Healthcare AI
EveryAIrequestinyourorganisation:
controlled,logged,andproven.
CareProxy is the control plane for AI in healthcare. We stop patient data before it leaves the building, prove what your AI did, and can stop an agent that goes wrong. Cloud or local: you choose the model, we deliver the control and the proof.
Designed to support compliance with
Validation partners · Danish enterprise
What is CareProxy?
A security layer that lets healthcare staff use AI without patient data ever leaving the hospital.
No new workflow for the clinician. No patient data in the cloud. CareProxy sits invisibly in the network and looks after it all.
Become compliant now
Meet GDPR, the EU AI Act and NIS2 today, instead of banning AI and waiting for legislation.
Keep the best AI
Your staff keep using ChatGPT and other top models. CareProxy simply sanitises the request first.
Prove it to the regulator
Every single AI request is logged with cryptographic proof. Export the documentation with one click.
Regulatory reality
The rules already apply. The rest is on the way.
Regulation (EU) 2024/1689, as amended by the Digital Omnibus (final Council adoption 29 June 2026)
The EU's Digital Omnibus (adopted 29 June 2026) moved the AI Act's high-risk deadlines, but it did not stop the clock: GDPR, NIS2 and DORA apply today, transparency obligations land in weeks, and the high-risk regime arrives in December 2027 with registration and an advantage for early movers.
- In force now GDPR · NIS2 · DORAFines of up to 4% of global turnover, and incident reporting is live. Shadow AI is a GDPR risk today, not in 2027.
- 2 Aug 2026 AI Act Article 50: transparencyUsers must be informed when interacting with AI, and AI-generated content must be labeled. Not deferred.
- 2 Dec 2026 Watermarking for existing systemsLabeling obligations reach systems already on the market, and new prohibitions take effect.
- 2 Dec 2027 The high-risk regime (Annex III)Risk classification, audit logging, output monitoring and fail-safe, with a registration mechanism and grandfathering.
- 2 Aug 2028 High-risk in regulated productsIncluding AI embedded in medical devices (Annex I).
What the high-risk regime requires
Four obligations that apply from December 2027. Several of them are effectively required by GDPR and NIS2 already.
- 01 Risk classification of all AI systems processing patient data
- 02 Legal-grade audit log per AI request, available to the regulator on demand
- 03 Technical documentation and ongoing monitoring of AI outputs
- 04 Fail-safe mechanisms: AI must be interruptible at any time
Systems in operation before the deadlines avoid the full high-risk obligations until substantially modified. The cheapest path to compliance is the one you deploy now.
How it works
Follow one request through CareProxy.
From sensitive prompt to safe answer in milliseconds.
How it works
Follow one request through CareProxy.
From sensitive prompt to safe answer in milliseconds.
- 01 Prompt & redactionA clinician's prompt is written with personal data; CareProxy masks the CPR and name in under 1 ms.
- 02 Safe routingClean requests go to Cloud AI; confidential data routes to Local AI and never leaves the building.
- 03 Agent stoppedAn AI agent tries to exfiltrate records. CareProxy blocks it instantly.
- 04 Everything loggedEvery AI action is written to a hash-chained, tamper-evident audit log in real time.
No rip-and-replace
Works on top of what you already run.
CareProxy is not another platform to migrate to. One engine sits as the control and evidence layer on top of your existing AI infrastructure: in the browser, on the gateway, and in the dev tools.
Integration surfaces
You keep your gateway and your models. We deliver the detection, the policy, and the signed evidence on top.
For the CISO
Compliance you can prove, in real time.
Track every AI request live. See what was blocked, what went to cloud, and prove it all with one click when the regulator calls.
- Live overview of all AI traffic
- 100% of calls logged and auditable
- One-click forensic export for regulators
Requests today
14,205
Blocked locally
13%
To cloud
87%
Ed25519-signed · immutable · one-click forensic export
Proof of evidence
Cryptographic proof, ready for the regulator.
Every decision is hash-chained and signed. The log can't be altered without breaking the chain. When the regulator comes, you have evidence built for regulatory scrutiny, not a CSV file.
- Hash-chained, Ed25519-signed audit log
- Verifiable without contacting CareProxy
- Covers GDPR Art. 32, ISO 27001, NIS2
Try it yourself
Type a request. Watch the decision.
The same zero-trust layer we validated with partners, live in your browser. Type or pick a prompt and watch CareProxy classify and route it in under a millisecond. Nothing leaves your browser.
Detected signals
- PIIICD-10 diagnosis code
Patient data → your on-premise model. Never leaves the building.
Logging is not evidence
Your gateway logs. But can it prove?
What a gateway log shows
- Request ID, timestamp and which model was called
- Token usage and response times
- Raw traffic, depending on configuration
- Rows that whoever operates the system can edit
- An engineering artefact, built for debugging
What the regulator asks
- Which personal data did the AI see, and on what legal basis?
- What was removed, blocked or passed on?
- Can you prove the log is complete and unaltered?
- Can a third party verify it without trusting you?
- Does the evidence layer stand outside the system it documents?
A gateway log is an engineering artefact. Evidence is something else. CareProxy writes the latter: signed, hash-chained, and without storing sensitive content.
Do you know exactly what your gateway log contains today? It is a ten-minute check. We will show you how.
Ready to take control of your AI infrastructure?
CareProxy is under active development. Join the waitlist to be notified as soon as pilot installations open.
Or reach out directly kontakt@careproxy.dk