Skip to main content
FromNine
Menu

Healthcare & Life Sciences

Less paperwork, and the doctor still decides.

What we would build for hospital groups, diagnostic chains, generics and active pharmaceutical ingredient manufacturers and medical device makers: patient data handled as the DPDP Act expects, administrative AI that stays clear of clinical judgement, and validated systems that hold up in an EU inspection.

For hospital groups, diagnostic chains, pharmaceutical manufacturers and medical device makers in India, at home and in their export markets in Europe.

Share your requirementsRelated solutions
Laboratory glassware set out in a regular grid

  1. 11 August 2023

    DPDP Act published

    Digital personal data, including patient records held digitally, comes under one national law.

    SourceAct No. 22 of 2023 (opens external site)

  2. May 2027

    Data Fiduciary duties apply

    Notice, safeguards, breach intimation and retention rules reach hospitals and laboratories that process personal data digitally.

    SourceG.S.R. 846(E) (opens external site)

  3. 2 August 2028

    EU AI Act: AI in medical devices

    High-risk duties for AI in devices sold in the EU, under the 2026 amendment.

    SourceRegulation (EU) 2024/1689 (opens external site)

What is changing for Indian health and pharma organisations

  1. Patient data now has a national law

    The Digital Personal Data Protection Act, 2023 and its Rules bring notice, consent, security safeguards and breach intimation to organisations that process patient data digitally, with the Data Fiduciary duties applying from May 2027. Access boundaries and retention therefore have to be designed, not assumed.

    SourceAct No. 22 of 2023

  2. Administration takes clinical time

    Discharge summaries, insurance pre-authorisation, coding and referrals consume hours that belong to patients. Carefully bounded assistance can return some of that time, as long as the record remains the doctor’s own work.

  3. The device boundary matters to exporters

    Under the EU Medical Device Regulation (MDR), software that guides diagnosis or treatment may qualify as a device, and any AI within it is high-risk under the EU AI Act. Indian device makers selling into the EU must plan for both, and keeping administrative AI clearly outside that boundary is a deliberate design choice.

    SourceRegulation (EU) 2017/745

  4. Hospitals are a target

    Ransomware attacks on hospitals have shown the cost of recovery plans that were never tested. CERT-In expects listed cyber incidents to be reported within six hours, so segmentation and tested recovery belong in the architecture from day one.

Problems we are asked to solve

  1. The problem

    Doctors spend their evenings completing discharge summaries and notes.

    What we would do

    Assistance drafts discharge summaries and letters from the record and the doctor’s notes; the doctor corrects and signs, and nothing unsigned is filed.

  2. The problem

    Referrals, prescriptions and insurance forms arrive in every possible format.

    What we would do

    Intake processing classifies each document, extracts the clinical question or the claim details and marks what is missing so staff can chase it, all with an audit trail.

  3. The problem

    Hospital, laboratory and pharmacy systems do not share a language.

    What we would do

    Integration on HL7 FHIR, using SNOMED CT for clinical terms, built as reusable interfaces rather than a separate link for each pair of systems.

  4. The problem

    Research and analytics teams wait months for data they can use.

    What we would do

    Pipelines that pseudonymise records, document lineage, tag purpose and control access, so each dataset carries the purpose it may serve under the DPDP Act.

  5. The problem

    Validation slows every change at a plant that supplies EU markets.

    What we would do

    Validation scaled to risk on GAMP 5 principles, with automated tests and requirements traceable to them, so the evidence ships with each release rather than following it.

  6. The problem

    Quality, regulatory and medical knowledge is buried in thousands of controlled documents.

    What we would do

    Search across SOPs, batch records, labels and regulatory letters that always points to the approved version of its source.

Three zones over one data layer

Administrative support, clinical decision support and secondary use stay separate by design, each with its own rules, approvals and evidence, over a shared interoperability layer.

Illustrative example
ADMINISTRATIVE SUPPORTCLINICAL DECISION SUPPORTSECONDARY USEDischarge and letter draftsCoding, referrals andpre-authorisationDoctor’s sign-offValidated separately as amedical device (EU MDR,AI Act high-risk)Approval for the stated purposeSecure processing environmentResearch and registriesInteroperability layer: HL7 FHIR, SNOMED CTHospital information and clinical systems
Administrative AI, clinical decision support and secondary use, separated

Our assistance stays in the administrative zone. Clinical decision support follows a medical-device route.

Read the diagram as text

One interoperability layer, built on HL7 FHIR and SNOMED CT, links three zones to the hospital information and clinical systems.

The administrative support zone holds discharge and letter drafts and the intake of coding, referrals and pre-authorisation. Nothing is written to the record until the doctor signs it off.

Clinical decision support is a separate zone: software of that kind goes through its own validation as a medical device under the EU MDR, and the EU AI Act classes it as high-risk.

Secondary use begins with approval for a stated purpose (for EU data, a permit from a health data access body). Processing happens inside a secure environment, and research teams and registries receive the results.

  • The doctor signs

    Drafts and suggestions never reach the record without approval from a named doctor.

  • A firm device boundary

    Once a feature starts to steer diagnosis or treatment, it leaves the administrative track and is developed as a medical device, never slipped in as an update.

  • Standards, not one-off links

    FHIR resources and shared terminology replace bespoke point-to-point interfaces.

  • Secondary use for a recorded purpose

    Research data is pseudonymised and released for a recorded purpose only; EU data also needs a permit and a secure processing environment.

EU dates for Indian exporters and health software vendors

These dates bind products and services on the EU market, and for some the detail still waits on implementing acts. India’s own DPDP dates are at the top of this page.

  1. In force

    MDR: EU device rules apply

    Including the rules under which some software becomes a medical device.

  2. In force

    NIS2: Member State NIS2 laws take effect

    Healthcare providers in the EU come within scope.

  3. In force

    EHDS: Health data regulation enters into force

  4. In force

    EU GMP: Draft Annex 11 and new Annex 22 on AI

    The consultation has closed; the final texts were not adopted at the status date.

  5. Position on 2 October 2026

  6. Ahead

    EHDS: Regulation applies generally

    Implementing acts fix the detailed formats.

  7. Ahead

    MDR: First deadline for legacy devices

    Covers class III and implantable class IIb devices, while a targeted MDR revision is debated.

  8. Ahead

    AI Act: Duties for AI in regulated products

    Applies to AI in medical devices, following the 2026 amendment.

  9. Ahead

    EHDS: First priority categories exchanged

    Patient summaries and ePrescriptions move first; health data access bodies start operating.

  10. Ahead

    EHDS: Further categories exchanged

    Imaging, lab results and discharge reports follow.

Rules behind a health or pharma specification

EU instruments that reach Indian exporters, software vendors and groups with European operations. Each entry says when it applies to you and how it sits next to Indian law.

Planning orientation only, not legal, regulatory or medical advice. Indian rules are summarised as they stood on 6 November 2026; EU dates checked on 2 October 2026.

GDPR: health data as a special categoryScopeEU instrument

Under Article 9, EU law treats health and genetic data as special categories that may be processed only on a specific legal ground, and processing them at scale normally calls for an impact assessment. An Indian company falls within the GDPR when it offers services to people in the EU or monitors them there (Article 3(2)).

How it affects you

At home, the DPDP Act and Rules govern patient data, most duties from May 2027. Who may see which record, how identities are masked and how long data is kept are settled before build, and we provide the technical input for an impact assessment under either law.

SourceRegulation (EU) 2016/679, EUR-Lex (opens external site)

European Health Data SpaceScopeEU instrument

Grants people in the EU electronic access to their own health records, defines a shared European exchange format with requirements for EHR systems, and opens regulated research access through health data access bodies. Its duties phase in between 2027 and 2031.

How it affects you

It matters to Indian vendors of hospital information or EHR software with European customers: data exposed in standard formats and access logged today avoid a rebuild later.

SourceRegulation (EU) 2025/327, EUR-Lex (opens external site)

Medical Device Regulation (MDR)ScopeEU instrument

In the EU, software meant to diagnose, prevent, monitor or treat can qualify as a medical device, generally class IIa or above under the classification rule for software. Indian manufacturers reach European patients through this regime; Regulation (EU) 2023/607 gave legacy devices longer transition periods.

How it affects you

Intended purpose is written down at the start. Administrative tools are built to remain outside the device definition; device software is developed under a regulated lifecycle with its own technical file.

SourceRegulation (EU) 2017/745, EUR-Lex (opens external site)

EU AI ActScopeEU instrument

AI that is itself a medical device, or protects the safety of one, counts as high-risk. Under the 2026 amendment those duties start on 2 August 2028, in step with the MDR conformity route. A provider based in India is covered once it places such a system on the EU market (Article 2(1)(a)), and must first name an authorised representative in the Union (Article 22(1)).

How it affects you

Where AI rules and device rules meet, one technical file should serve both. We plan it that way from the first sprint.

SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)

EU GMP Annex 11 and GAMP 5ScopeEU instrument

Annex 11 is the EU rule for computerised systems used in GMP manufacturing, relevant to Indian plants that supply medicines to the EU, and GAMP 5 is the industry’s guide to validating them by risk. Drafts of a revised Annex 11 and of a new Annex 22 covering AI appeared in July 2025.

How it affects you

Validation runs inside the delivery pipeline: every requirement linked to a test, evidence produced per release, and each AI use case checked against draft Annex 22.

SourceEudraLex Volume 4, European Commission (opens external site)

NIS2 for healthcareScopeEU instrument

Hospitals and other healthcare providers in the EU, EU reference laboratories and makers of certain medical products fall within it, with duties covering risk management, incident reporting and supplier security. An Indian supplier meets it through the contracts of its European customers.

How it affects you

At home, CERT-In’s six-hour reporting already covers listed incidents. Network segmentation, backups and recovery drills are built into our designs, and as a supplier we feed your incident reports.

SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)

Illustrative use cases

Illustrative example

  1. Discharge summary drafting

    A draft summary assembled from the record and notes, which the treating doctor corrects and signs.

    Document intelligence

  2. Referral and pre-authorisation intake

    Referrals and insurance pre-authorisation requests sorted and checked, with missing papers requested before anyone reviews them.

    Document intelligence

  3. Pharmacovigilance case intake

    Adverse event reports turned into structured cases for a generics manufacturer; safety specialists assess every report.

    Document intelligence

  4. SOP and validation record search

    Answers from approved SOPs and validation records at a pharma plant, always citing the version currently in force.

    Enterprise knowledge

  5. Patient service at a diagnostic chain

    An assistant for bookings, report availability and general questions; any medical question goes to staff.

    Service assistance

Platforms in healthcare and pharma

  • Salesforce

    Summit Partner

    Patient service, medical representatives and partner programmes for hospital groups and pharma companies, while clinical data stays in the clinical systems.

  • SAP

    Gold Partner

    Batch management, supply chain and finance for pharmaceutical plants, linked to quality and validation and to GST e-invoicing for domestic sales.

Partner tiers shown are FromNine’s own. Product names belong to their respective owners.

India

DPDP at home, EU rules for what you export

In India, the DPDP Act and Rules govern digital patient data, with the Data Fiduciary duties applying from May 2027, and CERT-In’s six-hour reporting covers listed cyber incidents.

Indian manufacturers and software vendors selling into the EU meet the MDR, EU GMP, the AI Act and, for health data of people there, the GDPR. We design data flows and validation once, with the Indian and European evidence documented side by side, so that entering a further market means new interfaces, not a new system.

Frequently asked questions

Will an AI assistant make our software a medical device?

It turns on the intended purpose. Assistants for notes, coding or intake are built to remain administrative, and a doctor approves each output. Should a feature start to guide diagnosis or treatment, we raise it at once and plan the device route for each market you sell into.

Where would patient data be processed?

Wherever your legal basis and internal policies permit, typically your own environment or a cloud region you select, with the encryption keys in your hands. Before build we document flows, retention and access against the DPDP Rules and, for patients in the EU, the GDPR.

Do you build integrations on FHIR?

Yes. Integration is designed on HL7 FHIR with common clinical terminology, so that it can later link to national health platforms and, for European customers, to the EU exchange format, without proprietary interfaces.

How do you approach validation in GxP environments?

Scaled to risk, on GAMP 5 principles: each requirement linked to an automated test, evidence produced per release, and change control your quality unit can walk an inspector through.

What happens when the AI is wrong?

Sometimes it will be. So drafts are never filed without the doctor’s signature, low-confidence extractions are sent for review, and quality is checked against the agreed test sets ahead of and after every release.

Discuss your hospital or pharma programme

Reducing documentation load, preparing patient data flows for May 2027 or renewing a validated system for an EU market? Begin with one workflow and the rules that govern it.

Share your requirementsEnterprise knowledge