Privacy-First AI: Why patient data must not end up on US servers

Running a generic chatbot through a standard API often means moving sensitive content into a legal and operational environment outside your own organisation. That is a very different risk profile for medical or personal data than for ordinary website copy.

In clinic settings, convenience and compliance clash quickly. Even where providers talk about low retention, the questions around access, responsibility and traceability often remain unresolved.

Health data is no ordinary personal data. The GDPR lists it as a special category whose processing is prohibited in principle and allowed only through narrow exceptions.[1] Swiss data protection law likewise counts health data among the specially protected categories, with a higher bar for consent and care.[2]

For clinic operations that means: even the question of which chat thread a diagnosis appears in is a data protection question. Whoever routes such content through a generic API carries the burden of showing the path is clean, and the provider does not carry it for them. This text replaces no legal advice; mapping which data classes appear in your own funnel still belongs at the start of every AI project.

The most common misconception in AI projects runs like this: whatever went into training has dissolved in there and is therefore anonymous. The European Data Protection Board published an opinion in 2024 that denies exactly this. AI models trained on personal data cannot in all cases be considered anonymous; anonymity requires that both direct extraction and obtaining personal data through queries are insignificantly unlikely.[3]

For a clinic this carries an uncomfortable second half. The same opinion holds that an organisation deploying such a model must, under its own accountability, assess whether the model was not developed through unlawful processing of personal data.[3] Responsibility does not end with the provider. It begins with the selection, and it cannot be delegated to a contract that only describes what the provider promises to do.

Where a model runs is no matter of IT taste. In 2020 the Court of Justice of the European Union invalidated the adequacy decision behind the EU-US Privacy Shield and required a third country to offer protection essentially equivalent to the EU standard, including scrutiny of government access there.[4] Its predecessor had already fallen before that.

Today's successor, the EU-US Data Privacy Framework, holds: in 2025 the General Court dismissed an action against the adequacy decision.[7] Sending patient data to the US therefore rests on a viable legal basis that remains subject to periodic review, and whose two predecessors both fell in court. That is no reason to panic. It is a reason to know the way back before you need it.

The regulation on the European Health Data Space has been in force since March 2025 and applies from 26 March 2027, with staggered deadlines for the individual data categories through 2031.[5] It governs both patient and clinician access to health data and its secondary use, and it gives patients explicit rights to restrict access and to opt out of secondary use.

For a clinic selecting systems today this is less a deadline than a direction: regulatory pressure on health data keeps growing over the coming years. An architecture in which nobody can say where which data sits becomes more expensive under it, not cheaper.

The Swiss Federal Data Protection and Information Commissioner makes clear that the data protection act is written technology-neutrally and therefore applies directly to AI-supported data processing as well.[8] The transparency expectation goes beyond the usual privacy-notice level: the purpose, the way it works and the data sources of AI-supported processing belong in the open, and explicitly also whether entered data is reused to improve self-learning systems.

That makes the third point of our architecture, the missing training path, no marketing promise in Switzerland. A supervisory authority wants that question answered.

Where do prompts and uploads go, and in which jurisdiction do the servers stand? The answer has to be a place, and no diagram with question marks.

Who can access, and how is deletion handled? Whether an incident becomes a manageable process or a reputation problem is decided by roles, logs and deletion periods.

What flows into someone else's training? A no has to be secured technically, and a contract clause alone secures nothing.

These three answers take an hour when the architecture is clean, and they are found in no contract when it is not. Our general position is on the data sovereignty page; the entry point is a question for the audit.

Not every AI initiative in a clinic needs dedicated infrastructure. Running a model purely on public text, meaning website copy, general preparation guidance or internal drafts without personal references, solves a problem with dedicated servers that does not exist at that point.

The data class decides how much effort is warranted. As soon as a patient names their name, their appointment or their complaint in a channel, the processing is a different one. That is exactly why classifying the data comes at the start of a project, not at the end.

In sensitive markets, privacy is not a legal appendix. It is part of the sales experience and the brand promise. Teams that can make control visible tend to build trust faster in discovery, first response and implementation.

That is why privacy-first is not an isolated page for RakenAI. It is a visible component of product, design and architecture.

The effect shows up in real conversations: after price, the most frequent question from international patients is often how their data is handled. A clear answer at that moment sells, and no answer does too.