Private AI for GP Practices: Kept Inside the Surgery
A practice manager drafting a complaint response in a public chatbot has just sent patient information to a provider the practice never assessed and cannot name in the DSPT. Private AI puts the same assistant inside the surgery.
£500 per month for the software and the hardware rental. You rent the machine — you don’t buy it.
Private AI for GP practices is a ChatGPT-style assistant running on a dedicated machine in the surgery, so policies, complaint responses, PCN reports and patient letters can be drafted and searched without practice or patient information reaching a third-party provider. It stays out of the clinical system and is installed and supported by us.
See what a private assistant would read
A short call with the practice manager or a partner. Bring your DSPT lead; we will walk through the data flow.
Private chat, document spaces and assistants on one machine in the practice office. Practice documents never leave the surgery.
Cloud Agents for the Phone, Local AI for Practice Documents
Appointment calls and the admin inbox suit a hosted agent; practice policies, complaints correspondence and hospital letters suit a machine inside the surgery. Many practices run both.
- ☁ Cloud-based AI Receptionist
- ☁ Cloud-based Email Manager
- ☁ Cloud-based Leads Outreach
- 🏢 On-premise Local AI
The Ban Does Not Work. The Alternative Does.
Staff at GP practices who need a letter drafted quickly are already using a chatbot. A blanket ban moves that out of sight; it does not stop it.
| Public chatbot | Private AI in the surgery (ours) | Private LLM you build yourself | |
|---|---|---|---|
| Where prompts and files go | The provider’s servers | A machine in the surgery | A machine in the surgery |
| Chat history stored | With the provider | On your machine | On your machine |
| Used to train models | Depends on the plan and settings | Never | Never |
| Who can see who used it | Nobody in your business | You, through your own sign-in | You, if you build the access control |
| Reads your document library | Only what someone pastes in | Yes — spaces with citations | If you build it |
| Installation and upkeep | None | Us | Your IT person, indefinitely |
A Processor the Practice Cannot Name in the DSPT
Every year a GP practice answers, in the Data Security and Protection Toolkit, for where its data is processed and by whom. Every week, somebody in the practice office pastes a complaint file, a patient letter or a policy into a public chatbot because the response is due and the chatbot is quick. The processor that creates is one the practice cannot name, has not assessed and did not contract with. The intent is fine. The line in the toolkit is not.
Private AI for GP practices gives the office the same assistant on a machine in the surgery. The model runs there. Policies, complaint files, PCN reporting, patient leaflets, staff handbooks and meeting minutes go into document spaces on it, and every draft, summary and answer is produced in the building. The DSPT question about processors gains a short answer for this tool: there is not one. Caldicott principles and the practice’s retention policy keep applying because nothing left.
The practice manager can draft a complaint response from the file and the complaints policy, then edit it into the practice’s own voice, inside the NHS complaints timescales. A receptionist can find the chaperone policy and its review date with the page cited. A PCN manager can have the quarterly report assembled from the practices’ submissions. A partner can have a long piece of national guidance summarised against what the practice already does.
None of it touches the clinical record. The machine is not connected to the clinical system, it is not for clinical decisions, and it is not a medical device; clinical questions go to a clinician or NHS 111. We install it in the practice office, import the policies folder first, train the practice manager, reception and admin team, and would rather your DSPT lead or Caldicott Guardian was on the first call.
One practical point for practices that have already banned public chatbots: the ban usually failed quietly, because the alternative was retyping. A private assistant in the practice office succeeds for the same reason the ban failed — it is the quicker option. Reception uses it because it is on the desktop next to the clinical system, not because a policy says so, and the practice manager can see, on the machine, exactly what it has been asked.
One Private AI Machine, Three Tools On It
Everything runs on the one machine in the surgery, and your team log in with the accounts they already have.
A private AI chatbot for the whole team
A ChatGPT-style assistant on your own machine. Staff ask questions, upload documents and images and work through drafts, and none of it leaves the building.
Document spaces
Files and correspondence organised into spaces. Search, summarise and compare across hundreds of documents, with a citation to the page every answer came from.
Custom assistants
The monthly report, the standard memo, the routine check — built around your workflows and running on the same machine, covered by the support arrangement.
| Document | What the practice asks for | What stays where |
|---|---|---|
| Policies and procedures | Find it, check the review date, cite the page | On the machine, in the surgery |
| Complaint files | A draft response from the file and your complaints policy | On the machine, in the surgery |
| PCN and contract reporting | The quarterly report assembled from submissions | On the machine, in the surgery |
| Patient letters and leaflets | A draft in the practice’s wording | On the machine, in the surgery |
| National guidance and CQC evidence | A summary against what the practice already does | On the machine, in the surgery |
| Clinical records | Not used — stays in the clinical system | Your clinical system |
From Practice Manager’s Call to a Private Assistant in the Office
Weeks, not months. Most practices start with the policies folder or the complaints process; PCNs usually start with one practice.
A call with the practice manager
List size, PCN role, how many staff, which paperwork goes first. We specify the machine from that and walk through the data flow with your DSPT lead.
Install and import
The machine goes on the practice network. Sign-in connects to your Microsoft 365 or Google Workspace. Policies, templates and correspondence are imported into spaces.
Train the office, then support
We train the practice manager, reception and admin team on what it does and what it is not for, then keep the software and models current.
Where Local AI Is the Wrong Answer
We would rather lose the enquiry than the trust. Three things we tell every prospect before they sign anything.
It will not make you compliant by itself
No product can make a business UK GDPR-compliant on its own. What private AI does is remove the hardest question from the assessment — where the personal data goes. Lawful basis, retention and staff conduct remain yours.
It is slower than the big cloud models
Open-weight models on a single machine are capable for summarising, drafting and answering questions about your own documents. For frontier reasoning on hard, novel problems, the largest cloud models are still ahead. That is the trade.
It is a weeks-long install, not a sign-up
A cloud agent is live in days. Local AI needs the machine specified, delivered, installed on your network and your documents imported. Weeks, not months — but not tomorrow.
Private by Construction, Not by Policy
Nothing leaves the building
Open-weight models, documents and chat history all live on the box. No third-party AI processor and no restricted transfer for the AI step.
Your sign-in, your access list
Single sign-on with Microsoft 365 or Google Workspace. You decide who has access with the tools you already administer.
Never trained on your content
Your documents and conversations are not used to train or improve any model. The models arrive trained and stay that way unless you ask.
Installed and supported by us
Hardware, installation, training, updates and support from one team, with a data processing agreement covering the support access you grant us.
Which Page Answers Your Practice’s Question
| If your question is… | The short answer | Read more |
|---|---|---|
| What is the full private AI setup? | One machine: chat, spaces, assistants, support | Private AI |
| We want the Local AI overview for GP practices | The head page for surgeries | Local AI for GP practices |
| What exactly is installed in the surgery? | One machine in the office, supported | On-Premises AI for gp practices |
| What does our DSPT lead need? | No processor, no transfer, for the AI step | GDPR Compliant AI for gp practices |
| The 8am phone queue is the real problem | A hosted agent, live in days | AI Receptionist |
| We are a dental practice, not a GP | Patient letters stay in the practice | Private AI for dental practices |
| Why on-premises at all? | The case for Local AI, in full | Local AI product page |
Private AI for GP Practices: Common Questions
What is private AI?
AI that processes your prompts and documents on hardware you control instead of on a provider’s servers. With ours, the model, the chat history and every uploaded file stay on a machine in the surgery. Nothing is sent to an outside service to produce an answer.
Is a private LLM as good as ChatGPT?
For everyday work — summarising, drafting, extracting, answering questions about your own documents — it is capable and most offices are happy with it. It is somewhat slower, and the largest cloud models are still ahead on hard, novel reasoning. That is the trade for keeping data in-house.
How do we describe a private AI chatbot in the DSPT?
As processing on a machine the practice owns, at the surgery, with no third-party AI processor and no transfer for the work it does. We act as a processor only for the support access you grant us, under a data processing agreement, and we will help your DSPT lead word the entry.
Can clinicians use it too?
For administrative drafting, yes — a patient information leaflet, a letter in the practice’s wording, a summary of guidance. Not for clinical decisions, and never with the clinical record, which stays in the clinical system.
We already banned public chatbots in the practice. Why would this be different?
Because the ban asked staff to do the slower thing. A private assistant on the practice’s own machine is the quicker thing, and it is on the desktop next to the clinical system. Staff use it because it helps, and the practice manager can see on the machine exactly what it has been asked.
Does it connect to our clinical system?
No, and it should not. The clinical record stays in your clinical system. It works on the documents around the practice — policies, correspondence, reports, leaflets — which are imported into spaces on the machine.
How does it fit with the Data Security and Protection Toolkit?
The DSPT asks you to know where data is processed and by whom. With a machine in the surgery the answer is: here, by nobody else. There is no third-party AI processor and no transfer for the work it does. Bring your DSPT lead or Caldicott Guardian to the call.
How much does Local AI cost?
£500 per month for the software and the hardware rental. The dedicated machine is rented to your business, not sold: you never buy the hardware. It is installed in your building and runs the private chat, document spaces and assistants. Local AI is for business customers only.
Give the Practice Office the Private Version
Tell us your list size and what the office is pasting into chatbots today. One short call to size the machine, with your DSPT lead welcome on the line.
Prefer email? sghaith@businessaiagents.co.uk