AI in UK Healthcare: What to Check Before You Buy

Scope of this guide

This is a buyer's checklist for UK healthcare organizations considering an AI product. It sets out what the UK regulator and NHS England say, cites each source, and turns it into questions you can put to a supplier. Every rule quoted below was checked against the regulator's own page on 2 October 2026; check the current version before you rely on it. This is general information, not legal advice.

Health data is special category data

Under UK GDPR, the ICO lists "data concerning health" as special category data, and defines it as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status." The ICO notes this covers a broad range of information, from diagnoses and test results to appointment details. An AI system that touches any of it is handling the most sensitive category the law recognizes.

What the ICO's AI guidance asks of you

The ICO's guidance on AI and data protection is organized around questions an organization has to be able to answer. They include accountability and governance (with data protection impact assessments), lawfulness (including special category data), transparency, accuracy and statistical accuracy, fairness, security and data minimization, and individual rights, including the safeguards around automated decision-making under Article 22.

NHS England's DTAC

NHS England's Digital Technology Assessment Criteria (DTAC) is an assessment framework that healthcare organizations use when assuring digital health technologies at the point of procurement. Ask any supplier whether it has completed it, and ask to see the result.

Questions to ask an AI supplier

• Which categories of personal data does the system process, and does that include data concerning health?
• Has a data protection impact assessment been completed, and can we see it?
• Where is data stored and processed, and by whom, including sub-processors?
• What is the lawful basis and the condition for processing special category data, and who is the controller?
• How is the accuracy of outputs measured and monitored, and what happens when the system is wrong?
• Can a person challenge or request human review of an outcome that affects them?
• Has the product been through DTAC, and when?

If the supplier is outside the UK

The ICO says a transfer is restricted when UK GDPR applies to the processing, you send the information to an organization outside the UK, and that organization is a separate legal entity. Every restricted transfer "must be covered by one of the following transfer mechanisms: UK adequacy regulations; appropriate safeguards; or an exception." With appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum, you must also complete a transfer risk assessment. If none applies, the ICO says you must not make the transfer.

Where Zunkiree Labs fits

Zunkiree Labs builds custom AI systems (including RAG pipelines, LLM integration and intelligent automation), data systems, custom software, and web and mobile applications, and is based in Nepal. The full list is on the services page. Because Zunkiree Labs is based outside the UK, data it processes for a UK customer would normally be a restricted transfer, so one of the mechanisms above would need to be in place. Orca is Zunkiree Labs' intelligence and orchestration layer: it sits above the CRM, email and marketing tools an organization already uses and coordinates agent workflows across them, rather than replacing those tools. Orca is being provided to support use cases in hospitals, coordinating agent workflows across the systems and teams involved. Ask any supplier, including us, which certifications and assessments it holds.

Sources

• ICO: What is special category data? (updated 9 April 2024)
• ICO: Guidance on AI and data protection (last updated 15 March 2023)
• ICO: International transfers, a guide (updated 15 January 2026)
• NHS England: Digital Technology Assessment Criteria (DTAC)