Healthcare

Patient data flagged on every line an agent reads.

Hospitals and health-tech companies build agents for appointments, triage support, discharge summaries and medical coding. KVKK Art. 6 and the Regulation on Personal Health Data place health data in a special category. Thulpar’s health rail combines a Turkish and English lexicon with NER, learns the tenant’s own terms and stops data leaving through the sink policy.

Request a demo →Watch the live simulation

Policy template

tr-insurance-seddk

Recommended install

On-premise, Standard tier. The health-data rail on, the file rails locked.

Surfaces

OpenAI-compatible gatewayCheck API

Regulatory basis

KVKK 6698 Art. 6 · Regulation on Personal Health Data
Ministry of Health information-security policies
EU AI Act Annex III (in the medical-device context)

Policy template

Special-category detection

Disease and medication names appear in free text. Generic PII detectors do not see them.

Watch the runs →

Runs

The scenarios below are derived from the product’s real rules.

Every scenario is an agent run written to the product’s real rules. It shows the stage, the rails, the decision, the finding, the approval and the ledger entry step by step.

3 scenarios →

Healthcare

What comes up in practice

Special-category detection

Disease and medication names appear in free text. Generic PII detectors do not see them.

The clinical decision-support boundary

The assistant must not diagnose. The topic rail and the persona check hold that line on every turn.

File attachments

Lab PDFs and images can carry active content, hidden text and PII in metadata.

Runs

3 scenarios

The player opens on the flagship scenario. Pick the others below.

Discharge-summary assistant and attending-physician approval · Clinical documentation assistantgatewaytr-insurance-seddkstandart

Decision trailDischarge Assistant · qwen3-32b · vLLM · hospital data centre

01inputuser

Physician: “Prepare the discharge summary for admission 2026-18877 and list the discharge medications.”

02tool_callagent

The his:get_encounter, his:get_labs and pharmacy:list_orders read calls; the clinical-read group is open.

03tool_resulttool

The admission summary: “type 2 diabetes mellitus”, “metformin 1000 mg”, HbA1c; the patient’s name and TCKN.

04output_chunkmodel

The stream starts: diagnosis, course, medications; every sentence passes the health and content rails.

05outputmodel

The full summary: the model wrote the patient’s TCKN; the HIS record only needs the admission number.

06tool_callagent

The agent calls his:write_discharge: the summary is to be written to the hospital information system.

07tool_callsystem

Approved in 22 minutes; the run resumes, the summary is written to the HIS; the approval on the ledger.

08memory_writeagent

The agent wants to write “the patient takes metformin” to long-term memory.

Thulpar · Rails

The assistant drafts the summary; disease and drug names are special category, the HIS write waits for the physician.

his:get_encounterhis:get_labshis:write_dischargepharmacy:list_orders

Controls: GR-PII-01 · GR-TOOL-02 · GR-IFC-01 · GR-MEM-01 · GR-LOG-01

Evidence ledger0000…0000

Simulation · runs in your browser · no request leaves the pageadded latency: 0 ms · 8 steps · SHA-256 chain

gateway8 steps · standart

Discharge-summary assistant and attending-physician approval

The assistant drafts the summary; disease and drug names are special category, the HIS write waits for the physician.

allowallow_with_findingsredactholddeny

check8 steps · standart

The triage-support chatbot does not diagnose

A patient asks for a diagnosis; the bot says it is an AI, and the diagnosis sentence becomes a safe-referral template.

allow_with_findingsprependallowrewritedeny

check8 steps · standart

Lab-report PDF intake

The uploaded “PDF” is another file; the real report’s metadata is masked, a hidden instruction never reaches coding.

denyredactallowallow_with_findings

Controls exercised in these scenarios

9 GR-*

id	control	OWASP	rails
GR-PII-01	PII and special-category detection + masking (TCKN, IBAN, phone, health) on input/tool/output/log	LLM02 / — / MCP10	pii.detect, pii.redact, file.metadata_pii
GR-TOOL-02	Durable human approval on high-impact actions, four eyes	LLM06 / ASI02, ASI09	labels.sink
GR-IFC-01	Information-flow labels (integrity, confidentiality, tenant, PII class) enforced at sensitive sinks	LLM02 / ASI01, ASI03 / MCP10	labels.sink, pii.detect
GR-MEM-01	Memory-poisoning policy + provenance	— / ASI06 / MCP10	memory.write
GR-LOG-01	Tamper-evident event log (model/tool/policy/approval/hit), ≥ 6 months, auditor export	— / — / MCP08
GR-TRANS-01	AI disclosure: chat + voice	— / ASI09	conversation
GR-CONT-01	Content-harm policy (AILuminate 12 + TR) with tenant thresholds	LLM09 / ASI09	content.input, content.output, toxicity, topic, groundedness, language, image.content_safety, banlist, competitors
GR-OUT-01	Output handling: no raw HTML, code sandbox, schema validation	LLM05 / ASI05 / MCP05	code, schema, regex, secrets, file.analyze, file.type, file.active_content, yara
GR-INJ-02	Indirect injection from tool/RAG output: untrusted label, no new tool call without policy	LLM01, LLM08 / ASI01, ASI06 / MCP06, MCP10	injection.indirect, file.hidden_text

The full catalogue and evidence packs →

← Telecom Other sectors Energy & Critical Infrastructure →

See it in your own environment.

A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.

Request a demo → Read the docs info@thulpar.com