Health-tech scale-up: Quick Check for GDPR-compliant AI
Strategy and roadmap before quick-win hype
Customer: Health-tech scale-up
Starting point
A 40-person health-tech scale-up had a rough idea of “AI for patient data” and wanted to engage a vendor — but did not know what was actually permissible for German patient data.
Solution
Instead of building immediately, we ran a two-day Quick Check: GDPR mapping, auditability, technical options (local vs cloud AI), tool selection. Outcome: a written roadmap with Phase 1 (local inference for triage), Phase 2 (RAG system for diagnostics support).
Result
- No misinvestment in non-compliant cloud AI
- Clear roadmap, signed off internally and by the data protection officer
- rzfz.ai Box has been running production Phase-1 since Q1 2026