AI for private clinics
Health data is a special category under GDPR. The margin for error is the narrowest there is.
Updated
Why private clinics use Acotia
A clinic processes health data, the GDPR special category with the least room for error. Administration and clinical staff already use AI to draft reports and answer patients. Acotia masks identifiers before they leave and leaves the choice of model and the log in the clinic's hands.
Identifiers out
Tax IDs, social security numbers, phone numbers and emails are replaced by labels before reaching the model; the useful content stays.
EU-hosted models
The clinic decides which models are enabled and can limit itself to EU-hosted ones. Anything from the sensitive folder can always go to one of them.
What is not detected, we say
Patient names are not reliably detected by pattern. That is why we recommend custom terms and the sensitive folder for clinical documents.
EU
Mistral models hosted in the EU, on your company's account
0
conversation texts stored on the server
15
days to see what leaves today
The tasks we bring under control first
Reports and letters
Draft or summarise reports with patient identifiers masked.
Patient service
Answer emails about appointments, quotes or follow-up without sending the patient's phone or email.
Administration and billing
Review quotes and invoices with payment data handled according to the policy.
Internal protocols
Questions about procedures with no patient data, with model and cost logged.
Summarise the patient's visit: social security 28 12345678 40, phone 612 345 678.
Summarise the patient's visit: social security [NSS_1], phone [PHONE_1].
Where the problem shows up
Rarely in the consulting room and almost always in administration: drafting a report for an insurer, summarising notes, preparing a claim, translating instructions for a patient. Administrative tasks with clinical data inside, done in a hurry with whatever tool is at hand.
What can be done with the data inside
Drafting tasks work just as well with the patient turned into a token. Whatever does not survive that transformation gets routed to a model hosted in the EU or blocked, and the user receives the alternative rather than a flat no.
For the data protection officer
The evidence log is what turns a diffuse risk into something governable: which data categories appeared, how often, in which service and what was done with them. It is also the material you use to update the risk assessment.
What should not be a risk
Translating discharge instructions for a foreign patient, summarising a report for the insurer or drafting the reply to a complaint are tasks AI does well and that administrative staff want to use. The problem is not the task, it is clinical data travelling without control.
Official sources
General Data Protection Regulation (GDPR), Regulation (EU) 2016/679: official text on EUR-Lex. Health data is a special category (Article 9).
Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD): consolidated text in the BOE.
Spanish Law 41/2002 on patient autonomy and clinical records: consolidated text in the BOE.
Frequently asked questions
Can health data be used in an AI assistant?
Health data is a special category under the GDPR and requires reinforced safeguards. With Acotia, what cannot be replaced is routed to a model hosted in the EU or blocked. Whether the use is lawful depends on the legal basis of each processing activity: check with your DPO.
What does the data protection officer see?
Which data categories appeared, how often, in which team and what was done with them, in an exportable log. It is material for updating the risk analysis.
What happens if someone tries to send something blocked?
They get a notice explaining why and the permitted alternative, instead of a flat no. That way people do not go back to their personal account.