AI use policy for a healthcare-adjacent business

A wellbeing app, a nutrition coach, a care agency or a health technology start-up handles health information and uses AI tools on it without being a regulated clinic, and the law applies regardless: health data needs a condition before any tool touches it, software that gives medical advice may be a medical device, professionals carry their own duties, and a chatbot that discusses symptoms is the riskiest thing a business can deploy. The policy draws the lines, and the customer terms say what the business does and does not do. The business receives its AI use policy and the contract provisions that go with it within five working days for a fixed £995.

Who this is for

Wellbeing, fitness, nutrition and mental health apps, care agencies and health technology start-ups in England and Wales that hold health information and use AI tools.

What matters in a healthcare-adjacent AI use policy

What healthcare-adjacent means and why the rules bite anyway

A business is healthcare-adjacent when it holds information about people's physical or mental health (a fitness profile, a symptom log, a mood diary, a care plan) without providing regulated healthcare, and the rules on health data, on software as a medical device, on health claims and on any clinician the business employs apply to it as fully as to a hospital; the policy begins by mapping the health information the business holds and the AI tools that touch it.

Health data, the condition that must exist and the tools it may enter

any personal data that goes into an AI tool is being processed under the UK GDPR, which calls for a lawful basis, transparency to the individuals, an Article 28 agreement with the provider and an Article 35 impact assessment where the use bears on people, and health data is special category data under Article 9 that may be processed only under a condition (explicit consent for most consumer uses, or the health care condition in Schedule 1 to the Data Protection Act 2018 where a health professional is responsible); the policy requires health data to enter only tools under a data processing agreement with training excluded and retention limited, requires the condition to be recorded for each use and the impact assessment to exist, keeps health data out of consumer tools, and prohibits inferring health conditions from behaviour unless the business has a condition and has told the customer.

The line into medical advice and the device the business did not mean to make

Software intended for diagnosis, prevention, monitoring, prediction or treatment of a disease or injury is a medical device under the Medical Devices Regulations 2002 as the Medicines and Healthcare products Regulatory Agency applies them, and an AI feature that interprets symptoms, recommends treatment, adjusts a dose or flags a condition can bring a wellbeing app within the regime with conformity assessment and registration the business did not plan for; the policy draws the line (general wellbeing information on one side; anything that diagnoses, treats or tells an individual what their symptoms mean on the other), requires the regulatory classification of any health-related AI feature to be assessed before it is built or bought, and requires generated content about health to be reviewed by a qualified person and to carry the not-medical-advice statements the terms require.

Clinicians, professionals and the duties that follow them

A business that engages nurses, dietitians, physiotherapists, counsellors or other registered professionals brings their regulators' standards into the business, and those standards expect the professional to retain responsibility for the care and advice given; the policy requires any AI tool used by a professional to be approved by the business and by the professional's own judgement, requires outputs to be reviewed and owned by the professional, prohibits tools from making clinical decisions, and sets the record in the client file; where the business is registered with the Care Quality Commission under the Health and Social Care Act 2008, the regulator's expectations apply to the tools as to everything else.

Customers, consent and the chatbot that talks about symptoms

A chatbot that customers can ask about symptoms, conditions, medication or mental health is the highest-risk deployment a healthcare-adjacent business can make, because it gives individual health information to people who may act on it and may miss a crisis; the policy either prohibits such a chatbot or confines it to approved content with hard limits (no diagnosis, no medication advice, crisis escalation to a person, clear statements that it is automated and not a clinician), requires explicit consent to the health data processing, requires the notice and the terms to describe it, and requires testing and monitoring; a decision about a person made solely by an AI tool with legal or similarly significant effects is governed by Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025, which permits it outside special category data only with safeguards (information, representations, human intervention, the right to contest), and for special category data the restriction is stricter still.

The contract provisions that go with the policy

The contract provisions drafted with the policy go into the customer terms (what the service is and is not, the automated features and their limits, the not-medical-advice statements, the explicit consent obtained separately, the route to a person), the supplier agreements with tool providers (health data, training excluded, retention, the regulatory status of any feature), the professionals' contracts, and the staff handbook; nothing confidential (trade secrets, clients' data, unreleased plans) goes into a tool whose terms let the provider train on or keep the input, because the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality obligations turn on the steps taken to keep it secret, and a customer's health record is the most confidential information the business holds; the policy is reviewed when features change and when the medical device regime changes.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

We are a wellbeing app, not a clinic. Do the health data rules apply to us?

They do. Mood diaries, symptom logs and dietary profiles are health data, special category under Article 9, needing a condition (usually explicit consent) before any tool processes them, an impact assessment and tools whose terms exclude training.

Could our AI feature be a medical device?

If it is intended to diagnose, monitor, predict, treat or tell an individual what their symptoms mean, it may be, with conformity assessment and registration to follow. The policy requires the classification to be assessed before the feature is built or bought and keeps wellbeing features on the right side of the line.

Can we offer a chatbot that answers health questions?

Only within hard limits: approved content, no diagnosis or medication advice, crisis escalation to a person, automated nature stated, explicit consent to the health data, testing and monitoring. Many businesses should not offer one at all, and the policy says which.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Privacy notice for a clinic or therapist
• AI use policy for a customer service team

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.