Typical forPrivate clinicsPhysiotherapistsDentistsPsychologists and therapists
AI in your clinic. Patients' data stays in the EU.
Health data is the most sensitive data there is. GoalCube lets you use AI for letters, bookings and summaries, while names, ID numbers and addresses stay with you – and there's a record of exactly what the AI used.
- The name kept apart from the health dataThe AI sees [PERSON_1] and the symptom – never who the patient is.
- Less time on paperworkDraft letters, summaries and booking replies in seconds.
- The clinician decidesThe AI never diagnoses or prioritises patients on its own.
| Patient | ID no. | Treatment |
|---|---|---|
| Martin Kiely | 5512983P | Physiotherapy |
| Anne Whelan | 3302714C | Physiotherapy |
| Ibrahim Saeed | 0587342M | Dental care |
Message from the patient Can I move my appointment from Tuesday? I'm at work. Martin Kiely
| Patient | ID no. | Treatment |
|---|---|---|
| [PERSON_1] | [ID_1] | Physiotherapy |
| [PERSON_2] | [ID_2] | Physiotherapy |
| [PERSON_3] | [ID_3] | Dental care |
Message from the patient Can I move my appointment from Tuesday? I'm at work. [PERSON_1]
Anne Whelan describes worsening pain and should get a call from a clinician today. Martin Kiely wants a new appointment; offer Thursday at 10 am. Ibrahim Saeed has a question about the bill; pass it to the office.
[PERSON_2] describes worsening pain and should get a call from a clinician today. [PERSON_1] wants a new appointment; offer Thursday at 10 am. [PERSON_3] has a question about the bill; pass it to the office.
Fictitious data. Point at a name or a pseudonym to see what belongs together.
What can you use AI for?
Choose a task. GoalCube works out the risk under the EU AI Act with fixed rules and tells you what to do.
Even a booking reveals that someone is a patient. GoalCube hides the name and ID number; a person confirms the use.
Health data (Article 9 GDPR) and professional secrecy. Only with pseudonyms, a business plan and a clinician who checks.
AI that prioritises access to healthcare may be high-risk or a medical device. A clinician must always decide.
AI for diagnosis is typically a medical device with its own rules (MDR). Don't use an ordinary chatbot for it.
The example is simplified. In GoalCube you answer a few questions, and the classification follows fixed rules.
What the law says
Health is special category data
Health data may only be processed on a specific basis, such as treatment under professional secrecy.
Article 9(2)(h) GDPR
Professional secrecy applies to AI providers too
Health professionals must not pass on health data without a legal basis. Only use AI with a data processing agreement (DPA) – and ideally without names.
Article 9(3) GDPR; national rules on professional secrecy
Medical AI has its own rules
AI that makes diagnoses or recommends treatment is typically a medical device and high-risk under Annex I of the AI Act.
MDR (EU) 2017/745; Article 6(1) AI Act
An impact assessment is usually required
Processing health data at scale with new technology normally needs a data protection impact assessment (DPIA).
Article 35 GDPR
Short and simplified. GoalCube helps you follow the rules; it is not legal advice.
Your staff keep working. GoalCube keeps track of the rest.
Low risk is approved automatically under fixed rules. Anything that needs a human lands on This week’s list – typically around 5 minutes a week.
Sort this week's messages, and draft replies to the ones about appointments.
I've drafted 17 replies. One patient describes worsening pain – a clinician needs to see that today. Names and ID numbers are only at GoalCube.
4 awaiting a human · approx. 5 minutes
Waiting for you
- Confirm new use: summarising clinical notesSensitive data · needs a person
- Complete impact assessment (DPIA)Health data · template ready
Approved automatically
- Summary of customer enquiriesLow risk · approved automatically on Monday
- Overview of supplier contractsLow risk · approved automatically on Tuesday
What you need
Start free with the overview. Add protection when you want to use AI on real data.
AI Map
Map
0 € per month
- AI inventory and AI policy
- Training with proof
- Deadlines, templates and report
Data Vault
Map and protect
from 9 € per month
- Everything in AI Map
- AI on your data, data stays in the EU
- Secret terms and documents
Data Vault + Human Decision
GoalCube for HR
from 15 € per month
- Everything in Data Vault
- A person decides on cases about people
- Passkey, log and timestamps
See all prices All prices are per month and exclude VAT. Pay yearly and get 2 months free. Prices apply from launch, which we expect in November 2026.
Questions and answers
Can we use ChatGPT in a clinic?
Not with names and health data in plain text on a standard plan. Use a business plan with a data processing agreement (DPA), remove names and ID numbers, and carry out a DPIA. GoalCube makes sure the AI only sees codes.
Does using AI breach professional secrecy?
It can, if health data is passed to a provider without a legal basis. With pseudonymisation in the EU, the AI provider never learns who the patient is – but talk to your professional body about your specific use.
Can the AI help with diagnoses?
Not an ordinary chatbot. AI for diagnosis is typically a medical device with its own requirements. GoalCube is for admin and writing, not for diagnoses.
Read more
- AI in practice
AI in clinics and care: How do you use AI on health data?
2 min readAI can help with admin and writing; diagnosis is a medical device. How clinics and care providers use AI without sending health data and names to the US.
- GDPR and AI
Can we use AI on sensitive data such as health and religion?
2 min readHealth, religion, union membership, ethnicity and biometrics are special categories under the GDPR. The rules when AI is involved, and how to protect them.
- GDPR and AI
Do we need a data protection impact assessment (DPIA) before using AI?
2 min readIf you use AI to assess people, on sensitive data or at scale, the GDPR usually requires a DPIA. Here is when, what it must contain, and a template.
- GDPR and AI
Pseudonymisation or anonymisation – what's the difference, and what does GDPR require?
2 min readPseudonymisation vs anonymisation: pseudonymised data is still personal data; anonymous data is not. The 2025 EU court ruling, and what it means for AI.
Other solutions for customers
- Online shop customers
- Guests
- Software users
- Members
- Subscribers
- Clients of advisers
- Students and learners
- Tenants
- Policyholders
- Borrowers and credit customers
- Passengers and travellers
- Donors and supporters
- Event attendees and registrations
- B2B customers
- Property buyers and sellers
- Residents in care and supported living
- Citizens
Ready to use AI on patient data?
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.