Last reviewed: May 2026

Patient Data Protection in AI

This page explains how Widgi AI protects against patient-identifiable information (PII) being entered into the assistant: how we identify it, what approach we use, what happens when it is detected, and the controls that prevent patient data from reaching the AI model. It is the public summary of our internal clinical-safety control.

See it in action

A short recorded demonstration of this control — showing a patient-identifiable prompt being detected and blocked before it reaches the AI — is available on the Patient Data Protection — Demonstration page.

In short

Before any prompt reaches the AI, Widgi automatically scans it for patient information — NHS numbers (checked against the official NHS checksum), dates of birth, postcodes, contact details and clinical labels. High-risk prompts are blocked and never sent to the model. The same check runs both in your browser and on our server, so it cannot be bypassed, and every detection is logged as a category only — never the actual text.

1. How we identify personal information in prompts

Every prompt is passed through a dedicated detector before it is processed. It looks for the identifiers that matter in a UK / NHS context:

NHS numbers — recognised by pattern and validated with the official NHS check-digit calculation, so a genuine NHS number is treated as the highest risk.
National Insurance numbers, dates of birth, UK postcodes, phone numbers and email addresses.
Patient-identifying labels — phrases such as “NHS Number:”, “DOB:”, “MRN:”, “Patient name:” or “Hospital number”.

The detector is context-aware: a date of birth or postcode on its own is low risk, but the same detail sitting next to a patient label (for example “DOB: 12/03/1980”) is automatically escalated to high risk.

2. Our approach: rules-based, not AI-based

Detection is rules-based — pattern matching plus checksum validation — and is deliberately not AI/model-based. We chose this for three reasons:

Deterministic and auditable — the same input always gives the same result, and every rule is human-readable and explainable.
Keeps data inside the boundary — an AI-based detector would mean sending the very text we are trying to protect to another service. Our detector runs in-process, so candidate patient data is never sent anywhere to be checked.
Precise on the highest-risk identifier — the NHS check-digit calculation gives very high accuracy on NHS numbers.

3. What happens when patient data is detected

High risk (e.g. a valid NHS number, or data next to a patient label) → the prompt is blocked and never sent to the AI. You are asked to remove the personal details and use a generic description instead (e.g. “a 62-year-old patient with type 2 diabetes”).
Medium risk (e.g. an email or lone phone number) → you are warned and asked to confirm before continuing.
Low risk → recorded only, with no interruption.

Privacy of the safety log itself

Every detection is recorded for monitoring. The log stores only the category found (e.g. “NHS number”) and a count — never the original prompt and never the matched value. The safety log therefore never becomes a store of patient data.

4. Controls that prevent patient data reaching the AI

We use defence-in-depth — the same detection runs in two independent layers:

In your browser — prompts are checked as you write; high-risk prompts are blocked before they can be sent, medium-risk prompts require confirmation.
On our server — the same ruleset runs again and is the binding control. Even if the browser check were bypassed, the server will not pass a high-risk prompt to the AI.

Supporting controls:

Monitoring & alerting — detections raise metrics and alarms and are reviewable by our team.
Regression protection — because this is safety-critical, an automated test suite runs on every software change, so the detector cannot be silently weakened.
UK-hosted, no third-party model — Widgi runs on UK AWS (London region), answers only from your organisation’s approved content, and uses no external model such as OpenAI.

The bottom line

Patient-identifiable information is caught by a deterministic, UK/NHS-aware detector running both in the browser and on the server. High-risk prompts are blocked before they ever reach the AI; detections are logged as categories only and alerted on; and the whole control is protected by automated tests on every release.