GDPR compliant healthcare AI — and the question that comes before it.
OneDose is built to be operated under GDPR: health data is special-category data under Article 9, and a deployment needs a lawful basis, a data processing agreement, defined residency and working data-subject rights. But for clinical AI in the EU, GDPR is not the hardest question — medical-device classification under MDR Rule 11 and the EU AI Act is, and it is one no vendor should answer for you on a web page.
This page states what the regulations are and what our design posture is. It does not assert a classification or a conformity status, because neither is ours to assert.
What does GDPR require for health data?
Health data is special-category data under Article 9, which means processing is prohibited unless a specific condition applies. That is a higher bar than the general lawful-basis requirement in Article 6, and it is the first thing an EU reviewer will ask about — not encryption.
On top of that sit the familiar obligations: a data processing agreement with the processor, defined residency, transparency to the data subject, working access and erasure rights, breach notification, and a DPIA where the processing is high-risk — which automated processing of patient health data generally is.
As with HIPAA, none of this makes a product “GDPR compliant”. GDPR regulates controllers and processors. Compliance is a property of your deployment, your lawful basis and your agreements, and a vendor claiming to have settled it for you has misunderstood the regulation or is hoping you have.
What about the EHDS?
The European Health Data Space Regulation adds a further layer on how health data moves and is made available across the EU, with obligations phasing in over the coming years. It is a live and evolving area rather than a settled one, and any vendor presenting a finished EHDS story today is describing a roadmap in the present tense.
Our position is that EHDS obligations are a real design input and not yet a completed posture, and we would rather tell you that than perform certainty about a regulation whose implementation is still arriving.
Is a clinical AI agent a medical device in the EU?
This is the question that matters most and the one most vendor pages skip.
MDR Rule 11 covers software intended to provide information used to make decisions for diagnostic or therapeutic purposes — software in that category is generally Class IIa or higher, with the conformity assessment that implies. The EU AI Act (Regulation 2024/1689) layers further obligations on high-risk AI, with dates phasing through 2026–2027.
An AI agent that triages a symptom or scores clinical risk is squarely in the territory those rules are written about. We are not going to tell you on a marketing page that it is not.
What we will tell you is our design posture, which is a fact about our product rather than a legal conclusion: OneDose agents collect and escalate rather than decide. Clinical questions, low-confidence cases and any sign of deterioration route to a human clinician with the full context attached. The agent does not diagnose, does not triage a symptom to a conclusion, and does not tell a patient whether to continue a medication. That boundary is a design constraint rather than a configuration setting, and it exists for patient-safety reasons that happen to align with the regulatory ones.
Whether that posture places a given deployment inside or outside Rule 11 is a determination for your regulatory counsel and, where relevant, a notified body. It is not a determination a vendor can make for you, and one who offers to has told you something about how they will handle the rest of the relationship. Ask us for the technical detail your counsel needs and you will get it.
Why is there no EU site?
Because “the EU site” is not structurally a thing. hreflang targets are language plus an ISO 3166-1 alpha-2 country code — there is no EU-wide target — so an EU presence is really Germany, France, the Netherlands, Ireland, and so on, one at a time.
And national health systems procure in national languages. English reaches Ireland and stretches to the Netherlands and the Nordics; it does not credibly reach German, French, Italian or Spanish hospital procurement. That is a translation programme rather than a locale toggle, and it is not one to start before the classification question above has an answer.
So the EU gets this page: an honest statement of posture for the reviewer who needs to know we have thought about it. Country presence follows real pipeline and a cleared regulatory answer, in that order.
Frequently asked
- Is OneDose GDPR compliant?
- OneDose is built to be operated under GDPR — health data is special-category data under Article 9, and the deployment needs a lawful basis, a data processing agreement, defined residency, and the data-subject rights machinery. GDPR compliance is a property of a specific deployment and the agreements around it rather than of software, so the honest answer for your organisation comes from a conversation about your lawful basis and your processing, not from this page.
- Is an AI follow-up agent a medical device in the EU?
- That is a live classification question and OneDose does not assert an answer to it on a marketing page. EU MDR Rule 11 covers software providing information used for diagnostic or therapeutic decisions, and the EU AI Act adds obligations for high-risk uses. Our design posture is that agents collect and escalate rather than decide — the clinical determination stays with a clinician — but classification is a matter for a notified body and your regulatory counsel, not for a vendor’s website.
- Does OneDose have an EU site or EU-language pages?
- No, and that is deliberate. hreflang has no EU-wide code — regions are ISO 3166-1 country codes — and EU national health systems procure in national languages, so "an EU site" is structurally not one thing. Country-level presence follows real EU pipeline and a cleared regulatory answer, in that order.
- Where is OneDose data stored for EU deployments?
- Residency is configured per deployment and the guarantee for your contract should be confirmed in writing rather than read off a page. Residency is the claim a regulator will ask you to evidence, which makes it the worst possible thing to take from marketing copy — ours or anyone’s.