GPU Solutions

Solutions · Healthcare

AI for healthcare with patient data kept in Spain

GPU Solutions runs AI models for hospitals, clinics, laboratories and research groups on its own NVIDIA B200 GPUs in a Tier III datacenter in Madrid. Patient data is processed and stored in Spain, in an isolated environment, and is never used to train models. You can transcribe consultations, read reports or run research on pseudonymised data without sending it to a foreign API.

In short
  • Patient data processed and stored in Spain, with no subprocessors outside the EU.
  • One isolated environment per customer: its own network, storage and access.
  • Platform certified ISO/IEC 27001:2023 and ENS Medium by EQA; datacenter certified ENS High.
  • Ready for GDPR art. 9, the EHDS and the AI Act: DPA, optional zero retention and access logs.

Why healthcare AI needs infrastructure in Spain

The real opportunity for AI in healthcare is the work that eats hours of skilled staff time today: writing up the clinical note after each consultation, reading scanned reports sent from other hospitals, finding the current protocol, or preparing data for a study. Today's open models handle these tasks well, provided they run close to the data on GPUs fast enough to answer during the consultation rather than the next day.

The problem is where they run. Health data is a special category under the GDPR and needs stronger safeguards. Sending medical records to an API hosted outside the EU raises questions about international transfers, access by foreign authorities and reuse for model training that no ethics committee or data protection officer wants to answer. That is why so many healthcare AI projects never get past the pilot.

Regulation is moving too. The European Health Data Space (EHDS) sets rules for secondary use of data in research, the AI Act treats AI software that qualifies as a medical device under the MDR as high-risk, and Spain's ENS (Esquema Nacional de Seguridad, the National Security Framework) still applies to public health services. We track every deadline in our regulatory radar. As a Spanish operator with its own hardware in Madrid, we give you an environment where you know where every piece of data sits, who accesses it and how to leave, at published prices.

Four AI use cases that work in healthcare today

These are realistic cases built on open models available now. Before you commit, we size them by measuring your actual workload on our cluster.

Consultation transcription into structured notes

The clinician records the consultation with the patient's consent and Whisper large-v3 transcribes it on a dedicated GPU in Madrid. A language model then turns the transcript into a note with the sections your medical record uses: reason for visit, history, examination, assessment and plan. The doctor reviews, edits and signs; the system suggests, it does not decide. Audio and text are kept or deleted according to the retention policy you set.

Whisper large-v3 · Qwen3 14B · dedicated GPU in Madrid

Reading scanned reports and forms

Plenty of clinical paperwork still arrives on paper or as scanned PDFs: discharge summaries from other hospitals, consent forms, referrals, external lab results. A vision model reads each page, extracts the fields you care about and returns them in a format your system can import, with the original image linked so anyone can check a value. Use it to digitise historical archives or to sort incoming documents every day without retyping them.

Qwen3-VL 32B OCR · Nemotron Nano 12B VL

Clinical protocol assistant with cited sources

We index your protocols, internal guidelines and nursing procedures in a private search space. When someone asks, say, for a department's antibiotic prophylaxis regimen, the assistant answers and cites the exact document and section the answer comes from, so it can be checked in seconds. When a protocol changes, it is reindexed and the answer changes with it. Neither the questions nor the documents ever leave your environment.

Search over your documents · GLM 5.3 · private endpoint

Research environment for pseudonymised data

For secondary-use studies we set up a dedicated pod with full NVIDIA B200 GPUs, storage with quotas and SSH or Jupyter access for the authorised team only. Data arrives already pseudonymised by your organisation, is analysed inside the environment, and only the aggregated results your protocol allows ever leave it. It follows the secure processing environment logic set out in the EHDS, applied to the research projects you are running now.

Dedicated pod with 1 to 4 B200 · Jupyter · Exascaler storage with quotas

How your patients' data travels

Four legs, all in Spain and all under contract. Here is the path a request takes from your system to the GPU and back.

  1. 01

    Your systems

    Your EHR, PACS and document management stay where they are. You only send what each use case needs, pseudonymised wherever possible.

  2. 02

    Encrypted link

    Traffic goes over a VPN or a dedicated, encrypted point-to-point link, with post-quantum cryptography available. If you prefer, it never touches the public internet.

  3. 03

    Isolated environment

    Each customer gets its own network, its own storage and its own access controls. We log who gets in and when, and you apply your retention policy or zero retention.

  4. 04

    GPU in Madrid

    The model runs on NVIDIA B200 GPUs in a Tier III datacenter in Madrid. Nothing is reused: not for training models and not for other customers.

Healthcare regulation and how we help

Compliance remains your organisation's responsibility as data controller. What we provide is infrastructure and documentation that make your risk analysis and impact assessments easier.

Healthcare regulation and how we help
RegulationWhat it requiresHow we help
GDPR art. 9Health data is a special category: it needs a specific legal basis, stronger security measures and, in many cases, a data protection impact assessment.Processing and storage in Spain, no subprocessors outside the EU, a standard DPA with optional zero retention, and technical documentation for your impact assessment.
EHDS (Regulation (EU) 2025/327)Governs patients' access to their own data and secondary use for research and innovation through secure processing environments, applying in phases.Isolated environments with named access, access logs and controlled export of results, in line with the secure environment logic for secondary use.
AI Act and MDRAI software that is a medical device is high-risk, with obligations from 2 August 2028: risk management, data governance, record-keeping and human oversight.Traceable infrastructure for the manufacturer: pinned model versions, your own images, access logs and data that stays in Spain.
ENS (Royal Decree 311/2022)Public health services and their technology providers must apply Spain's National Security Framework according to each system's category.Platform certified ENS Medium by EQA, hosted in a datacenter certified ENS High. For systems categorised High, we work through the fit with you.
LOPDGDD (Spanish Organic Law 3/2018)Its 17th additional provision governs health data processing, including reuse of pseudonymised data for research with technical separation between whoever pseudonymises and whoever does the research.Environments separated by project and team, restricted access, and pseudonymisation on your side before the data reaches the GPU.

Regulatory radar: healthcare

Rules and deadlines that affect AI in healthcare, each with its official source. The full list is in our regulatory radar.

  1. AI Act high-risk obligations for Annex III systems start to apply

    Covers credit scoring, life and health insurance pricing, justice, essential public services and employment. Requires risk management, data quality, logging, human oversight and technical documentation.

    Official source: EUR-Lex · Reglamento (UE) 2026/1744 ↗

    DeadlineEU

  2. European Health Data Space Regulation (EU) 2025/327 starts applying in phases

    Obligations arrive in 2027, 2029 and 2031: patient access to their data, requirements for electronic health record systems and secondary use of health data inside secure processing environments.

    Official source: EUR-Lex · Reglamento (UE) 2025/327 ↗

    DeadlineEU

  3. EuroHPC AI Gigafactories call closes (up to 7 consortia)

    Awards are expected in early 2027. Spain is bidding with a public-private candidacy. It signals where European compute capacity for training and running models will be located.

    Official source: EuroHPC ↗

    DeadlineEU

  4. First EHDS implementing regulation on MyHealth@EU (Implementing Regulation (EU) 2026/2083)

    Sets technical rules for cross-border exchange of health data between Member States and applies from 26 March 2027. It is the first concrete implementing act under the EHDS Regulation.

    Official source: EUR-Lex · Reglamento de Ejecución (UE) 2026/2083 ↗

    In forceEU

  5. Royal Decree 415/2026 on health technology assessment in Spain's national health system

    In force since 18 June 2026. It organises health technology assessment, accepts real-world data and covers digital therapies, which matters to anyone building clinical software with AI.

    Official source: BOE-A-2026-11587 ↗

    In forceSpain

  6. Spanish Government launches the National Health Data Space

    An interoperable network of regional platforms for secondary use of health data, backed by 70 million euros. It prepares research and AI models on clinical data inside controlled environments.

    Official source: La Moncloa ↗

    OngoingSpain

  7. MDCG 2025-6 / AIB 2025-1: AI medical software must meet both the AI Act and MDR/IVDR

    AI medical software that needs a notified body is high-risk and must meet both frameworks. The guidance explains how to combine the documentation into a single conformity assessment.

    Official source: Comisión Europea · MDCG ↗

    PublishedEU

Recent laws, guidance and decisions →

Frequently asked questions about AI in healthcare

Does patient data leave Spain?

No. Data is processed and stored on our own GPUs in a Tier III datacenter in Madrid, and we use no subprocessors outside the European Union. The link from your systems can be a VPN or a dedicated, encrypted point-to-point connection. Your data is never used to train models, whether ours or anyone else's.

Will you sign a data processing agreement?

Yes. We sign a standard DPA as data processor, with an optional zero-retention mode: requests are processed and nothing is stored afterwards. It sets out where the data is located, the security measures in place and the list of subprocessors, all within the EU. If your data protection officer needs additional clauses, we review them together.

What certifications do you hold?

The platform is certified to UNE-EN ISO/IEC 27001:2023 and ENS Medium category by EQA. The Madrid datacenter holds ENS High category, ISO/IEC 27001:2022, ISO 9001 and ISO 50001. If your system is categorised as High under the ENS, we review the fit with you before starting.

Is an AI clinical assistant a medical device?

It depends on its intended purpose. If the software helps diagnose, treat or predict outcomes for specific patients, it is usually a medical device under the MDR and, under the AI Act, a high-risk system from 2 August 2028. A protocol search tool that cites sources and makes no decisions about patients needs a different analysis. Qualification is the manufacturer's call; we provide traceable, documented infrastructure.

How long does it take to get an environment running?

A standard dedicated environment is ready 72 hours after signature. Before that, we measure your workload on our cluster to size the GPU you need, from a MIG fraction up to a full node of eight NVIDIA B200. If you just want to try models, you can start today on GPU Flow with pay-per-token inference.

How much does it cost?

A full NVIDIA B200 GPU costs €8.00/h excluding VAT and a 1/8 MIG fraction starts at €1.50/h; inference on GPU Flow starts at €0.06 per million input tokens. On-demand has no commitment; reserved capacity has a six-month minimum. Full details are on our pricing page.

Next step

Tell us what you want to do with your patients' data

Talk to an engineer →