AI in clinical settings needs documented governance before it goes live.

Special category data obligations

Health data is special category under UK GDPR Article 9. AI systems processing patient data for clinical decisions, risk stratification, or diagnostic support require a mandatory DPIA before deployment.

Human oversight must be documented

ICO guidance requires organisations to document how clinicians can review, question, and override AI-assisted decisions. Written evidence of these mechanisms is expected, not just a verbal assurance.

Equality Act applies to clinical AI

AI tools used in triaging, resource allocation, or care planning must be assessed for bias across protected characteristics including age, disability, race, and sex.

Generate ICO-aligned AI Impact Assessments with auto-populated DPIA fields including necessity tests, DPO consultation tracking, and residual risk sign-off.

Score each clinical AI system across data protection, bias and fairness, transparency, and security. Produces a weighted risk score with targeted mitigation recommendations.

Invite your IG lead, DPO, or Caldicott Guardian to review and annotate assessments directly without platform admin access. Full audit trail of their review is recorded.

Store vendor contracts, DPIAs, clinical safety assessments, and governance policies. Each document is linked to its AI system record for easy retrieval at audit.