AI in Medicine: Medical Data, GDPR, and Self-Hosted Solutions in 2026

The chief physician of a private medical center in Vienna asks: "Will AI diagnose instead of our doctors?" Our answer is: no. Never. An AI assistant in a medical center is not a diagnostician, nor a doctor. It's a smart assistant for the administrator that responds to patients at 10 PM when the reception is already closed – and it does so exclusively based on your clinic's documents. In short: AI in medicine, as we understand it, is the automation of patient informational queries and searching internal protocols. Treatment, diagnosis, prescriptions – always the doctor's domain. But "How to prepare for an MRI?" at 11 PM – that's entirely doable for AI.

📚 Table of Contents

• AI in medicine is not a diagnostician: what it does and what it never does
• What scenarios does an AI assistant in a medical center solve
• What medical data is under special GDPR protection and why this applies to AI
• Three layers of regulation: GDPR Art.9 + EU AI Act + national medical law
• Why ChatGPT and Notion AI are legally unacceptable in medicine
• AI architecture for a medical center: what is stored where
• Real-world case: a medical center and the implementation of self-hosted AI
• What to tell a patient if they ask about AI: a conversation script
• Checklist for the chief physician: 10 questions before implementing AI
• Frequently Asked Questions
• Conclusions
• Want to see how it works?

AI in medicine is not a diagnostician: what it does and what it never does

When we at AskYourDocs talk with chief physicians and medical center directors, the first question is always the same: "Is this AI that will make diagnoses?" The answer is always the same: no.

There's a fundamental difference between medical AI (systems that analyze images, aid in diagnostics, support clinical decisions) – and a document-based AI assistant that answers informational queries. We focus on the latter. The former is a separate class of solutions with different requirements, different regulations, and different responsibilities.

The AI responds exclusively based on the documents uploaded by your clinic. If a question goes beyond their scope, the AI honestly replies, "The answer is not in our documents," and suggests contacting a doctor or administrator. This isn't a limitation – it's a safeguard.

Specific examples – what this boundary looks like in practice:

This behavior is configured during implementation via a system prompt and tested with sample questions before launch. If the AI attempts to answer a medical question during testing, the settings are adjusted to completely eliminate such behavior. Only after this is the system handed over to the clinic.

What scenarios does an AI assistant in a medical center solve

Preparation for procedures – 24/7 without staff involvement

Patients remember questions about preparation not during working hours, but in the evening or at night. At 10:30 PM, a patient remembers they have a gastroscopy tomorrow and can't recall if they were allowed to eat that evening. Without AI: they either stay awake worried, call the on-duty staff, or come unprepared and the procedure is rescheduled. With AI: they message the Telegram bot and get the exact answer from the clinic's protocol in 5 seconds.

According to our clients' data, inquiries about preparation constitute 25–40% of all administrative queries. In a center with 10 specialties and 50 procedures, this means hundreds of combinations. AI knows them all – provided the protocols are uploaded. And it answers precisely according to your clinic's protocol, not the "general internet."

Prices, services, and scheduling – end of phone queues

"How much is an MRI?", "When does the cardiologist see patients?", "What documents are needed for the first visit?" – each question takes 2–5 minutes of an administrator's time. With 50 such questions daily, that's nearly 4 hours spent solely on repetitive answers. AI responds instantly, in parallel to an unlimited number of queries, at any time of day.

Internal knowledge base for staff

A nurse in a new department doesn't remember a patient preparation protocol – they ask the AI and get the answer in 10 seconds with a link to the specific document. A new doctor doesn't distract experienced colleagues with organizational questions – the AI answers from corporate regulations. We recommend a separate collection of documents for staff with role-based access control by department.

Post-discharge support and specialist navigation

"When can I eat after a colonoscopy?", "How soon can I drive after anesthesia?" – these questions arise at home after the procedure. AI answers precisely based on discharge instructions. For questions beyond standard recommendations, it immediately redirects: "This matter requires a doctor's consultation. Please call [number] or, if your condition worsens, 103."

For initial navigation: "My knee hurts – which specialist should I see?" – the AI answers exclusively based on your center's structure and list of specialists. This is not a medical consultation – it's clinic navigation.

Real numbers

• 60–70% of administrative inquiries are informational questions that AI handles independently.
• 3–4 hours per day are freed up for each administrator for real tasks.
• 100% of inquiries outside working hours receive an instant response – previously 0%.
• 0 instances of AI attempting to answer a medical question – with correct configuration.

What medical data is under special GDPR protection and why this applies to AI

What constitutes medical data under GDPR Article 9

According to GDPR, special categories of data include medical records, genetic and biometric data, information about mental health and disabilities. But the most crucial practical aspect is data that reveals health status. If a patient asks, "How to prepare for chemotherapy?" – the very fact of this question reveals a diagnosis of cancer. This is already Art. 9 data.

The practical implication: if an AI assistant receives questions from patients via a cloud service, each question is stored on the provider's servers. "When can I ride a bike after knee surgery?" reveals that the patient underwent surgery. All of this is Art. 9 data on servers located in the US, outside your control.

Two legal bases for processing medical data via AI

Under GDPR Article 9(2), there are two realistic bases for medical centers:

Art. 9(2)(h) – medical necessity. Processing is necessary for the provision of healthcare or the management of healthcare systems. This is the most common basis – but it requires that processing occurs within a healthcare system, under the responsibility of medical personnel, with appropriate security safeguards. Cloud-based AI with servers in the US does not meet these requirements.

Art. 9(2)(a) – explicit consent. Explicit consent for medical data is a much stricter requirement than standard consent. It's not a simple "I agree to the terms" checkbox, but a separate, specific statement from the patient confirming they understand what data is being processed and for what purpose. In practice, implementing this correctly for an AI chat interface is complex.

For most medical centers, Art. 9(2)(h) is more practical – but it legally mandates a self-hosted architecture where data is not transferred to third parties.

Three layers of regulation: GDPR Art.9 + EU AI Act + national medical law

At AskYourDocs, before each implementation in a medical center, we conduct a regulatory analysis with the client. This takes time – but it prevents much more costly problems later.

Layer 1: GDPR Article 9

The fundamental layer applicable to any processing of medical data. For an AI assistant in a medical center, it requires:

• Legal basis under Art. 9(2) – documented before system launch.
• DPIA – mandatory for AI processing medical data at scale. Important practice: DPIAs must be reviewed with every significant system change, not just at initial implementation.
• DPO – mandatory for most medical centers. Must be involved in assessing any new AI system.
• ROPA – all processing operations via AI must be documented in a register.

Real precedent: In 2024, the Swedish regulator (IMY) fined the pharmacy Apoteket SEK 37 million (approx. €3.2 million) for transferring customer medical data to Meta via Pixel without a proper legal basis and technical safeguards. The absence of a correct Art. 9(2) justification is one of the most common reasons for fines in healthcare.

Layer 2: EU AI Act

Update May 2024: The Digital Omnibus agreement of May 7, 2024, postponed deadlines for high-risk AI systems. For use-based systems (Annex III) – from August 2, 2026, to December 2, 2027. For AI embedded in medical devices (Annex I, medical devices) – until August 2, 2028. Formal adoption is expected by August 2, 2026.

But the key classification remains important already now:

High-risk (diagnostics, clinical decisions, image analysis): conformity assessment, registration in the EU AI database, audit logs. According to The Thinking Company's estimates, the governance framework for such a system ranges from €80,000 to €200,000 for initial development.

Not high-risk (informational queries, administrative tasks): The AskYourDocs AI assistant, which only answers informational queries and always redirects medical ones, is generally not considered a high-risk system. This is precisely why we strictly adhere to this principle: it keeps the system out of the high-risk category, not only ethically but also regulatorily.

Layer 3: National Medical Law

Austria: medical confidentiality is protected by criminal law – not just GDPR. Ärztegesetz § 54 – the doctor's duty to maintain confidentiality under threat of criminal liability. Transferring any information revealing a patient's medical condition to a third party without explicit consent is a potential criminal offense. A "third party" includes OpenAI, Google, and any cloud provider. Austria's DSB has established the strictest EU standard: it is insufficient to claim that "the probability of access by US intelligence agencies is low" – technical impossibility of such access is required.

Germany: § 393 SGB V – data of insured patients must be stored exclusively within the EEA on certified providers. MBO-Ä § 9 (Schweigepflicht) – violation of medical confidentiality: disciplinary and criminal liability. AWS/Azure Germany servers are physically in Germany but managed by US companies – the US CLOUD Act allows demanding access to data regardless of server location.

How the three layers interact

For detailed information on GDPR requirements for Austria and Germany, see the article AI and GDPR in Germany and Austria: Requirements for Corporate Systems 2026.

Why ChatGPT and Notion AI are Legally Unacceptable in Medicine

We often hear from clinic directors: "But we're only answering general questions – we're not transmitting patient records." The problem is that questions from patients of a medical center are already considered medical data under GDPR Article 9. This is true even without accessing their medical records.

Reason 1: Patient questions reveal medical status. "Can I take ibuprofen after stomach surgery?" reveals that the patient has undergone surgery. This constitutes Art. 9 data. If this data is stored on OpenAI servers in the US without a DPA and TIA, it's a GDPR violation, regardless of whether you transmitted the medical record itself.

Reason 2: Medical confidentiality extends beyond GDPR. In Austria and Germany, it's protected by criminal law. Transferring any information that reveals a patient's medical condition to a third party without explicit consent is a potential criminal offense. OpenAI, Google, Microsoft – all are considered "third parties" in this context.

Reason 3: Medical law requires processing under the responsibility of medical personnel. Art. 9(2)(h) GDPR permits processing without explicit consent only if it occurs "under the responsibility of a professional subject to the obligation of professional secrecy." A cloud AI provider is a commercial entity without medical confidentiality obligations. They do not fall under this provision.

Reason 4: Lack of an auditable trail under your control. With cloud-based ChatGPT, you have no control over the logs – the provider can modify or delete them. During a regulatory audit, you won't be able to provide proof that the system operated correctly. The EU AI Act (Art. 12) requires audit logs for high-risk systems to be retained for 10 years. With self-hosted solutions, logs are on your server under your control.

Real Precedent: In 2024, the Swedish regulator (IMY) fined the pharmacy chain Apoteket SEK 37 million (approx. €3.2 million) for transferring customer medical data to Meta via its Pixel – without adequate technical security measures. The penalty wasn't for a data breach, but for the lack of a legal basis and technical guarantees. This is a trend: regulators in the EU are actively scrutinizing the healthcare sector, particularly concerning AI and digital tools.

Learn more about the legal risks of cloud AI in the article Self-hosted AI vs Cloud: Where Your Data Stays.

AI Architecture for Medical Centers: What is Stored Where

For executives, the distinction between "we store your data securely" (a provider's promise) and "your data cannot physically leave your server" (an architectural guarantee) is crucial. For the medical field, the latter is paramount. Below is an outline of the system we deploy.

Component 1: Server

The most critical choice in the entire architecture is the physical location and management of the server. For AT/DE clinics, we deploy exclusively with EU providers outside the CLOUD Act's jurisdiction:

• Hetzner Online GmbH (Nuremberg DE or Helsinki FI) – Our default choice. A German company, ISO 27001 certified, starting from €30/month.
• OVHcloud (Strasbourg FR) – A French company, an alternative to Hetzner.
• Clinic's Own Server – Maximum isolation, suitable for the highest requirements.

Component 2: Database

PostgreSQL + pgvector – A standard database with vector search capabilities. It stores the clinic's document text, their vector representations, metadata, and optionally, query logs. What is never stored: medical records, lab results, or patients' personal identifiable information.

We recommend segmented collections: a public one (protocols, price lists, schedules – for patients) and an internal one (regulations, procedures – for staff only). If needed, separate collections can be created for specific departments.

Component 3: Language Model

Option A – Closed Circuit (Ollama locally). The model is installed directly on the clinic's server. No queries leave the local environment. We recommend this for AT/DE clinics with the highest confidentiality requirements. Optimal models include Mistral Small 3 (24B) or Llama 3.3 70B.

Option B – Hybrid (local storage + external LLM). Documents are stored locally, and response generation is handled via an external API (Mistral or OpenAI). However, only an anonymized fragment is transmitted, without any identifiers. This is more cost-effective for maintenance but involves minimal external traffic. For AT/DE clinics processing data of insured patients, we strongly recommend Option A.

Component 4: Chat Interface

Depending on the clinic's needs, we deploy: a web chat for the website (embeddable with a single line of code), a Telegram bot, a WhatsApp bot (via Business API), or an internal interface for staff (accessible only from the clinic's IP addresses or via VPN). All interfaces are configured with an origin filter, accepting requests only from your authorized sources.

Full Request Flow – In Simple Terms

A patient writes at 11 PM: "How should I prepare for an MRI with contrast if I have a iodine allergy?"

1. The query arrives at the clinic's server via HTTPS and is logged on your server.
2. The question is locally converted into a mathematical vector (embedding model on your server).
3. Vector search finds relevant snippets from your protocols – for example, the MRI with contrast protocol and the section on allergic reactions.
4. The retrieved snippets + the question are passed to the LLM – either locally (Option A) or only the anonymized text of the snippets is sent externally (Option B).
5. The LLM generates a response: "With an iodine allergy, it is essential to inform your doctor before the procedure. An MRI without contrast is possible. To clarify details, please contact [doctor's number]. To schedule an appointment: [link]."
6. The response is returned to the patient through the same secure channel.

Security Summary: The patient's name was not used. No medical records were accessed. The query remained solely on your server. In the hybrid scenario, the external LLM received an anonymous text snippet of the protocol without contextual information about who was asking.

What is Uploaded and What is Never Uploaded

Learn about document preparation in the article How to Prepare Documents for an AI Assistant. For details on closed-circuit systems, refer to the article Closed Circuit with Ollama: Offline AI for Business.

Real-World Case: Medical Center and Self-Hosted AI Implementation

We're detailing this case, not to boast about results, but to illustrate every decision made and its reasoning. In medicine, every technical choice carries legal and clinical implications.

Situation Before Implementation

The clinic director approached us not because he "wanted AI," but because he had a specific operational problem and a concrete fear.

Problem: 3 administrators × 3 hours = 9 hours daily spent solely on repetitive answers. 40-50% of inquiries arrived outside working hours and remained unanswered, leading to complaints and negative feedback. At an average rate of €17/hour, this represented €135-€180 in hidden daily costs. The clinic had 8 specialties, 25 doctors, 200+ preparation protocols, and 350 services listed.

Director's Fear: "What if the AI advises a patient incorrectly on a medical matter?" Our response shaped the entire architecture: "The AI will not provide medical advice. At all. Never. We are building a system where this is technically impossible, through system prompts and mandatory pre-launch testing." This precisely enabled the implementation.

What Was Uploaded — and What Was Deliberately Excluded

Uploaded: 200+ preparation protocols for procedures, a price list with 350 services, doctor schedules, clinic FAQs (100+ question-answer pairs), and post-procedure recommendations for the 15 most common procedures. Each document was verified for accuracy by the head physician before upload.

Deliberately NOT Uploaded: Patient medical records, lab results, consultation notes. An AI used for informational queries doesn't need access to specific patient data. Uploading such data would have introduced Art. 9 GDPR risks and required explicit consent from each patient without any functional benefit.

Technical Configuration and Rationale

Server: Hetzner, Finland, 32 GB RAM / 8 vCPU / RTX 3080 16GB / 500 GB SSD. Hetzner is a German company, so the CLOUD Act does not apply. This is crucial for a clinic with Austrian patients, as the DSB's stance on US cloud providers is the strictest in the EU. Choosing Finland over Nuremberg was the client's preference for a geographically isolated data center for added resilience.

Model: Mistral Small 3 (24B) via Ollama — closed-loop system. For informational questions about preparation and schedules, Llama 3.3 70B is overkill. Mistral Small 3 provides 9/10 quality responses with half the resource consumption and answers in 3-8 seconds. A closed-loop system was chosen due to the sensitive nature of medicine: even an anonymized fragment like "preparation for chemotherapy" reveals oncology issues. No data should leave the server.

Three Interfaces: Telegram bot (for younger patients), website web chat (for older patients and initial contact), and an internal interface for staff (accessible only from clinic IP addresses, providing access to internal regulations not available to patients).

Setting System Boundaries — The Most Critical Step

This is where most AI providers cut corners, and it's where we invest the most attention. In medicine, an AI responding with something resembling medical advice poses a legal and reputational risk to the clinic.

The system prompt includes four strict rules:

• Respond only based on clinic documents. If no answer is found, state honestly: "Our documents do not contain the answer to this question." No responses from "general knowledge" — protocols vary between clinics.
• For any medical question — provide a standard redirection. The line between "informational" and "medical" is blurry. "Can I take ibuprofen before an MRI?" depends on the patient's condition, which the AI doesn't know. Anything related to medications, symptoms, or diagnoses automatically triggers a redirection without an attempted answer.
• Always cite the source. "According to the clinic's [clinic name] gastroscopy preparation protocol" — patients can verify and trust more. If an error occurs, the administrator can immediately see which document needs correction.
• If unsure — redirect. It's better to over-redirect to a doctor than to provide an inaccurate answer.

Pre-launch Testing: 150 test queries — 100 informational and 50 medical. All 50 medical queries received standard redirection with no attempt to answer the core question. Only then was the system launched.

Results After 2 Months

• After-hours responses: 100% instant responses (previously 0%). Peak activity: 8 PM–11 PM — precisely when patients prepare for the next day's procedures.
• Administrative workload: 65% reduction in repetitive questions requiring manual responses. Staff can now focus on actual bookings and complex situations.
• Patient satisfaction: Feedback regularly includes "very convenient to get an answer even at night." Complaints about "unanswered calls" have disappeared.
• GDPR audit after one month: All data is on the clinic's server, no transfers to third parties, logs are accessible to administrators. The system complies with requirements.
• Medical questions: Zero instances where the AI attempted to provide a medical answer. Every medical question over two months received a standard redirection.
• Financial impact: 9 hours/day × €17 × 22 days = ~€3,370 in monthly cost savings against a €120/month server cost.

What Didn't Work and How We Fixed It — Honestly

Scanned documents without OCR. For the first two weeks, some protocols yielded empty or inaccurate responses: 30% of clinic documents were PDF scans without a text layer. Solution: conversion using Adobe Acrobat and online OCR (2-3 minutes per document). After conversion, response quality improved to 9/10.

Outdated protocols. During upload, we discovered 15% of protocols in the archive were old versions. We asked the head physician to verify the currency of each. This took a week but prevented incorrect patient answers.

Borderline questions. "Should I stop metformin before an MRI?" This is both a preparation question (covered in protocols) and a medication question (medical). Solution: The AI provides information from the protocol and recommends confirming with a doctor: "According to our protocol: if you are taking metformin, please inform your doctor before the procedure. For individual consultation — [doctor's contact]."

For detailed information on document preparation, see the article How to Prepare Documents for an AI Assistant.

What to Tell a Patient Who Asks About AI: A Conversation Script

These scripts were developed with our medical center clients based on real patient inquiries.

"Is an AI or a person responding to me?"

"Yes, our AI assistant is responding. It operates based on our clinic's documents and only answers informational questions. It does not respond to medical queries regarding symptoms, diagnoses, or treatments, and always redirects to a doctor. If your question is medical, I'll connect you with a specialist."

"Where is my data stored?"

"Your question and our response are stored exclusively on our clinic's server in [EU country]. We do not share your inquiries with any external services — neither ChatGPT, Google, nor any other platforms. Your medical records and lab results are not connected to this system at all."

"I don't want an AI to know my question."

"We fully respect your choice. Please call us at [phone number] or email [email address] — an administrator will respond. The AI chat is an optional convenience for after-hours inquiries, not a mandatory channel."

"Will the AI diagnose me?"

"No, absolutely not. Our AI only answers informational questions — preparation for procedures, schedules, prices. As soon as a question relates to symptoms, pain, or treatment, it immediately states, 'This is a medical question; please consult a doctor' and provides specialist contact information. Only a doctor can practice medicine."

What to communicate proactively — the bot's welcome message

"Welcome! I am the AI assistant for [Clinic Name]. I answer questions about procedure preparation, doctor schedules, pricing, and booking. I do not answer medical questions (symptoms, diagnoses, medications) — for those, please consult a doctor. Your data is stored exclusively on our clinic's server and is not shared with third parties."

Reading this for 30 seconds resolves 90% of potential questions and misunderstandings.

Checklist for Head Physicians: 10 Questions Before Implementing AI

Medical Data Security

• 1. Where are patient questions physically stored? Correct Answer: On the clinic's server within the EU. Anything else requires detailed analysis under Art. 9 GDPR.
• 2. Are patient medical records uploaded to the system? Correct Answer: No, never. An AI for informational questions does not need access to records.
• 3. Can anyone other than the clinic technically access the inquiries? Correct Answer: No. Not "we don't look," but "we technically cannot." Self-hosted provides this guarantee.

Legal Compliance

• 4. Has a DPIA been conducted? It's mandatory under GDPR Art. 35 for AI processing potential Art. 9 data. Without it, you don't know your risks and are violating the requirement.
• 5. Is there a DPO, and are they involved in the implementation? Most medical centers are obligated to have a DPO. They must assess any new data processing system.
• 6. Has the legal basis under Art. 9(2) been identified? Typically Art. 9(2)(h) or (a). This must be documented and included in the ROPA before launch.

Functional Boundaries

• 7. How does the system respond to medical questions? Verify technically: ask a test medical question and observe the response. Correct response: redirection without any attempt to answer the core issue.
• 8. Are queries logged in logs accessible to the clinic? Important for audits and for fulfilling patient rights (data access, deletion).

Management and Accountability

• 9. Who specifically is responsible for system administration? Not "the IT department in general" — but a specific individual with rights and instructions.
• 10. What is the procedure if the AI gives an incorrect medical answer? Incidents must be logged and corrected. A procedure should exist before launch — not after the first incident.

A full checklist of 20 questions is available in the article AI Security Checklist: 20 Questions Before Implementation for Business.

Frequently Asked Questions

Can an AI assistant recommend medications or dosages?

No — this is a strict boundary. The AI responds exclusively based on clinic documents. If a general post-procedure recommendation exists in the documents, it can reproduce it. Any question about specific drugs, dosages, or prescriptions always results in a redirection to a doctor, with no exceptions.

Is patient consent required for using an AI chat?

We recommend adding information about AI processing to your privacy policy and displaying a brief notification upon the first interaction with the chat. For a system that only processes anonymous informational queries without personal medical data, explicit consent under Art. 9 is not mandatory. However, transparency builds patient trust and is considered best practice.

What if a patient writes to the chat in a crisis situation?

Upon detecting keywords for emergencies ("unbearable pain," "shortness of breath," "fainting"), the system immediately responds: "If you are experiencing an emergency, call 103 or 112 immediately. Do not wait for a chat response." We configure this trigger during every implementation.

How long does implementation take?

5–7 business days, provided documents are in a text-searchable format. The most time-consuming part is document preparation: converting scans via OCR and verifying protocol currency. More details in the article How to Prepare Documents for an AI Assistant.

Conclusions

• 🚫 AI does not replace doctors: diagnosis, prescriptions, and treatment are always the doctor's domain. AI only answers informational questions from clinic documents.
• ✅ Real value: 24/7 preparation for procedures, pricing and schedules, staff access to protocols — frees up administrators from 60–70% of routine inquiries.
• ⚖️ Three layers of regulation: GDPR Art.9 + EU AI Act + national medical laws. An AI assistant for informational questions is not a high-risk system if it doesn't influence clinical decisions.
• 🚫 ChatGPT and cloud AI: patient questions can reveal medical data falling under Art. 9. Cloud servers under US jurisdiction are legally unacceptable for medical centers in the EU.
• 🏠 Self-hosted on the clinic's server: the only architecture where patient queries and clinic documents technically never leave your perimeter.
• 💬 Patients will ask: a clinic with a prepared, honest answer builds trust. A conversation script helps respond confidently and correctly.

Want to see how it works for your clinic?

Send us a few procedure preparation protocols and your price list. In 30 minutes, we'll provide a live demonstration: how the AI answers real patient questions — and where that data is physically located.

Write on Telegram →

Turnkey implementation in 5–7 days. EU-based server under your control. Patient medical records are not uploaded to the system.

Read also

• GDPR and AI on Documents: What Businesses Need to Know in 2026
• Self-hosted AI vs Cloud: Where Your Data Stays
• Closed-Loop with Ollama: AI Without Internet for Business
• 6 Risks of Data Leakage via AI: How to Protect Your Business in 2026
• AI and GDPR in Germany and Austria: System Requirements for 2026
• AI Security Checklist: 20 Questions Before Implementation
• How to Prepare Documents for an AI Assistant
• All Articles on Data Security and AI

⸻

Sources: Galeon — Health Data and GDPR 2026 · The Thinking Company — Healthcare AI Governance 2026 · DPO Consulting — GDPR in Healthcare · Momentum — GDPR Consent Requirements for Health Data · LegalNodes — EU AI Healthcare Regulation 2025 · Secure Privacy — Healthcare GDPR & Article 9 · Taylor Wessing — Re-use of Patient Data to Train AI · IMY — Fines against Apoteket and Apohem (2024)