PrivaSearch
Book a demo

HR, consultancies and healthcare administration

AI for HR and healthcare administration, within the GDPR. Special category data stays where it belongs.

PrivaSearch is software that lets your team search its own client files with Claude, ChatGPT or Mistral Vibe, after names, BSNs (Dutch citizen service numbers) and addresses have been replaced by pseudonyms and a colleague has checked that. For an HR department, consultancy or healthcare administration, that means: querying personnel files and intakes, while health data never reaches the AI in recognisable form.

Book a demo
In short

A personnel file or intake often contains health data: special category data with a prohibition of its own.

PrivaSearch replaces names, BSNs (Dutch citizen service numbers) and addresses with pseudonyms, and a colleague releases every document.

Only those in a project see the documents. The activity log records who viewed what.

What you use AI for

The client files that matter.

HR and healthcare administration hold the most sensitive things an organisation knows about people. That is exactly where finding things quickly is valuable, and exactly where nothing may leak.

  1. Personnel files

    Finding what is in an employment contract, appraisal or agreement, with names and BSNs replaced by pseudonyms.

  2. Advice and reintegration

    Searching reports and advice for an earlier recommendation or an agreement, without the AI knowing who it is about.

  3. Intakes and care plans

    Querying intake reports and care plans for an agreement or a deadline, with the review before anything becomes searchable.

  4. Care contracts and complaint files

    Searching contracts with health insurers and complaint files for a provision or an earlier outcome.

Which rules apply

What the law asks of your client files.

The GDPR prohibits processing health data unless an exception applies. On top of that come the retention and confidentiality obligations of HR and healthcare.

The question we hear most often

Working GDPR-proof with AI in HR or healthcare administration: what does that involve?

No tool does that for a firm, PrivaSearch included. The GDPR and the AI Act place the obligations with you as the controller. What your firm arranges itself, and what PrivaSearch does to help:

What your firm arranges itself

  • A lawful basis (Articles 6 and 9 GDPR)A lawful basis for every processing operation, and for special category data an exception from Article 9(2) as well.
  • A data processing agreement (Article 28 GDPR)With every party that processes data for you: with PrivaSearch, and with the provider of the AI assistant you connect.
  • A DPIA where one is required (Article 35 GDPR)Often with special category data or processing on a large scale.
  • An AI policyWhich tools are allowed, with which data, and who decides on that.
  • AI literacy (Article 4 AI Act)Staff who work with AI know what they are doing and what the risks are.
  • Professional secrecyThe professional secrecy of healthcare and the confidentiality of a personnel file remain yours. Per project, appoint only reviewers who may already view the documents.

What PrivaSearch does to help

  • Pseudonymising before the AINames, BSNs (Dutch citizen service numbers) and addresses are replaced before anything goes to your AI assistant.
  • A mandatory privacy reviewA colleague checks and approves every document. Only then is it searchable.
  • Permissions per projectOnly the members of a project see the documents of that project.
  • The activity logWho viewed, searched, released or revealed what, without document content in the log.
  • Storage in the EUOriginals are stored in data centres in the EU, in a database of its own per organisation.
  • An AI policy and a DPIA to start withStarter documents based on your own set-up, to have reviewed.

PrivaSearch is designed for the GDPR. The assessment of your situation remains yours and that of your data protection officer or lawyer.

How it works

From client file to answer, in four steps.

The AI only receives text that a colleague has released, with pseudonyms instead of names. See how it works.

  1. Add client files. Upload documents or connect a SharePoint library; SharePoint is only read.
  2. Detect and pseudonymise. A language model within PrivaSearch and Dutch patterns (BSN with the eleven test, IBAN, Dutch number plate, KvK number) find personal data and replace it with pseudonyms.
  3. A colleague reviews. Original and pseudonym are side by side. What the model missed, the reviewer adds; then they approve the document.
  4. Search with your assistant. Claude, ChatGPT Business or Mistral Vibe searches the released passages through a secure MCP connection, for example: “Which agreements on returning to work are in the plan of action of [PERSOON_B4A1]?”

The difference

A client file in a chatbot, or through PrivaSearch.

Topic WithoutUploading a client file to a chatbot WithPrivaSearch between your client file and your assistant
What the AI sees The entire client file, with names, BSNs and addresses. Released passages with pseudonyms.
Check beforehand None. A mandatory review by a colleague.
Who may see it Whoever uploads it, outside any arrangement for the client file. Only the members of the project.
What is recorded Nothing. Every view, search and release in the activity log.
Where the originals are With the provider of the chatbot. In data centres in the EU.

What you type into the assistant yourself goes straight to it, outside PrivaSearch. So ask about the role or the pseudonym, not about the person.

Frequently asked questions

What you probably want to know.

Working GDPR-proof with AI in HR or healthcare administration: what does that involve?

No tool does that for you. Your firm arranges a lawful basis, a data processing agreement, a DPIA where one is required, an AI policy, AI literacy and professional secrecy itself. PrivaSearch does the technology: pseudonymising before the AI, a mandatory review, permissions per project, the activity log, storage in the EU and a starter document for your AI policy and your DPIA.

May I put personnel files into ChatGPT or Copilot?

Not just like that. They often contain health data, and that is special category data with a prohibition of its own. The entire file also goes to the provider. With PrivaSearch, the assistant only sees released passages with pseudonyms.

Is pseudonymised health data still special category data?

For you, yes: you have the key, so it remains personal data, and Article 9 GDPR continues to apply. Pseudonymising is a security measure and an argument in your assessment, not a route to get outside Article 9.

Is a DPIA needed for AI in healthcare administration?

Often, yes. With health data on a large scale, a DPIA is usually required. PrivaSearch creates a DPIA starter document based on your own set-up; have it reviewed by a lawyer or your data protection officer.

Who sees a file in PrivaSearch?

Only the members of the project, after a password, two-step verification and a confirmed device. Every view, search and reveal goes into the activity log.

What if the detection misses a diagnosis or a name?

That is why the review is mandatory: a colleague sees the original next to the pseudonymised text, marks what was missed and only then approves. Until that approval, a document is not searchable.

Sources

The legislation and the pages of the supervisory authority were consulted on 3 November 2026. If you see something that is no longer correct, email us at privacy@privasearch.ai.

Read also

Updated on

See in twenty minutes what happens to your documents.

We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.

Book a demo →