that consent was given verifiably — not just that a checkbox was ticked somewhere. In a dispute you must be able to show who ticked what when. A mandatory checkbox with a link to your privacy policy is the baseline, the audit trail is the obligation.

The activity log stores per response: consent timestamp, IP address (hashed for data minimisation), user agent and the exact wording of the consent in the version that applied at that time. If you change the text later, the old version stays linked to the old answer — you can thus prove what the patient actually said yes to back then.

For sensitive processing like AI analysis or third-party sharing you need double consent — separate checkboxes, separate purposes, individually revocable. Conditional logic only surfaces the second checkbox when actually needed, so the first does not drown in noise.

A data processing agreement (DPA) is a sober contract between you as data controller and a service provider that processes personal data on your behalf. As soon as patient data leaves your practice — because it sits with a hosting provider — you need a DPA per Art. 28 GDPR. Without one, the processing is formally unlawful.

Questee runs on Hetzner servers in Falkenstein and Nuremberg. Hetzner offers a standard DPA that can be signed directly in the Hetzner customer account (PDF with qualified signature or classically printed and mailed). Since Questee itself is the data processor of your practice, the chain runs in two steps: practice → Questee → Hetzner. You receive the DPA with Questee on request by email.

The TOM documentation (technical and organisational measures) matters: which encryption, which access rights, which backup strategy. This documentation must be ready at hand during an audit by the supervisory authority. We provide it as a PDF so you can hand it to your data protection officer.

A bit of honesty up front: there is currently no native integration with t2med, Medatixx, Tomedo or comparable practice software. The reality in German practices is that intake data gets transferred manually into the patient file — whether the form was filled on paper or digitally. Digital still saves time because typing falls away: copy-paste from the PDF export or structured view in the browser.

Two paths have proven themselves in practice. First: PDF export of the full response, printed or filed as a document in the patient record. Second: CSV export at the weekend, filtered by appointment date, manual import into a patient list. Webhooks to external systems are possible but typically only worthwhile at higher volumes.

For special workflows like pre-op checks, wound healing follow-ups or therapy compliance surveys, a simple webhook into a Google sheet or Notion database often suffices — no enterprise system needed. The important part is to think the workflow honestly: what does digital capture add if someone still evaluates by hand at the end? In most cases: fewer typos, less waiting time, more structure.