Your industry: Dentists and healthcare practices
Tailored to medical, dental, physio and psychotherapy practices: the recommendations of the FMH and SSO require processing in CH/EU/EEA and no provider access to the data, and professional secrecy (Art. 321 Criminal Code) is factored in. The rating is therefore stricter for identifiable patient data.
Works with client data: the setup is proven, contract and governance are in place. This is exactly how you should do it.
Depends on the contract, configuration and industry: feasible with a documented risk assessment, not without it.
Not defensible for client data in our risk assessment: no contract, no control or no documented safeguards. Often still the best choice for research, marketing and anonymised content.
In the practices view: Azure Switzerland Standard is green only with Modified Abuse Monitoring and store=false; without these approvals it turns yellow, because Microsoft can otherwise store flagged samples that authorised staff may review. The EU options turn red for identifiable patient data: in practice data almost everything is health data, free text can hardly be pseudonymised reliably, and breaching professional secrecy (Art. 321 Criminal Code) carries a custodial sentence of up to three years or a monetary penalty. They stay yellow only for fully anonymised content.
Filter the table by traffic-light colour. On a smartphone it scrolls sideways.
| Solution | Client data | Models | Data location | Model quality | Effort | Cost | What to watch |
|---|---|---|---|---|---|---|---|
Azure OpenAI Switzerland (Standard) Microsoft Azure, Switzerland North region | Green | GPT-4o (until April 2027), Embeddings | Processing Switzerland Storage Switzerland | Solid, several generations behind the frontier | Medium, integration by IT or partner | Low, per token, no base fee | The reference choice for patient data, but green only with two approvals: apply for Modified Abuse Monitoring (without it Microsoft stores flagged samples that authorised staff may review; with ContentLogging=false this is verifiably disabled) and store=false. Without both, yellow applies. Only managed customers can apply with Microsoft, we clarify this for our practice customers. Choose the Standard deployment type (not Global or Data Zone), commissioned processing contract, confidentiality of all auxiliaries (Art. 321 Criminal Code). For new customers, GPT-4o (until April 2027) is effectively the only option; GPT-4.1 is deprecated. |
Swiss AI platforms e.g. AIgent, Swisscom, Phoenix Technologies (kvant), Infomaniak | Green | Open models such as DeepSeek, Qwen, GLM, Apertus | Processing Switzerland Storage Switzerland | Good to very good, a step behind the frontier | Low, ready-made interface, some with agents | Medium, licence per user, sometimes plus usage | A straightforward compliant choice for patient data: processing and storage stay in Switzerland. Name confidential computing as a review point: providers such as Phoenix Technologies use it to protect data even during processing, which comes closest to the FMH requirement of no provider access. |
AI in your industry software e.g. practice, law firm, CRM or portfolio systems | Depends on provider | Usually GPT or Claude in the background | Processing Depends on provider Storage Depends on provider | Good, tailored to the use case | Low, the system is already in use | Low to medium, often as an add-on module | Practice software: clarify in writing which model runs where and pass the FMH requirements on to the vendor. Also clarify the medical device status: diagnostics, such as X-ray analysis, only with certified software (MedDO or MDR); general AI models only for administration, correspondence and drafts. |
Microsoft 365 Copilot Microsoft, with EU Data Boundary | Yellow | GPT models from OpenAI, operated by Microsoft | Processing EU/EFTA Storage Switzerland (Data Location or ADR) | Very good, strong in everyday office work | Low, licence and configuration | Medium, licence per user and month | Only with a commissioned processing contract, Flex Routing disabled, Anthropic models switched off and permissions cleaned up. The FMH and SSO recommendations require processing in CH/EU/EEA and no provider access to the data. |
Azure OpenAI Data Zone EU Microsoft Azure, resource in Switzerland North | Red | Latest GPT generation, e.g. GPT-5.4 to GPT-6.1 | Processing EU Data Boundary, confirm countries with Microsoft before use Storage Switzerland | Frontier, latest GPT models | Medium, integration by IT or partner | Low, per token | Red for identifiable patient data: the region would comply with FMH guidance, but breaching professional secrecy (Art. 321 Criminal Code) carries a custodial sentence of up to three years or a monetary penalty, and free text can hardly be pseudonymised reliably. Yellow only for fully anonymised content. The EU Data Boundary can also include EFTA countries: confirm the affected countries with Microsoft before use. |
Claude via AWS Bedrock (EU) Amazon Web Services, EU regions | Red | Opus 5 and Sonnet 5 in Ireland or Stockholm, Opus 5.5 and Sonnet 5.5 via EU inference | Processing EU Storage No prompt storage by Bedrock | Frontier, especially strong for text and analysis | Medium to high, AWS account and development needed | Low to medium, per token | Like Data Zone EU: red for identifiable patient data, yellow only for fully anonymised content; also review the AWS sub-processing. |
Gemini via Google Vertex AI (EU) Google Cloud, EU regions | Red | Gemini models | Processing EU Storage EU or Switzerland | Frontier, strong with long documents | Medium to high, Google Cloud project and development | Low to medium, per token | Like Data Zone EU; have the processing location verified in writing. Red for identifiable patient data, yellow only for fully anonymised content. |
Claude directly from Anthropic Claude API, Team and Enterprise | Red | Claude Fable 5.1, Opus 5.5, Sonnet 5.5 | Processing US or global Storage US | Frontier, newest Claude models first | Low, ready to use | Medium, licence or per token | US processing is outside the permitted regions and endangers professional secrecy (Art. 321 Criminal Code): unsuitable for patient data. |
Claude in Microsoft Foundry or Copilot Microsoft, operated on Anthropic infrastructure | Red | Claude models | Processing Outside the EU Data Boundary Storage Not guaranteed | Frontier, same as Claude direct | Low, switchable at a toggle | Medium, in licence or per token | Processing outside the EU: unsuitable for patient data, keep the switch off. |
Copilot with Flex Routing enabled Microsoft 365, setting available since April 2026 | Red | GPT models | Processing At peak load also US, Canada, Australia Storage Switzerland | Very good, same as Copilot | Low, a single setting | Medium, licence per user and month | Practices must disable this: peak-load processing in the US/Canada/Australia breaches the FMH and SSO region rule. |
Private AI accounts ChatGPT, Claude.ai, Gemini with a private or free account | Red | All of them | Processing Unclear, mostly US Storage US | Frontier, which makes it so tempting | None, and that is exactly the problem | Low, free or privately paid | Criminally punishable with patient data (Art. 321 Criminal Code, custodial sentence of up to three years or a monetary penalty): prohibit by policy, offer a compliant alternative. |
Microsoft, AWS and Google are US corporations and are subject to the US CLOUD Act, even with data centres in Switzerland or the EU. This residual risk belongs in every risk assessment.
Hardly any organisation needs just one tool. What has proven itself is the combination of an AI employee for daily work and a secure interface for automations.
For practices we recommend the strict setup: a Swiss platform, ideally with confidential computing, plus Azure Switzerland Standard with Modified Abuse Monitoring. Patient data stays in Switzerland end to end, which satisfies the FMH and SSO recommendations most easily. Provisioned with GPT-5.1 is uneconomical for any practice (from approx. USD 13,000 per month).
Patient data is especially sensitive personal data under the revised DPA and is subject to professional secrecy under Art. 321 of the Criminal Code, which since 1937 has grown to cover far more professions, including physio- and psychotherapy. The FMH and SSO recommendations on IT in the practice and the documentation and retention duties under cantonal health law apply regardless of the technology.
This overview does not replace legal advice. Model availability and regions change constantly; October 2026 edition. Verify details with the provider before use.
Taskstreams builds and operates the pipeline that fits your policy: Switzerland only with Azure OpenAI Switzerland North, or the frontier model in the EU while your client data stays in Switzerland. Contract and governance are included; you receive finished AI employees for your processes, from document review to client reporting, instead of your own infrastructure project.