Reports in consumer tools
Under time pressure, a report containing patient data gets pasted into a chatbot to tidy it up. No processing agreement, no logging, no idea where the data ends up.
Healthcare
Patient data stays in house. In your own server room.
Clinicians spend a large part of their time on administration. AI can help, but patient data does not belong in a consumer tool. werqly runs AI on a node in your own server room, with roles per department, safeguards on national ID and patient numbers, and an audit log that records who used which data and when.
- Node in your own server room
- Roles per department and function
- Logging per user and per source
Running in your server room
Role: Clinician
- Mistral Large
- Llama 70B
- Qwen 32B
Safeguards active
Insight: anonymous (default)
- National ID detection
- Patient numbers blocked
werqly Node — your own AI node, in your own server room
The risk
Where it goes wrong in healthcare.
A ban that does not work
Banning AI does not remove the administrative burden. It only makes the use invisible to the data protection officer.
Requirements you must evidence
Health data comes with national security and hosting requirements that must be demonstrable. A standalone AI tool without logging does not fit them.
Benefits
What it gives your organisation.
Less administrative burden, without patient data leaving the building.
Less administration per clinician
Draft reports and handovers take less time, so more time goes to the patient.
Patient data stays inside
Processing on a node in your own server room: no transfer, no cloud vendor, and a manageable DPIA.
An approved route instead of a ban
Staff get a safe alternative to the chatbot on their phone. The DPO gets visibility instead of blind spots.
Demonstrable within your security framework
Logging per user and per source fits the access-logging requirements of health-data rules and your security policy.
Use cases
What healthcare providers use it for.
Automations are built per organisation, usually following from the TIMA Scan. Always supportive: the clinician checks and decides.
Draft reports and notes
A first version of a report, which the clinician checks and completes.
Summaries for handover
The relevant information from a record, gathered for a handover or referral.
Letters to referrers
Draft letters to the GP or referring physician, based on the report.
Searchable protocols
Your organisation’s guidelines, protocols and work instructions searchable, with sources.
Analysing incident reports
Recurring themes in complaints and incident reports made visible for quality management.
Administration and registration
Preparing registration and billing work, checked by the administration.
AI security and governance control
AI security and governance, built for healthcare.
werqly AI Control gives your security officer and DPO the means to bound, log and account for AI use.
Roles per department and function
Clinicians, back office and management each get their own sources, models and automations.
Safeguards on IDs and patient numbers
Patterns are blocked per role before they reach a model. Also for roles without EHR access.
Access logging for health data
Every access to data through AI is logged: who, when, which source. You set the retention period.
Insight on your terms
Anonymous by default, agreed with the works council and DPO. Per user only after four-eyes approval, for incidents.
Management link visible and severable
With the node in your server room, you can see what travels over the management link and cut it.
Automations with an owner
Every automation is tied to a responsible person and a set of sources. The clinician always decides.
Regulation
What the rules look for.
werqly does not make processing patient data lawful by itself. It does give your organisation an environment that fits into your information security.
| Framework | What it asks | How werqly fits |
|---|---|---|
| National health-data hosting rules | Several EU countries set specific requirements: HDS certification for hosting health data in France, a C5 attestation for cloud use in Germany, NEN 7510 compliance in the Netherlands. | A node in your own server room keeps health data within your organisation. werqly holds neither HDS nor C5, and its NEN 7510 certification is in progress. |
| Medical confidentiality | Patient data only for those directly involved in the patient’s care. | Roles per department and function determine which sources and automations someone may use. |
| GDPR: health data (Art. 9) and DPIA (Art. 35) | Health data is a special category of personal data. Large-scale processing usually requires a data protection impact assessment. | Processing on a dedicated node in your server room, without transfer to third parties, makes the DPIA more manageable. |
| Medical Device Regulation (EU 2017/745) | Software intended for diagnosis or treatment can be a medical device. | werqly is not a medical device. Use it for administration and support, not for diagnostic or treatment decisions. |
This page is not legal advice. Always assess the use of AI with your own data protection officer, compliance function or professional body.
Recommended setup
Which setup fits a healthcare provider.
For patient data we recommend your own server room: the data then never leaves your organisation. With werqly Pro management, werqly operates the node remotely as a processor; when self-managed, your IT department does so.
- Node in your own server room or datacentre
- Connection to your electronic health record read-only and per role, as a project with your EHR vendor
- werqly Cloud only for work without patient data
Calculate your private AI costs.
Enter your work email and number of employees. We work out four setups for you straight away: in your own server room or in our datacentre, self-managed or with werqly Pro management. werqly is not a cheap AI subscription: you pay for your own hardware and full control.
- 1Enter your email and number of employees
- 2Compare four proposals
- 3Request a quote straight away
Working out the proposals…
For patient data we recommend your own server room. werqly holds neither HDS nor C5 certification and its NEN 7510 certification is in progress; werqly Cloud suits work without patient data.
Your own server room
Your node in your own server room or rack
werqly Cloud
No server room? A locked rack in our EU datacentre
werqly Pro management
Your own server room
We operate the node and the models
— per month
—
- Data never leaves your premises
- No outside party in the processing
- Updates, monitoring and support by werqly
werqly Pro management
werqly Cloud
We operate the node and the models
— per month
—
- For organisations without a server room
- Dedicated node in a locked rack, never shared
- Updates, monitoring and support by werqly
Self-managed
Your own server room
Your IT department operates it; we supply software and updates
— per month
—
- Data never leaves your premises
- No outside party in processing or management
- Full control with your IT department
Self-managed
werqly Cloud
Your IT department operates it; we supply software and updates
— per month
—
- For organisations without a server room
- Dedicated node in a locked rack, never shared
- Your IT department runs policies and automations
Indicative amounts, excluding VAT. Custom automations are quoted separately. Only the quote is binding.
FAQ
Questions from healthcare providers.
May patient data be processed in werqly?
That depends on your own assessment: the legal basis, a DPIA, and how werqly fits your national security and hosting requirements. The setup in your own server room, without transfer to third parties, is built for it. Involve your data protection officer from the start.
Is werqly a medical device?
No. werqly supports administration and documentation. The clinician checks the output and makes the decisions. Applications intended for diagnosis or treatment fall under the Medical Device Regulation.
Can werqly connect to our electronic health record?
Yes, as a project with your EHR vendor. Such a connection is read-only, scoped per role and part of the DPIA. Expect it to be the part that needs the most preparation.
What does werqly see of patient data?
Prompts, documents and output are processed on the node in your server room. The management link carries configuration, updates and only the insights you release. With werqly Pro management, werqly is a processor and maintenance is covered by the processing agreement.
Further reading in the knowledge base
AI in healthcare: patient data, hosting rules and the GDPR
Can a care organisation use AI with patient data? What medical confidentiality, the GDPR and hosting rules (NEN 7510, C5, HDS) require, and how to do it safely.
Read the article →AI security in healthcare: what the information security standard asks of an AI environment
Dutch healthcare runs on NEN 7510, built on ISO 27001. What AI adds to the risk register, which requirements an AI environment must meet and how to show it.
Read the article →What is private AI? Meaning, forms and when you need it
Private AI means language models run on infrastructure that belongs to your organisation alone. What it is, which forms exist and when it is the right choice.
Read the article →Other sectors
Law firms and notaries
It is not about AI, it is about professional secrecy. Case files and client data never leave your firm.
View the sector →Financial sector
Client data, DORA and the AI Act: AI whose location you can evidence.
View the sector →Local government
Residents’ data, algorithm registers and the AI Act: AI you manage yourself.
View the sector →