GDPR Compliant AI for Dental Practices: No Processor to Appoint
A practice that appoints a cloud AI provider has just added a processor of special-category health data to its records. A machine in the practice office adds nothing to that list.
£500 per month for the software and the hardware rental. You rent the machine — you don’t buy it.
GDPR compliant AI for dental practices means AI used in a way that meets the UK GDPR and Data Protection Act 2018 for special-category health data. A machine installed in the practice means no third-party AI processor and no restricted transfer for the AI step, and the clinical record stays untouched; lawful basis, retention and staff conduct remain the practice’s.
Bring your DPO to the call
A short call with the practice manager or your data protection lead. We will walk through the data flow before any hardware is ordered.
Model, documents and chat history on one machine in the practice office. Patient information never leaves the building.
Cloud Agents for the Front Desk, Local AI for the Records
The phone and the enquiry inbox are not where a practice’s confidentiality problem lives, so most practices run those on our hosted agents and keep patient documents on the Local AI machine.
- ☁ Cloud-based AI Receptionist
- ☁ Cloud-based Email Manager
- ☁ Cloud-based Leads Outreach
- 🏢 On-premise Local AI
The Questions Your DPO Asks About AI and GDPR Compliance
Most of the hard work in an AI GDPR assessment is about the processor and the transfer. Here is what each looks like for dental practices.
| The question | Cloud AI service | A machine in the practice |
|---|---|---|
| Who is the processor for the AI step? | The AI provider — appoint, assess, contract, review | Nobody — the model runs on your own machine |
| Is there a restricted transfer? | Often — IDTA or UK Addendum, plus a transfer risk assessment | No — the data never leaves the building |
| Is our data used to train models? | Depends on the plan, the settings and the small print | Never |
| What goes in the Article 30 record? | A new processor and, often, a new transfer | One fewer of each |
| Erasure requests | Your copy and theirs | Your copy only |
| Lawful basis, purpose, retention | Yours | Still yours |
Special-Category Data Raises the Bar, and a Machine in the Office Clears It
Everything useful in a dental practice’s paperwork is health data: the referral letter, the treatment plan letter, the complaint file, the correspondence with secondary care. Under the UK GDPR that is special-category data, which means the lawful-basis question has an extra condition, the DPIA is more likely to be required, and any processor the practice appoints is handling the most sensitive category there is. Appointing a cloud AI provider to draft letters adds exactly such a processor — and the GDC expects every member of the team to protect patient information, which is a hard standard to evidence with a chatbot nobody in the practice controls.
A machine in the practice office does not add a processor. The model runs on it; letters, policies and correspondence you import stay on it, and so does every conversation. No AI provider processes patient information on the practice’s behalf, so no Article 28 contract for that step. Nothing leaves the building, so no restricted transfer. The DPIA the practice would rather do anyway gets shorter, because the processor, transfer and training-use questions have plain answers.
What stays with the practice is what was always its own: the condition for processing health data, retention under the practice’s existing policy, and who in the practice has access — set through the Microsoft 365 or Google Workspace sign-in staff already use. The clinical record is never touched: the machine is not connected to the practice management system, and it is not for anything clinical.
We act as a processor only for the support access the practice grants us, under a data processing agreement, and we will help the practice manager or the practice’s data protection lead word the entry. Bring them to the first call.
What Is Installed, and What the Paperwork Looks Like
The machine, the software on it, the sign-in and the support — and the two documents your advisers will ask for.
No third-party AI processor
The model runs on your own machine, so your documents are never sent to an AI provider. Nothing to appoint, assess or keep under review for the AI step.
No restricted transfers
Your data never leaves the UK. The IDTA, the UK Addendum and a transfer risk assessment simply do not arise for the processing it does.
A shorter Article 30 record
One fewer processor and one fewer transfer to describe, review and keep current — and one less thing to explain if the ICO ever asks.
| Document | What the practice asks for | What stays where |
|---|---|---|
| Referral letters and replies | Draft the referral; summarise what came back | On the machine, in the practice |
| Treatment plan and recall letters | Draft in the practice’s wording from the plan | On the machine, in the practice |
| Complaints | Draft a response from the file and your complaints policy | On the machine, in the practice |
| Policies, SOPs, audits, training records | Find it, check the review date, cite the page | On the machine, in the practice |
| Supplier and lab contracts | Compare terms, flag the differences | On the machine, in the practice |
| Clinical records and radiographs | Not used — stays in the practice system | Your practice management software |
From Practice Manager’s Call to a Machine in the Office
Weeks, not months. Most practices start with the policies folder or the referral correspondence and widen from there.
A call with the practice manager
NHS, private or mixed, how many staff, which paperwork goes first. We specify the machine from that.
Install and import
The machine goes on the practice network. Sign-in connects to your Microsoft 365 or Google Workspace. Policies, SOPs and correspondence are imported into spaces.
Train the team, then support
We train the practice manager and reception first, then keep the software and models current, with support from the people who installed it.
Where Local AI Is the Wrong Answer
We would rather lose the enquiry than the trust. Three things we tell every prospect before they sign anything.
It is not a compliance certificate
No product can make dental practices UK GDPR-compliant on their own. A machine in the building removes the processor and transfer questions for the AI step. Purpose, lawful basis, retention and staff conduct remain yours, and we will not tell you otherwise.
It is slower than the big cloud models
Open-weight models on a single machine are capable for summarising, drafting and answering questions about your own documents. For frontier reasoning on hard, novel problems, the largest cloud models are still ahead. That is the trade.
It is a weeks-long install, not a sign-up
A cloud agent is live in days. Local AI needs the machine specified, delivered, installed on your network and your documents imported. Weeks, not months — but not tomorrow.
Built With the Regulator in Mind
Data never leaves the building
Open-weight model, documents and chat history on one machine in the practice. The only outside connection is your own sign-in.
Never used for training
Your content is not used to train or improve any model. The models arrive trained and stay that way unless you ask.
One DPA, for one thing
We are a processor only for the support access you grant, and the agreement says so in plain terms.
Honest about the trade
Local models are capable and somewhat slower than the largest cloud services. We say so before you sign anything.
Which Page Answers Your Practice’s Question
| If your question is… | The short answer | Read more |
|---|---|---|
| The general GDPR picture for AI | The processor and transfer questions, in full | GDPR compliant AI |
| We want the Local AI overview for dentists | The head page for dental practices | Local AI for dental practices |
| What exactly is installed in the practice? | One machine in the office, supported | On-Premises AI for dental practices |
| We want a private ChatGPT for the office | That is the private chat assistant | Private AI for dental practices |
| We also need the phone answered | A hosted agent, live in days | AI Receptionist |
| We are a GP practice, not dental | The DSPT questions, answered | GDPR Compliant AI for gp practices |
| Why on-premises at all? | The case for Local AI, in full | Local AI product page |
AI and GDPR Compliance for Dentists: Common Questions
Is there such a thing as GDPR compliant AI?
Not as a product label. Compliance is a property of how dental practices use a tool, not of the tool. What a product can do is make the assessment easier: a machine in the practice removes the processor and transfer questions for the AI step entirely.
Do we need a DPIA for AI?
Often, yes, and we would rather you did one. A machine in the building makes it shorter: the questions about the processor, the transfer mechanism and the training use of your data have plain answers. Purpose, lawful basis, retention and access are still yours to answer.
Is patient correspondence special-category data under UK GDPR?
Yes — it is health data, and a cloud AI provider drafting from it is a processor of special-category data with everything that entails. A machine in the practice office means no such processor is appointed for the AI step. The practice’s own condition for processing health data still applies.
Does using AI mean we need a DPIA?
Often, yes, and for health data we would rather you did one. A machine in the practice makes it shorter: processor, transfer and training-use questions have plain answers. Purpose, lawful basis, retention and access remain yours to answer.
Does it connect to our practice management software?
No, and that is deliberate. The clinical record stays in your practice system. It works on the documents around it — letters, policies, correspondence, contracts — which are imported into document spaces on the machine.
Can it read clinical photographs or radiographs?
The private chat accepts images, but we advise against using it for anything clinical. It is for the practice’s administrative documents. Diagnosis and treatment decisions stay with the clinician.
How much does Local AI cost?
£500 per month for the software and the hardware rental. The dedicated machine is rented to your business, not sold: you never buy the hardware. It is installed in your building and runs the private chat, document spaces and assistants. Local AI is for business customers only.
Bring the Hard Questions to the First Call
Tell us what is blocking AI sign-off in the practice and whether you are NHS, private or mixed. We will walk through the data flow with your data protection lead.
Prefer email? sghaith@businessaiagents.co.uk