Healthcare / Clinical AI

Clinical AI data, audit-ready and EEA-resident

Ambient clinical speech, medical imaging with DICOM, EHR extraction with FHIR and HL7v2, clinical-note de-identification, voice biometrics, and clinical coding. Collected under GDPR Article 9, aligned with EU AI Act Article 10, on self-hosted European infrastructure. BAA-ready for US engagements.

Discuss your healthcare dataset Request the DPA

Norwegian company / EEA jurisdiction
GDPR Article 9 / 30-day erasure SLA
EU AI Act Article 10 aligned
HIPAA BAA-ready / US engagements

Regulatory posture

Cite the regulation by article, not the marketing

Four regulatory frameworks dominate healthcare AI procurement review. Here are the article-numbered answers.

EU AI Act

Annex III item 5 / Article 10

Aligned with Article 10 data-governance obligations. YPAI supplies documentation supporting your conformity assessment. YPAI does not certify your AI system as compliant.
GDPR

Articles 6, 7, and 9

Documented per-contributor consent for health and biometric data under Article 9(2)(a). 30-day erasure SLA. Withdrawal workflow with audit trail.
HIPAA

45 CFR 164.514 / BAA-ready

Healthcare-specific consent language and data handling. YPAI signs the BAA as a business associate for US-facing engagements. Customer retains covered-entity obligations.
EU MDR

Class IIa+ / CE + AI Act dual-track

Audit artifacts support your CE plus AI Act dual-track conformity assessment. YPAI does not certify your SaMD. We supply the evidence trail your notified body asks for.

Clinical modalities

Eight clinical modalities, one consent chain

One DPA, one audit trail, one named project lead across eight clinical modalities. Single-modality data vendors require stitching four contracts and four sub-processor reviews.

Modality Clinical sub-domains Domain expertise Output formats

Modality Ambient clinical speech

Sub-domains Multi-party encounter recording, dictation, code-switching speech, Nordic Healthcare Ambient AI service

Expertise Licensed clinical professionals in pipeline. Multilingual contributor network across all Nordic languages and major EU languages.

Output Aligned consent and provenance per recording. Output negotiated per project.

Modality Medical imaging

Sub-domains Radiology, cardiology, pathology, DICOM and HL7v2 imaging workflows. Additional clinical sub-domains confirmed in scoping.

Expertise Annotation by licensed professionals across radiology, cardiology, and pathology.

Output DICOM and project-specific medical-imaging formats confirmed in scoping.

Modality EHR document extraction

Sub-domains Structured field extraction with FHIR and HL7v2 mapping, clinical-note de-identification, document classification

Expertise Medical records annotation. Clinical-domain credentialing applied to high-risk fields.

Output FHIR and HL7v2 output schemas. Project-specific standard alignment confirmed in scoping.

Modality Biomedical literature

Sub-domains Clinical text corpora, entity and relation annotation, RAG-eval data

Expertise Clinical and scientific annotation. Source-license review applied at the corpus level. Per-project corpus list confirmed in scoping.

Output Source-attributed text plus annotation layer. Per-record license trace.

Modality Voice biometrics

Sub-domains Speaker verification training, voiceprint enrolment data, GDPR Article 9 explicit consent

Expertise Special-category data handling. Per-contributor consent record with withdrawal trace.

Output Audio plus consent metadata. Withdrawal endpoint on file.

Modality Clinical coding

Sub-domains ICD-10/11, SNOMED-CT, LOINC, RxNorm coding training data. Standard-by-standard depth confirmed in scoping.

Expertise Coder-credentialed annotation in pipeline. Second-pass QA on disputed codes.

Output Source record plus code assignment plus rationale.

Modality Clinical trials

Sub-domains Trial document collection, protocol annotation, eligibility-criteria extraction

Expertise Clinical and scientific annotation. Trial-specific scope negotiated.

Output Per-trial deliverable scoped against your conformity track (CE, MDR, AI Act, or combined).

Modality Federated learning

Sub-domains Sovereign-compute layer, multi-site governance frameworks, deployment infrastructure

Expertise YPAI Layer 2 (custom AI infrastructure for regulated buyers) and Layer 3 (high-compliance deployments, governance frameworks).

Output Reference architecture plus deployment pipeline. Not a stand-alone dataset purchase.

Jurisdiction

EEA-resident infrastructure, by default

Norwegian company, self-hosted European servers, short EEA-resident sub-processor list disclosed in the DPA. Legal exposure under EEA frameworks only.

Norwegian company

Norwegian legal entity, EEA jurisdiction. Headquartered in Oslo, Norway.
Self-hosted European servers

Production data on YPAI-operated European infrastructure. Self-hosted servers inside the EEA.
Sub-processor transparency

Short EEA-resident sub-processor list disclosed in the DPA at scoping. SCCs available for buyer-directed transfers.
Outside US CLOUD Act compulsion

Norwegian legal entity, not subject to US CLOUD Act compulsion. Legal exposure under EEA frameworks only.

Audit artifacts

Routine deliverables, not special requests

Every project ships with the artifact set a notified body or regulator can ask for. Delivered with the dataset, not retrieved later.

Consent

consent_records.jsonl (per contributor, per purpose)
erasure_sla_30d.md
withdrawal_trace.csv (with audit log)

Provenance

provenance_ledger.csv (per recording)
dataset_versions.changelog (immutable)
sampling_methodology.md

Quality + disclosure

qa_artifacts.jsonl (per modality)
demographic_dialect_distribution.csv
de_identification_method.md
subprocessor_disclosure.md

Nordic clinical speech

Clinical Nordic speech, in production

Danish, Norwegian, Swedish, and Finnish ambient clinical AI. Recorded inside the EEA with licensed clinicians and code-switching patients.

Danish

Clinical accents and regional terminology

Norwegian

Bokmål and Nynorsk. Regional clinical accents.

Swedish

Code-switching Swedish-English in clinical settings

Finnish

Finnish clinical terminology. Swedish-speaking minority dialect coverage.

See the HIPAA-compliant speech-data service

Engagement

Custom contracts, 4 to 12 weeks

Named project lead. DPA included with every engagement. Audit-ready delivery.

01 Week 0

Discovery call

30-minute call with a project lead. Modality, jurisdiction, timeline, and conformity track confirmed.
02 Weeks 1-2

Scoping + DPA

Statement of work. DPA included. Sub-processor list disclosed. Consent posture confirmed per modality.
03 Weeks 2-10

Custom collection or annotation

Contributor recruitment within EEA where required. Clinical-domain credentialing in pipeline. Per-recording or per-record QA.
04 Final week

Audit-ready delivery

Dataset plus audit pack (consent, provenance, QA, sampling methodology, de-identification method, sub-processor transparency). Versioned, immutable, change-logged.

Next step

Scope a clinical AI data project

Custom contracts only. Named project lead. DPA included with every engagement.

Request a scoping call Request the DPA