Healthcare.
Patient and member experience, personalised on data that never leaves the perimeter.
In healthcare, the race for patients and members is now a digital-experience race: the front door, access, and personalised engagement that decide who chooses a provider and who stays. That runs on special-category health data, so the engagement stack has to be sovereign long before a clinician is anywhere near it.
- R01Personalised member engagement on GDPR Art. 9 special-category health data
- R02Patient-experience AI drifting into regulated clinical territory (MDR, AI Act)
- R03Consent and trust for a digital front door on health data
What's actually
reshaping the sector.
The shifts our research is tracking, named, current, cited.
McKinsey finds health payers put just 17% of marketing spend into digital versus 61% in banking, and estimates AI could add 3-12% revenue, much of it through better member acquisition and engagement. The experience gap is the growth.
McKinsey →Accenture's survey of 21,000 consumers found around 30% chose a new provider in a year, and nearly 80% of switchers blamed navigation and digital-experience failures, with 71% naming access as a top factor. Experience is now the retention lever.
Accenture →The European Health Data Space entered into force in March 2025; Member States may require health data to be stored and processed within the EU, with use rules phasing in to 2029–2031.
European Commission →Deloitte’s 2026 outlook finds more than 90% of health leaders prioritize productivity, yet only 3% report significant AI financial returns and 51% have not measured ROI, the honest-broker opening.
Deloitte →In healthcare, the patient and member relationship is won on experience and kept on trust, and both run on data too sensitive to hand to a third-country model.
Win the patient on experience. Keep them on trust.
Patients and members now choose and leave providers the way they choose retailers: on the digital experience, the front door, access, and personalised engagement. Accenture found nearly 80% of people who switched provider blamed navigation and digital-experience failures. That experience runs on special-category health data, which makes the engagement stack the one that can least afford to leak.
Personalise member acquisition, engagement, and retention on sovereign, first-party data and you close the digital-front-door gap, McKinsey finds AI could add 3-12% revenue for payers, much of it via better acquisition and engagement, without a consent or transfer problem. Run it on an opaque US API and you have put your patients' trust in a jurisdiction you cannot audit.
We build the sovereign patient-experience stack and pick the right model for each job: acquisition and engagement decisioned on EU compute, agentic service where frontier reasoning helps and PHI stays home, non-personal creative on the frontier. In healthcare, experience wins the patient and sovereignty keeps them, because trust is the whole product.
Where each AI workload
should live.
| Workload | Placement | Rationale |
|---|---|---|
| Member acquisition & digital front door | Sovereign | Health and eligibility data; belongs on EU compute. |
| Patient engagement & retention | Sovereign | Sensitive history; trust is the relationship. |
| Agentic patient/member service | Hybrid | Frontier reasoning; PHI and identity kept sovereign. |
| Campaign & content creative | Frontier | Non-personal, de-identified. |
What is yours to encode,
and what you are renting by accident.
Before any platform decision, one question settles the rest: how much of what your organisation knows can be written down precisely enough for a machine to act on it, and who ends up owning that writing. We run a short engagement to answer it, and it produces working artefacts rather than a report.
Two artefacts come out of this. An operating ontology, the nouns: the entities, relationships, and states your business actually runs on, described once and precisely. And agentic skills, the verbs: the procedures, thresholds, and judgments your best people apply, written down, versioned, and testable instead of retold.
A placement map addressed to the CTO or CIO office: what runs on your compute, what is bought, what is rented, who holds the keys, and what each costs. One test cuts through most of the debate. If a supplier vanished on a Friday, what stops working on Monday, and how long would it take you to replace it?
Where an open-weight model fine-tuned or adapted on your own corpus beats a frontier call, where a small purpose-built model for one narrow task beats both, and where the frontier still earns its fee. Geographic sovereignty falls out of that answer rather than having to be argued for on its own.
- →Care pathways, and the deviations clinicians accept in practice
- →Formulary, prescribing, and interaction rules
- →Consent, capacity, and safeguarding thresholds
- →Triage criteria and escalation, as actually applied on a ward
- →Documentation standards that make a note defensible
Clinical notes are special category and cannot travel. A model adapted on de-identified in-house corpora, running on site, is the only version of this a DPO can sign.
- +A register of encodable know-how, ranked by value and by how fast it decays
- +A draft operating ontology in an open format, not inside a vendor's platform
- +Two or three working skills, built and evaluated on your real work, not demonstrated on a slide
- +A bring-it-in-house plan the CTO or CIO office can actually staff
- +A model strategy: open weights, fine-tuning, purpose-built small models, and where the frontier stays
- +An evaluation harness that shows it works, and keeps showing it after we leave
This is a CTO and CIO office engagement, not a procurement exercise. Your own people have to end up running it, because the moment the encoding is delegated, the thing being encoded quietly stops being yours.
Palantir calls this layer an ontology, and the idea is right: a governed model of your objects, links, and actions that agents can act on. It lives inside their platform. 8090 will design, build, host, and maintain the software around it for you. Both are serious, and both leave the same question open. At the end of it, who owns the layer that holds your judgment? We build the same artefacts in open formats, on compute you control, and hand your CTO the keys.
Patient-grade AI,
inside the perimeter.
The same four layers we ship in legal, instantiated for a provider or life-sciences organisation, where the data is special category from the first field onward.
A patient engagement and journey assistant, a clinician documentation copilot that drafts inside your own templates, and a research workspace where cohorts can be explored without the underlying records ever being copied out.
Care pathways, formulary and prescribing rules, consent and safeguarding thresholds, and escalation criteria compiled into skills, so anything drafted for a clinician arrives already shaped by the protocol they are accountable to.
Patient data is pinned to local inference by architecture, with a refusal rather than a warning when something tries to route outward. Frontier models are reachable only for de-identified or non-clinical work.
On the provider's own infrastructure, on a managed sovereign instance, or on hardware inside the hospital or laboratory for workloads that must not depend on an external link.
The application layer here is built for you, not bought. The pattern is the one we already ship, as a product, in legal.
Four postures.
One codebase.
The same software in every posture, so a team can start hosted and end up air-gapped without a migration project. You move along the ladder when you decide to, not when a contract renews.
Your stack stood up on our infrastructure in days and pointed at real work, so it is judged on your matters rather than on a demo. The pilot fee credits against the hardware when you migrate.
Teams that want proof before capital expenditure.
The open-source cores installed on a machine you own, by a script anyone can read first. No account with us, no telemetry, no phone-home. Code flows one way, from us to you, and only when you ask for it.
Small teams, and anyone who wants to inspect the source before trusting it.
An isolated instance per client on sovereign infrastructure, European by default, run, patched, and monitored by us, with the security and backup credentials in your hands rather than ours.
Organisations without an infrastructure team to spare.
Dedicated AI hardware inside your building, with the applications and the open-weight models you choose installed and tested before it ships. It runs with the network unplugged, and it keeps working whatever happens to us.
In healthcare the appliance is what lets a department move now: capability on site, in weeks, without a national programme or a transfer assessment.
Work that cannot leave the building, ever.
- +Deployment and hardening, on your machines or ours
- +Knowledge encoding: your playbooks and positions compiled into installable skills
- +Model selection, tuning, and an evaluation harness built on your own work
- +Remote maintenance and monitoring at a published monthly rate
- +Updates as ordered, readable migrations, always after an encrypted backup
- +Backup, restore, and continuity drills you can actually rehearse
- +Enablement for the people who use it daily, not only for IT
- +Governance evidence: routing logs, audit trail, and an attestation pack
- Reach into your instance or see your work
- Revoke your software or disable a licence remotely
- Force an update on you
Not promises. Consequences of the architecture: your keys and your data are generated on your machine and stay there, and nothing calls home.
Get the full
healthcare
placement map.
We send a sector-specific brief with workload-by-workload placement guidance and a reference architecture for sovereign deployment.