INDUSTRIES · HEALTHCARE
Patient records handled inside your perimeter, with the clinician in charge.
Administrative and documentation work done inside your perimeter, with patient identifiers masked before a model reads them and a recorded trail behind every step. Support for the people who decide, never a diagnosis.
IN SHORT
For hospitals, laboratories and health-tech firms, AgentAnywhere is designed to run inside your own perimeter. Aavaran, our data-masking layer, masks patient identifiers before a model reads them, Manthan reads long files and drafts summaries and letters for a clinician or an administrator to review, Seva assists patient-service desks, AgentAnywhere Vaani is designed to take voice notes in Indian languages on Indian infrastructure, and every step is recorded. We offer support for the people who decide, not diagnosis or treatment, and software that aids diagnosis can be regulated as a medical device.
01 · A record is a person's health
Reports, discharge files and bills hold the most private details a person has. From May 2027 hospitals and health-tech firms carry the DPDP duties as data fiduciaries.
02 · Some software becomes a device
CDSCO's guidance says software that meets the Medical Devices Rules 2017 definition is regulated as a medical device. Each feature has to be placed on one side of that line.
03 · Staff use what they can check
An assistant is useful on a busy ward only when its output can be read against the source and corrected by the person who owns the decision.
WHY IT FITS
Sovereign, our models, and the Trust Platform.
Three things, in the terms of healthcare: where it runs and who controls it, which models do the work, and the controls and the record around every call.
01 · Sovereignty
Patient records are processed where the hospital runs its other systems.
- Inside your perimeter: your own cloud account in an Indian region, or your own hardware. Region-pinned, and designed to deploy air-gapped.
- Swaraj, the sovereign deployment, is designed to pin a deployment to the region you choose.
- It runs under your governance. You decide which documents, which staff and which desks it serves.
02 · Our models
The line we select, measure and serve, for administrative and documentation work.
- Manthan reads long documents and drafts summaries, letters and options for a person to decide on, in English and Indian languages.
- Seva assists a patient-service desk. AgentAnywhere Vaani is designed to take voice notes in Indian languages; its masking, routing and tally are ours, and speech recognition and synthesis are open-licensed external components used for now.
- Manthan, Seva and Taksha are built on open foundation models, measured and served by us. None of them diagnoses or recommends treatment. You can bring your own open model.
03 · The Trust Platform
Controls around every call, and a record the hospital keeps.
- Aavaran masks patient identifiers before a model reads them, with a signed Trust Receipt for each masking call.
- Kavach is designed to screen each request for prompt injection and unsafe output. The Agent Gateway applies your policy at the point of the call.
- Every step is recorded, in a trail you can query and export as CSV.
INSIDE YOUR PERIMETER
What happens to one patient's request.
Follow one request from the moment it arrives to the receipt an auditor can check. Raw values are designed not to cross the boundary.
One request · start to receipt
Illustration
Your perimeter · your cloud, your region, or designed to deploy air-gapped
Step 1 of 5
A request arrives
A question comes in. It carries a name, an account, a card number: the things that must not travel.
THE RULES
The rules that bind you.
What each instrument requires in plain words, where it stands today, and what it means for AI in healthcare. Dates that have not arrived are written as dates.
What it requires
Commenced on 13 November 2025; sections 3 to 17 and most duties start 18 months after publication, about May 2027. Section 8(5): protect personal data, including data with a processor, by reasonable security safeguards.
What it means for AI
The duties apply to hospitals and health-tech firms as data fiduciaries. A model host is a processor, and masking before the model reads is one safeguard you can show.
What it requires
Rule 7(2)(b): a fuller breach report within 72 hours. Rule 6(1)(e): logs and personal data kept one year.
What it means for AI
After a breach you will need to say what the AI read and did. A recorded trail you can query gives you that timeline; the report is yours to file.
What it requires
Government may restrict transfers of personal data to notified countries, and may require Significant Data Fiduciaries to keep specified data in India.
What it means for AI
As far as we read, no list or categories have been notified. A deployment that runs in India, region-pinned, is ready if one is.
CDSCO Guidance Document on Medical Device Software, CDSCO/MD/GD/MDSW/01/2026
Guidance, non-binding
What it requires
Non-binding guidance. Software that meets the Medical Devices Rules 2017 definition is regulated as a medical device. Hospital and lab information systems are not devices unless they add medical functions, such as image analysis as an aid in diagnosis.
What it means for AI
Software that aids diagnosis can be a regulated medical device. That is not what we offer. Our work is administrative and documentation support that a clinician reads and decides on.
What it requires
Report listed incidents within 6 hours of noticing. Keep ICT logs for a rolling 180 days within Indian jurisdiction.
What it means for AI
An AI system produces ICT logs. A recorded trail that stays in your deployment is the material for the log duty. Reporting stays with you.
What it requires
Guidance. No separate AI law is needed at this stage; existing laws govern AI.
What it means for AI
The rules above apply to an AI system as they apply to any other system in the hospital.
This is what the rules say, not legal advice. Your compliance function owns the reading and the filing.
USE CASES · BY FAMILY
What runs inside a hospital or a laboratory.
Each card opens the page for that family or machine. Tell us your setting and we will show you the closest demonstration.
WORK SCENES
What it looks like on a working day.
The problem, what runs, and what the person at the desk gets. Each scene is an illustration of how the work is designed to go, not a customer account.
Scene 01
A discharge file for the insurance desk
The problem
- An insurance desk reads a long discharge file to answer an insurer's query.
What runs
- Aavaran masks the patient identifiers, and Manthan summarises the file.
What they get
- The staff member reads a summary with the source file beside it, corrects it and sends the reply.
Scene 02
A referral letter to draft
The problem
- A clinician has notes and little time to write the letter.
What runs
- Manthan drafts the letter from the notes the clinician supplies, inside your perimeter.
What they get
- The clinician edits and signs, and the drafting step is recorded.
Scene 03
Billing and appointment queries
The problem
- The patient-service desk answers the same questions all day, with personal details in each.
What runs
- Seva returns a summary, compliance flags and a suggested reply, and Aavaran masks the identifiers first.
What they get
- The desk agent uses or edits the reply, and the supervisor sees a quality scorecard.
Scene 04
An appointment line in the patient's language
The problem
- Patients leave voice notes in their own language, and the recording is sensitive.
What runs
- AgentAnywhere Vaani is designed to understand, mask, classify and route each note on Indian infrastructure.
What they get
- The right desk receives a masked, categorised request, and uncertain or urgent notes go to a person.
Scene 05
Hospital software on your own network
The problem
- The hospital's own software cannot be sent to an outside tool.
What runs
- Taksha works on your own network, and an independent referee checks each claimed success.
What they get
- Your engineers receive each change with the referee's verdict, and your release process decides what ships.
THE SOVEREIGNTY TEST
The sovereignty test, for healthcare.
If an AI system cannot answer these from its own records, you are renting it. Beside each question: what a rented AI service usually answers, and how we answer. Read the test.
01Where does the data run?
What a rented AI service usually answers
“In a region near you, per the contract.” The vendor decides when the model changes.
How we answer
Inside your perimeter: your cloud in an Indian region or your own hardware, region-pinned and designed to deploy air-gapped.
02Which model made that decision?
What a rented AI service usually answers
“The AI.”
How we answer
Model Hub is designed to register each model with an owner and lineage. Manthan, Seva and Taksha are built on open foundation models, measured and served by us.
03What did the model actually see?
What a rented AI service usually answers
The full patient record, name and phone number included.
How we answer
Aavaran masks patient identifiers before the model reads them, with a signed Trust Receipt for each masking call.
04What stops the agent doing harm?
What a rented AI service usually answers
A prompt that asks the model to be careful with health data.
How we answer
A policy outside the model. Kavach is designed to screen each request for prompt injection and unsafe output, and the Agent Gateway applies your policy at the point of the call.
05Who approved the consequential step?
What a rented AI service usually answers
“The system.”
How we answer
A named clinician or administrator reads, edits and signs, and the step is recorded. We offer support for the person who decides, not a diagnosis.
06What will you show the regulator?
What a rented AI service usually answers
A slide on data protection.
How we answer
A recorded trail, queryable and exportable as CSV, with a signed Trust Receipt for each masking call. Your compliance function owns the filing.
STATED PLAINLY
What this is not.
- Software that aids diagnosis can be regulated as a medical device, under CDSCO's guidance on medical device software. That is not what we offer. Nothing here diagnoses, or recommends or plans treatment.
- Whether a feature is a medical device is a question for you and the CDSCO guidance. We keep our work to administrative and documentation support that a clinician reads and decides on.
- A model's output supports a person. The clinician or the administrator edits it, decides and signs.
- Seva is shown on synthetic conversations. AgentAnywhere Vaani is shown without accuracy figures, and its first pilot deployment is being built.
- Masking reduces what a model reads. It does not take data outside any law, and your compliance function owns that view.
THE OFFER · THE SOVEREIGN PILOT
Bring your hardest workload. We come to your data.
Pick the one workload your risk committee keeps deferring because the data cannot go anywhere. We run the pilot where the data already sits, with our architects beside your team, and you decide at the end whether it goes live.
For hospitals, laboratories and health-tech firms: bring the administrative workload your privacy officer worries about, such as discharge files for the insurance desk or an appointment line. We stay on the administrative side of the line.
What the pilot is
- One workload, one team, six to ten weeks.
- A sovereign environment by default.
- Solutions Architecture paired with your team for the duration.
- It ends with one agent in production under your governance, or a documented decision not to proceed.
What we add
- The Trust Platform is on from the first call: data masking, policy screening, the Agent Gateway and a recorded trail.
- The record stays with you and is exportable as CSV.
- You can bring your own open model.
- A reply within one business day.
A risk committee has no reason to refuse, because the data does not have to go anywhere to find out. The pilot ends one of two ways: one agent in production under your governance, or a documented decision not to proceed, with the record behind it.
FAQ
Frequently asked questions.
- Can a hospital use AI on patient records without sending them abroad?
- Yes. AgentAnywhere is designed to run inside your perimeter, in your cloud account in an Indian region or on your own hardware, region-pinned and designed to deploy air-gapped. Aavaran masks patient identifiers before a model reads them, and every step is recorded.
- Does the DPDP Act apply to hospitals?
- Yes, as data fiduciaries, from May 2027. Most duties start about 18 months after the commencement notified on 13 November 2025. Section 8(5) asks for reasonable security safeguards, rule 7(2)(b) for a fuller breach report within 72 hours, and rule 6(1)(e) for logs and personal data to be kept one year.
- When is software a medical device in India?
- CDSCO's guidance document CDSCO/MD/GD/MDSW/01/2026, which is non-binding, says software that meets the Medical Devices Rules 2017 definition is regulated as a medical device. Hospital and lab information systems are not devices unless they add medical functions, such as image analysis as an aid in diagnosis.
- Does AgentAnywhere diagnose or recommend treatment?
- No. Software that aids diagnosis can be a regulated medical device, and that is not what we offer. Our models support administrative and documentation work that a clinician or an administrator reads, edits and signs.
- What healthcare work can Manthan do?
- Manthan reads long documents and drafts summaries, letters and options for a person to review, in English and Indian languages, inside your perimeter. It is built on open foundation models, measured and served by us. It does not diagnose.
- How are patient identifiers protected before a model reads them?
- Aavaran detects names, contacts, health identifiers and the fields your policy designates on each call and masks them before the model reads the raw value, with a signed Trust Receipt for each masking call. Masking reduces what a model reads; it does not take data outside any law.
- What record does a hospital get of what the AI did?
- Every step is recorded, each masking call carries a signed Trust Receipt, and the trail is queryable and exportable as CSV. Your compliance function owns the filing.
- What does the Sovereign Pilot involve for a hospital?
- One workload, one team, six to ten weeks, in a sovereign environment, with Solutions Architecture paired with your team. The Trust Platform is on from the first call, the record stays with you and is exportable as CSV, and it ends with one agent in production under your governance or a documented decision not to proceed.
Bring your hardest workload.
We come to your data. One workload, one team, six to ten weeks, in a sovereign environment. Tell us the workload and a solutions architect will reach out within one business day.