Data security & compliance

Security built to the strictest healthcare standards

Gosta is built from the ground up to medical-device standards for data security, transparency and patient safety.

Data Protection & Security

Certified, audited, and kept that way

Certified systems and ongoing oversight, not a one-off assessment.

EU MDR Class I Medical Device

CE-marked device meeting health and social-care software requirements.

ISO 27001

A certified ISMS: information security is systematically managed and audited.

GDPR

Patient data handled under EU privacy law.

National requirements met

We work through each customer’s own security review and meet the national requirements that apply to their organisation.

What happens to the data, step by step


Speech becomes a note, the note goes into the record, and the working data is gone. Nothing is kept beyond what the visit needs.
Gosta listens
Speech is captured during the consultation and processed as it happens, inside the EU.
No audio recordings stored
The consultation becomes structured text. Audio is deleted as soon as it has been transcribed.
Responsibility always remains with the professional
The note, codes and letters stay drafts until a clinician has reviewed and approved them.
Transferred, then erased
The approved output moves into the record system, and the working data is permanently erased.
No data used for training AI models
Gosta doesn’t use any of your data to train its AI models.

How the best teams use Gosta

Security is shared between the tool and the team using it. Three habits that keep it that way.

Ask for consent

Tell the patient the consultation is being documented with Gosta. A reminder can be shown at the start of every session.

Read before you sign

Check the note and the proposed codes, add anything missing, and only then transfer them into the record.

Keep access personal

Accounts are individual and access is logged, so it stays clear who saw what and when. Do not share credentials.

Frequently asked questions

Where is the data stored and processed?

Exclusively on European infrastructure. Nothing is processed outside the EU.

Is Gosta a medical device?

Yes. Gosta is CE-marked under the EU Medical Device Regulation (MDR) as a Class I device for health and social-care software.

Are audio recordings kept?

No. Speech is processed during the consultation and deleted once the note has been produced.

Is our data used to train AI models?

No. Patient data from your organization is not used for model training.

Who is responsible for the documentation?

The clinician. Notes, codes and letters are drafts until a professional reviews and approves them, and nothing reaches the record before that.

How do you handle model errors and hallucinations?

A hallucination is when AI generates content that is nonsensical or incorrect. We keep improving the technology to avoid it, and there are two more ways we tackle it. Our clinical team regularly reviews our models and templates and checks the outputs for accuracy. And your input matters: we encourage you to read every note before transferring it to your record system.

Want to hear more?

Send us a message and we will share more!