For care organisations
Support AI use in healthcare. Protect patient data while people work.
See which AI tools clinicians use and record what is allowed for each one. Staff get help as soon as patient data appears in their text.
Prefer to try it yourself? 14 days free, no credit card.
AI already helps with handovers and letters. Oversight has not caught up.
Nurses use AI to summarise handovers, doctors use it to rewrite referral letters and a practice group is trying out an AI scribe. Understandable, with so much writing on top of patient care. But those texts hold names, ID numbers, diagnoses and medication, all covered by medical confidentiality. Here's how to stay in control, in four steps.
1 See
See which AI tools clinicians use.
The CMIO wants to know which AI tools clinicians really use, besides the speech recognition the organisation has a contract for. The catalogue shows the tools seen in this organisation, from Copilot and ChatGPT to Autoscriber and Heidi Health, each with a risk score and the organisation's decision. Usage and Compliance show what share of AI use goes through approved tools, and which tools are new.
More about SeeAn impression of the AI tools catalogue. The tools and risk scores come from the product. The decision in the last column is your organisation's own.
2 Decide
Assess a new AI scribe and record what is allowed.
A practice group tries Heidi Health, an AI scribe that listens in on consultations and writes the notes. Nobody has assessed it yet. The screen shows the assessment of Heidi Health: the Australian vendor, where the data is held, whether it trains on input and whether a data processing agreement (DPA) is available. The organisation decides, for example, to allow it only once the CMIO and the DPO have reviewed it, and records that decision and its condition in the AI register.
More about DecideProduct example with fictional data.
3 Help
Help clinicians protect patient data while they work.
A nurse asks an AI tool to shorten the handover for the evening shift. The patient's name, date of birth, citizen service number (BSN), diagnosis and medication are in it. BeeSensible highlights those details in the text. One click turns them into a placeholder such as [NAME1], or removes them, and the AI tool can still rewrite the handover. The organisation can also set masking to happen automatically when text is pasted or sent. A referral letter a doctor wants to rewrite can be anonymised the same way.
Names that only mean something inside your organisation, such as an internal care programme, an ongoing study or a ward code, can be added as custom terms.
Custom terms that fit here
- Home First programme Project
- RESTFUL-2 study Project
- Ward 7 West Location
- CareBridge System
GeminiReferral letter: cardiology
Dear colleague, I am referring Mohammed El Idrissi, born 11 March 1992, BSN 184629375, to your clinic at St. Catherine's Hospital.
History of type 2 diabetes mellitus and hypertension. Takes metformin 850 mg twice daily.
DeepSeek is not allowed here
Your organisation does not allow this tool for work. Use an allowed alternative.
Use instead
Open Microsoft 365 CopilotAlso allowed: ChatGPT
DeepSeek is allowed here, with limits
Your organisation allows this tool with limits. Only use it with anonymised data.
Use instead
Open Microsoft 365 CopilotAlso allowed: ChatGPT
No decision yet on DeepSeek
Your organisation has not made a decision on this tool yet. Do not share personal data or confidential business information here.
Use instead
Open Microsoft 365 CopilotAlso allowed: ChatGPT
Only enter public information here
Product example with fictional data.
4 Substantiate
Show in figures how your AI policy works.
The board wants to show the Dutch Health and Youth Care Inspectorate (IGJ) how the organisation handles AI tools and patient data. Each month or quarter you create a report: how many tools have a decision, how many critical details were adjusted before sending, and how often staff chose the approved alternative after a notice. Always for the whole organisation, never per clinician, and downloadable as a PDF. It fits the risk analysis required by NEN 7510, the Dutch standard for information security in healthcare.
More about SubstantiateNotices about tools
Shown when someone opens a tool without a decision, or one that is limited or not allowed.
Browser use only, counted at most once per tool per day.
Product example with fictional data.
A customer's view
"Everyone here knows you have to be careful with customer data. But that awareness fades when you're busy. Knowledge is no guarantee of behaviour. That's exactly why we use BeeSensible."
Debby Elfrink Operations director, Speck Pompen This customer works in a different sector.
Trust and getting started
Your data stays safe, and getting started is quick.
What happens to your data
- Text is checked on our own servers, hosted by the European companies Scaleway and Hetzner, and deleted straight away.
- The dashboard shows totals for the whole organisation, never a breakdown by employee. Figures only appear once five or more users are active.
- You get a data processing agreement (DPA). The product DPIA and security information are available on request.
How to get started
- Install the extension on a few workstations, or have IT roll it out centrally through Intune or Group Policy, on any plan.
- Employees get an explanation and short videos about what they'll see and what they can do.
Good to know
Questions we often get.
So patient data may never go into an AI tool?
That is for you to decide. In an application set up for it, with a DPA and a lawful basis, it can be part of the work. You record that as the decision for the tool, with its condition. BeeSensible shows clinicians which details are in their text.
Does detection recognise clinical terms?
Yes. Detection works in Dutch and English and recognises diagnoses, medication and doses as well as names, ID numbers and addresses. In each detection profile you choose which types are included and how strictly. Programme names and ward codes can be added as custom terms.
Does BeeSensible judge whether an AI scribe is clinically suitable?
No. The catalogue shows the facts about the vendor, hosting, training on input, the DPA and an indicative EU AI Act classification. In the register you record the decision, with the DPIA and the review date. Whether an application is clinically suitable and its output correct is for your organisation to judge.
How does this fit IGJ guidance, the GDPR and NEN 7510?
Health data is a special category of personal data, with medical confidentiality on top. The IGJ expects generative AI to be introduced and used with care, and NEN 7510 asks for a risk analysis with appropriate controls. BeeSensible can be one of those controls, and shows how it works. It is for the organisation to judge what is appropriate.
Does BeeSensible block AI tools?
Not on its own. People see what was found and what you decided about a tool. You decide whether someone can still go ahead with a tool that is not allowed, and whether masking happens by default. What happens after a highlight or a notice is counted, without content and without a name.
Start by seeing which AI tools your organisation uses
Start on a few workstations, or see it in a demo first.
14 days free, no credit card. Rolled out across your organisation within an hour.
