25.06.2026
Local AI for Medical Practices: §203, Patient Data and RAG
How medical practices can process letters, findings and guidelines locally and integrate AI with their PMS.
A familiar AI chat for practice knowledge, templates and preparatory documentation. The platform runs in the practice network; data sources and integrations are configured in a controlled way.
Doctor's letters, findings and histories take time - public AI services add data paths outside the practice.
Health data requires particularly clear limits on data sources, access permissions and traceable processing.
A DPA with the provider does not replace medical confidentiality.
We configure and operate AI Cube Pro for GDPR- and §203-compliant use when required. This includes controlled data paths, limited permissions, documented maintenance, the appropriate DPA and written secrecy obligations for the people involved.
§203 StGB protects confidential information entrusted by clients, patients and other parties. The necessary involvement of contributing persons is permitted. What matters is that access is limited to what is necessary, the people involved are bound to secrecy and the complete data and maintenance path is controlled.
With public AI services, inputs and documents leave your own infrastructure. Whether a service is suitable in a specific case therefore depends not only on a DPA, but also on data flows, subprocessors, access permissions and the actual use.
On-premises inference, local vector search and internally operated interfaces keep technical processing in your controlled environment. This reduces external data paths and subprocessors and allows access to be limited precisely.
When we provide setup or operations as a contributing person, the people involved accept a written secrecy obligation and are instructed about the criminal consequences. Where personal data is involved, this is combined with a DPA, limited administrative rights and documented maintenance paths.
These technical and contractual building blocks form part of the agreed §203 scope:
Data-protection layer
Secrecy and instruction on criminal consequences
necessary rights, logging and controlled paths
This content is general information and not legal or tax advice. The specific implementation under §203 must be reviewed professionally on a case-by-case basis.
AI Cube Pro brings a familiar AI chat, local models and dedicated knowledge areas into the practice. Staff can use approved templates and documents as knowledge. PMS connections and automated data flows are assessed and implemented separately.

Ready for use in under two weeks after configuration approval
EUR 5,999 excl. VAT
RAG, data sources, integrations, secure connectivity and custom workflows are scoped separately.
Optional managed operations from EUR 149.90 excl. VAT per AI Cube and month; §203 scopes include a DPA, limited administrative rights, written secrecy obligations for the people involved and instruction on the criminal consequences
These examples describe possible workflows. Data sources, permissions and professional review are defined for the concrete use case.
Sovereign AI is a lifecycle, not a device purchase - and everything stays on your infrastructure.
Workshop, sizing, data classification and §203 contract framework. We understand your stack, professional software and compliance requirements before we recommend.
On-premise build on your hardware, RAG on your documents with access control, integration into your professional software, secrecy obligation + DPA.
Updates, monitoring, model upgrades and RAG maintenance as a service contract - or you operate fully yourself. Handover and knowledge transfer included.
From hardware and inference through RAG and integration to operations and security - no interface ping-pong between advice, build and operations.
Describe the workflow and data that should be processed locally or in a controlled environment.
From local AI integration to architecture, data sovereignty and ongoing operations.
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
No risk: worst case, you leave with a clearer understanding of your project than before.


“WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.”