Data minimisation
We collect only what the clinical workflow actually requires. Each practice's data is scoped to that practice alone and is never shared across tenants or used for any purpose outside the service.
Security & Privacy
Your patients' data stays where it belongs
PappAI is built on data minimisation, role-based access control, and a strict separation between AI-generated suggestions and the clinical decisions that are always yours to make.
- Data minimisation
- Health data on EU infrastructure
- Database-level isolation
- No training by PappAI on the data
- Art. 28 DPA available to read
Three founding principles
Role-based access
Nutritionists and patients operate in separate authentication contexts. Each role is permitted to see and act only on what it needs. The system is designed to keep sessions isolated and to prevent cross-role data exposure.
Human decision always wins
The AI generates a proposal. The clinician reads it, edits it if needed and approves it. No AI output is applied to the plan or the clinical record without an explicit action by the professional.
01 · Access control
Each practice sees only its own patients
Each nutrition practice operates inside its own isolated context. The boundaries are enforced at the database level as well as in application logic.
Tenant isolation
One studio cannot access the patients, records, or settings of another. Data is logically partitioned and scoped by practice at the database layer.
Role separation
Nutritionist accounts and patient accounts are distinct authentication identities with different permissions. A patient cannot see clinical notes; a nutritionist cannot impersonate a patient.
Endpoint-level enforcement
Authenticated clinical-data endpoints are designed to verify role and tenant membership on every request. The architecture is built to make these checks unavoidable for protected routes.
Explicit patient association
A patient is linked to a practice only after redeeming a one-time association code issued by the professional. No implicit or automatic linking occurs.
02 · Data & GDPR
Health data treated as a special category
Patients' clinical information is health data within the meaning of Article 9 GDPR. We treat it accordingly.
Controller / Processor split
The nutrition professional is the data controller for their patients' data. PappAI acts as data processor on their behalf, under the terms of our Data Processing Agreement.
Informed consent in the workflow
PappAI supports collecting patient consent as part of the workflow and stores attributable consent records (who consented, when, and to what version of the notice). It is the professional's responsibility to obtain consent in line with their applicable obligations.
No training by PappAI
PappAI does not use patients' clinical data to train, fine-tune or evaluate AI models. AI processing runs on Google Vertex AI in the EU region, a sub-processor listed in the DPA.
Data Processing Agreement available
The standard DPA can be read online and is signed from the platform. If your organisation needs a custom DPA, contact us at support@pappai.it.
03 · AI role & limits
Role and limits of the AI
PappAI uses AI to speed up professional workflows. Clinical responsibility always stays with the licensed professional.
01
Suggestions only
AI generates diet plans and clinical observations as draft proposals. The professional must review and explicitly approve each one before it is saved or shown to the patient.
02
Audit trail of AI operations
Relevant AI interactions are logged: the request context, the generated output and the outcome, accepted as is, edited or rejected.
03
No autonomous actions
The AI never edits a saved plan and never acts without an explicit action by the person using PappAI. In the app, the patient gets an AI answer only when they ask for it (SensAI, meal photo estimate), and the plan does not change. There is no background AI processing on patient data.
AI outputs are informational drafting support for the licensed professional's review. PappAI is not a medical device, does not perform diagnosis or treatment, and is not intended to replace clinical judgement. Clinical and dietary responsibility remains with the licensed professional at all times.
04 · Reference documents
05 · FAQ
Frequently asked questions
Health data stays on European infrastructure, AI processing included (Google Vertex AI, EU region). The exception is login data of those who choose “Sign in with Apple” or “Sign in with Google”, processed by Apple and Google under their own terms. WhatsApp, SMS and push notifications go through providers that may also be outside the EU (Meta, Twilio, Apple, Google) and do not contain clinical data generated by PappAI; the content of free-text messages written by the professional is the professional's responsibility.
Want to see PappAI live?
Leave your professional email. We'll contact you for a private demo and to activate your practice.
Quick setup · Cancel anytime See plans