AI Safety & Governance

• AI proposes. Clinicians decide. Always.
• No autonomous clinical actions — ever.
• Conservative defaults: AI surfaces uncertainty rather than masking it.
• Every AI output is traceable to its inputs and model.
• Patient data is not used to train foundation models.

These rules apply to every AI feature in the platform, including AI Receptionist, AI web chat / WhatsApp / email, treatment-plan support, photo classification, clinical-note support, and operational analytics.

• Clinical AI surfaces require clinician sign-off before any record is finalised or any action is taken.
• Patient-facing AI agents escalate to humans on intent thresholds and on any clinical question.
• Operational AI (e.g. routing, summarisation) is auditable and reversible.

It is a hard policy that AI does not make clinical decisions, prescribe treatment, or take clinical actions on its own. Every clinical AI proposal is logged and requires sign-off. We will not ship a feature that breaks this rule.

• Customer patient data is not used to train foundation models.
• Tenant-specific tuning (e.g. brand voice for AI Receptionist) is opt-in and isolated to that tenant.
• Inputs to model providers are configured with training-on-input disabled where the option exists.
• Aggregated, de-identified telemetry may be used to evaluate and improve features.

Dentorb AI is being built around our custom-built, multimodal AI gateway, with OpenAI, Anthropic and Google as model providers. The gateway is designed to support text, image and audio workflows with the same human oversight and data-protection controls. Providers used for each released feature are disclosed on the Sub-processors page. Provider changes follow the sub-processor change process.

• Pre-release evaluation against safety, accuracy and bias test sets relevant to UK dental practice.
• Adversarial testing of patient-facing agents (jailbreaks, prompt injection, data exfiltration attempts).
• Continuous monitoring of failure cases with feedback loops into the test sets.

• Patients are told when they are interacting with an AI agent.
• AI-generated drafts are visibly labelled to staff before approval.
• Citations link AI outputs back to the source records they used.

An internal AI Safety Council reviews every clinical-touching feature before launch. Membership includes engineering, product, a clinical adviser and a data-protection lead. The Council can block a release.

If an AI feature behaves unsafely we follow our incident-response process. Material incidents are disclosed to affected customers within 72 hours, even when a quiet rollback would be possible.

The treating clinician remains the responsible decision-maker for clinical outcomes. dentorb's AI is decision-supporting, not decision-making, and our terms reflect that clearly.