What “AI that stays on your network” means

When we say private AI “never leaves your private network”, it isn’t a figure of speech. It is a concrete claim about where data lives, where it travels and who can access it. Here is what that looks like in practice.

Where dictation is processed

The doctor dictates on a computer or phone in the practice. The recording doesn’t travel over the public internet: a small router in the practice builds an encrypted link to our data centre in Serbia. There, in an environment that belongs to your practice alone, run a speech recognition model and a model that turns the transcript into a structured report.

None of it goes to foreign AI services. If the practice’s internet goes down, the assistant is unavailable until the link is back — dictation is kept on the device and syncs by itself when the link returns.

What is stored, and where

• The dictation audio — in your environment in our data centre in Serbia, for as long as you decide. Many practices delete it once the report is signed off.
• The report text — in the same environment, until you move it into your records system.
• An access log — who used the system and when.

Backups are encrypted and also stay in Serbia. There is no copy “in the cloud” of a foreign provider.

Who has access

Your environment is separate from every other client and has its own keys. Only the users you approve have access. Our team accesses it only for maintenance, under a data processing agreement, and every such session is logged.

Why it makes compliance easier

The GDPR and Serbian data protection law give health data special protection. When that data is sent to a foreign AI service, a series of questions follows: who is the processor, where are the servers, is data transferred to third countries, is it used for training.

When the data stays in Serbia, in an environment that is yours alone, most of those questions get a simple answer: no transfer to third countries, a known processor who has signed an agreement, and no training on the data. What remains are the questions you already have — who in the practice may see which data — and the system answers them with roles and access logs.

That doesn’t make compliance automatic. Responsibility stays with the practice as the controller. But this architecture is easy to explain — to the regulator and to patients.

And if you really want a server in the building?

For hospitals and clinic chains we also offer an enterprise option, with a server that sits physically in your own server room. For a practice with a few doctors it doesn’t make financial sense — the standard model costs less and is just as private.

What the doctor actually gets

• A report in the practice’s own template, instead of retyping.
• Suggested ICD-10 codes, which the doctor reviews and confirms.
• More time for the patient, less for the keyboard.

The best way to find out whether it works for your practice is a 30-day pilot on your real cases.