Security is what makes AI on patient records possible
AI on patient data can only be adopted when an organisation can document where the data is processed, who reads it and what is left afterwards. With Vidd, all three answers can be verified.
Helse Sør-Øst's tender evaluation
“[Vidd's] solution stands out positively in every security category, with clear control of access, data processing and technical safeguards. Key security mechanisms are well documented. The solution is mature and verifiable.”
- Security
- 9.4 out of 10
- Highest of the four suppliers
- Technical solution
- 10 out of 10
- Highest of the four suppliers
The whole AI chain runs in a closed environment in Norway
Speech recognition, language models, search and logging run on dedicated hardware, either in the organisation's own data centre or in Vidd's sovereign cloud. Both operating models are in production, with the same codebase and the same certification.
Vidd does not build its own record archive
Data is fetched when the clinician needs it, used for the draft and deleted. The approved document is stored in the record system.
- Step 1
Recording
The conversation is streamed encrypted to the platform and transcribed there.
The audio is deleted when the document is published
- Step 2
Record documents
Only the documents the clinician chooses are fetched from the record system.
Deleted as soon as the draft exists
- Step 3
Transcript and draft
The clinician reads, corrects and approves before anything moves on.
Deleted automatically, by default within 24 hours
- Step 4
Approved document
Published to the record system through its own interface.
Stored in the record system, not by Vidd
No patient database at Vidd
No backup of patient data
No training of the models on patient data
Only what the clinician chooses, with the clinician's own access
When Vidd is to write a discharge summary, the clinician chooses which record documents to use. The list shows only title and date, and the content is fetched only once a document is chosen. Vidd never reads more of the record than the clinician has decided.
The clinician's access, not Vidd's
Lookups in the record system are made with the logged-in clinician's own access. Vidd has no shared service account that can read records on its own.
Logged in the record system
Access is registered against the clinician in the record system's own audit trail, just as when the clinician opens the document directly. Vidd's own log comes in addition.
Nobody at Vidd sees data without the customer's permission
Vidd's staff get technical access to temporary data only with the customer's explicit permission for the individual incident, and the access is logged. The hosting provider does not hold the application keys.
The tool documents. The clinician decides.
Vidd makes no clinical decisions. It drafts from what the clinician has said in the consultation or selected from the record, and nothing is stored in the record until the clinician has read and approved it. Because the draft has to be correct, Vidd is a medical device.
CE-marked medical device, class I
Under the EU Medical Device Regulation (MDR). Approval of the draft is enforced in the platform, not only on screen.
ISO 13485:2016
The quality management system is certified by DNV, certificate C765121, valid until October 2028. It covers design, development, production and distribution of the software.
IEC 62304, class B
The software life cycle follows the standard for medical device software, with traceability from user needs through risk to test. Every model version is released under the quality system.
Vidd is not certified to ISO 27001 or ISO 42001. Our management of information security and AI follows the requirements of both, and we will say so when that changes.
How the platform is kept secure in operation
What applies to a specific delivery is set out in its agreement and security documentation.
Encryption
Data is encrypted at rest and in transit, with TLS 1.2 or later and separate keys per environment.
Login
HelseID or the record system's own login. No password database of our own, and two-factor authentication on all administrative access.
Logging
Every call is logged with user, action and time in an append-only log. Access logs are kept for at least five years and can be forwarded to the customer's own logging system.
Round-the-clock monitoring
In Vidd's sovereign cloud the platform is monitored by a security operations centre approved under NSM's quality scheme for incident handling. Traffic runs over Norsk Helsenett.
Incidents
Security incidents are reported to the customer within one hour, with a root-cause report within five working days.
Vulnerabilities
Dependencies and containers are scanned in every build. The platform has been penetration-tested by an independent third party, most recently in September 2026.
Clear roles and a short supply chain
The organisation is the data controller for the patient data, and Vidd is the data processor under a data processing agreement. The sub-processors are few and listed in the agreement: the data centre provider for Vidd's sovereign cloud, Norsk Helsenett and HelseID. No AI vendor or cloud service receives patient data.
Documentation we share before a decision
- Security documentation for risk assessment (ROS)
- Basis for a DPIA
- Integration description for the record system
- Data processing agreement with a list of sub-processors
- Instructions for Use
Questions about security and data processing
No. Speech recognition and language models run on dedicated hardware in the organisation's own data centre or in Vidd's sovereign cloud in Norway, without internet access. No part of the processing uses external AI or cloud APIs.
Only if the customer allows it. Technical access to temporary data is given only with explicit permission for the individual incident, and the access is logged. The customer can also opt out entirely.
No. The models do not change in operation and are not trained on patient data. New versions are validated on synthetic data created by Vidd's clinicians before they are put into use.
Not after the document is published. The recording is deleted then, and the document in the record is what remains.
Yes. The platform runs on dedicated hardware inside your security zone. We agree capacity, networking and the division of operational responsibility with your operations organisation.
The clinician who approves the document. Vidd drafts, and nothing goes into the record without approval.
Read more
Medwatch
Vidd Medical launches offline AI for secure and sovereign health data
Vidd Medical has launched a CE-marked artificial intelligence solution that runs locally, without using American cloud infrastructure.
Medwatch
Responsible AI in healthcare requires governance and trust
Orinta Rui, head of regulatory affairs (QA/RA) at Vidd Medical, on the need for governance, trust and control in developing artificial intelligence.
Dagens Medisin
Do you know where the patient conversation ends up?
Do you need documentation
for a risk assessment or DPIA?
We send what your security team and data protection officer need, tailored to the operating model you are considering.