Nobody wants to be the one who signs off
The project stalls not because it is forbidden, but because it isn't clear who decides. Without a defined, secure architecture, processing sensitive data with AI is a risk that is hard to take on.
Healthcare
and healthtech.
AI in healthcare.
Here the first question is not which model to use: it is where the information stays, who can see what and what gets logged.We work with medical device companies, pharmaceutical distributors and healthcare services, from the data architecture up to the processes that rest on it.
Healthcare
What AI changes in healthcare
In healthcare the order of decisions is reversed compared with any other sector: first you decide the architecture, then the model. Not out of excessive caution, but for security and data protection.
A medical device company, a pharmaceutical distributor or a clinic handles two kinds of data at once. Data with no sensitivity at all (stock, supplier lead times, invoicing) and data that is as sensitive as it gets. The temptation is to treat everything with the same care, and the result is that nothing gets done. The sensible alternative is to separate them. Identify which processes don't touch sensitive data and start there, while the sensitive side is solved with an architecture designed for it rather than with an exception.
That is why, in this sector, the useful conversation starts with infrastructure questions. What information leaves the system, which model processes it and where it is hosted, who can see what and what gets logged. Once those four are answered, choosing the model is the easy part.
4architecture questions answered before a model is chosen
3systems where a batch's trail usually lives: ERP, warehouse and spreadsheets
80%of a new regulatory file is already written in the previous one
Three things you can automate now
None of the three touches patient data. So they can be tackled without first opening a six-month data governance debate.
Why do our costs always drift?
Forecasting models on material prices, rebates and expiry dates.
Where has this batch been?
Bringing together the batch trail that today is split across systems and making it searchable, with the full history. The trail is produced on the spot, instead of being rebuilt every time a customer or an audit asks for it.
Do I have to rewrite this whole file?
An assistant over your own regulatory and procedural documentation that finds what is already written and returns it citing the source document. A new file no longer starts from nothing.
What a first project looks like
Four steps, and the first is on paper. Here the architecture is written before anything is built, and that is what gets the rest approved.
-
1
Separate what touches sensitive data from what doesn't
Purchasing, supplier lead times, invoicing and stock on one side; medical records and patient data on the other. The list is made once and it orders everything that follows.
-
2
Write down where each piece of data lives and who sees it
Which system holds it, who has access today and with what permission, what leaves the company and what doesn't. It is a document, not a build, and it is the one you show when someone asks.
-
3
Name who signs off, and scope what they sign off
The usual brake isn't technical: it is that the decision has no owner. An approval limited to one specific process gets signed; an approval to "use AI" is signed by nobody.
-
4
Then, the first process on the non-sensitive side
With the architecture written, the admin close or the regulatory documentation can be tackled without first opening a data governance debate. The sensitive side comes in later, with rules already in place.
What we build for a healthcare company
Everything we build, and here the order matters more than anywhere else. The architecture goes first because it decides which of the rest can be approved.
Data platforms
Where each piece of data lives, what leaves the system, who sees what and what gets logged. It goes first: without this written down and signed, the rest never gets past the meeting.
See the product
Business Intelligence
Commissions, variable costs and reconciliations, which touch no sensitive data and are where a measurable result shows first. It is usually the first number management accepts as right.
See the product
AI knowledge base (RAG)
Technical files, procedures and incident reports you can query with the document cited, so that what was already written isn't rewritten every year.
See the product
AI workflow automation
The admin cycle end to end (close, reconciliation, file) with a person supervising and every decision logged.
See the product
Machine Learning
Forecasting on your own series: demand, product consumption, cost drift. And models on clinical data as well, once the architecture is decided.
See the product
AI agents
Batch traceability on request, responses to audits and incident handling. Today these take up the technical team's time rather than the admin team's.
See the product
AI consulting
The session where use cases are ranked by what they demand of the architecture, which in this sector is what decides which ones can be done now.
See the productFrequently asked questions
Let's talk about your projectDo you work with patient data?
Yes, and with everything around clinical data: traceability, regulatory documentation and administrative and financial processes. We never start with the model, and in this sector that is not a detail of method. As soon as patient data is involved, the first conversation is about architecture: what leaves the system, where it is processed, who sees what and what gets logged. That decision shapes everything that follows.
So what kind of healthcare companies are your clients?
Life sciences companies in medical devices, medical technology and pharma, as well as pharmaceutical distributors, pharmacies and healthcare services. In general, organisations where clinical data sits alongside a great deal of operational and regulatory data, and both need putting in order.
Can generative AI be used with sensitive information?
It depends entirely on where it is processed. A model hosted on your own infrastructure or in a dedicated private environment changes the answer compared with a public service. That is the architecture decision this page is about, and it is made before a model is chosen.
How long does the architecture part take?
Less than people fear, because it doesn't mean rebuilding the systems. It means deciding and writing down which data goes where. What stretches it isn't the technical work: it is getting the people who have to decide into the same meeting.
We are a small healthtech. Is this for us?
Yes, and with one advantage: the earlier the data architecture is decided, the cheaper it is. Redoing it once there are customers and data inside is the expensive scenario. In companies of twenty or thirty people, this conversation is settled in a few sessions.
Who has to sign off the data architecture?
Almost always three people, and it helps to know that on day one: whoever is responsible for the system, whoever is responsible for data protection and whoever runs the part of the business that will use it. You don't need a committee: you need those three to sit down once with the document in front of them. When one is missing, the project doesn't stall on the technical side; it stalls waiting for someone to dare to decide on their behalf. Who they are depends on the company: in medical devices it is usually the head of IT, the data protection officer and whoever leads quality or regulatory affairs; in a pharmaceutical distributor, operations takes that third seat.
Is batch traceability an AI project?
Pulling the trail together isn't: that is data engineering, and it comes first. AI comes in afterwards, once the trail is in one place and can be questioned in plain language or matched against incidents to anticipate where they will recur.