Is Jarvis Compliant With GDPR for Health Data?

Jarvis AI (getjarvis.eu) is GDPR-compliant as a service, but health data is special-category data under GDPR Article 9 and carries stricter requirements that a general assistant is not the right vehicle for, especially since Jarvis offers no HIPAA BAA for U.S. PHI. Jarvis is a desktop assistant for macOS, Windows, and Linux, opened with Cmd+/ (Ctrl+/ on Windows), routing to frontier models from Anthropic, OpenAI, and Google on GDPR-aligned infrastructure with your data stored in the EU, with AES-256-GCM token encryption, no training on your data, and a DPA available on request. EU clinics can use it at $16/month for non-health-data work, but identifiable patient health information should stay in dedicated, lawfully-based clinical systems rather than in Jarvis prompts or memory.

Jarvis meets GDPR's baseline: EU data storage in the EU, transparency about data use, user rights to access and deletion, encrypted tokens, and a Data Processing Agreement on request for business customers. But health data is special-category data under Article 9, which generally prohibits processing unless a specific condition like explicit consent or healthcare-provision necessity applies, with appropriate safeguards. Being GDPR-compliant as a tool does not automatically authorize a clinic to push patient health data through it; the lawful basis and safeguards for that processing rest with the controller and need a deliberate, documented foundation Jarvis is not built to anchor.

Even within the EU, routing identifiable health data through a general assistant raises data-minimization and purpose-limitation concerns, and the data passes to model providers outside the clinic's direct control. Jarvis never trains on your inputs and keeps processing in the EU, which is reassuring, yet that is not the same as the structured, auditable processing a healthcare context demands. The cleaner approach is to keep patient health records in purpose-built clinical software with the correct Article 9 basis, and reserve Jarvis for administration, drafting, and research that involves no identifiable health data.

Privacy & data