Healthcare
Agentic AI for healthcare — clinical operations, claims and documentation automation designed around GDPR Article 9, MDR and strict EU data residency.
What makes healthcare hard for AI
Health data is special-category data
Processing requires an Article 9 condition, not merely a lawful basis. That shapes architecture: what may be sent to a model, where inference may run, and what may be retained in logs — which routinely contain prompts.
Clinical decision support may be a regulated device
Software intended to inform clinical decisions can fall within the Medical Device Regulation, bringing conformity assessment into scope. The boundary between operational tooling and clinical decision support is where the classification turns, and it deserves a deliberate answer early.
Interoperability is uneven
FHIR adoption varies by system and country. The European Health Data Space adds a further layer of obligations as it phases in.
Where the value concentrates
The clearest wins sit in administrative and operational work rather than clinical judgement:
- Clinical documentation. Drafting notes and letters for clinician review, reducing time spent on records.
- Coding and claims. Extraction and code suggestion with human confirmation, improving accuracy and reducing rework.
- Scheduling and capacity. Demand forecasting and coordination across constrained resources.
- Prior authorisation. Assembling supporting evidence and tracking status.
What the economics look like
Documentation burden is both a cost and a retention issue — administrative load is a well-documented contributor to clinician burnout. Programmes that return time to clinical staff tend to be adopted willingly, which matters more than the raw business case.
How we build it
We classify each data flow before choosing infrastructure, so only the flows that genuinely require EU-controlled processing carry that cost — and the reasoning is documented for the DPIA rather than reconstructed afterwards.
Sovereignty by design
Pseudonymisation before inference where possible, key custody outside the provider where the data warrants it, and prompt logs treated as regulated data with the same residency and retention rules as the source.
Related work
Starting smaller
Private clinics and smaller providers generally start with documentation support and appointment coordination — high-volume, low clinical risk, and outside device classification.
Questions we get from healthcare providers
Is our AI tool a medical device?
It depends on intended purpose. Software meant to inform a clinical decision about an individual patient can fall within the Medical Device Regulation; operational and administrative tooling generally does not. The distinction turns on stated intended use, so decide and document it early — retrofitting a classification is expensive.
Can patient data go to a commercial model provider?
Only with an Article 9 condition and a transfer analysis that survives scrutiny. In most designs the better answer is to avoid the question: pseudonymise before inference, keep identifiers inside your own boundary, and re-associate on return.
What does the European Health Data Space change?
It introduces obligations around interoperability and secondary use that phase in over the coming years. The practical implication now is to build with FHIR-aligned structures and explicit provenance, so compliance is a configuration rather than a migration.
Where do prompt logs sit?
Inside the regulated perimeter. Logs of clinical AI systems contain clinical data; default observability retention is one of the most common gaps we find.