Why Swiss-hosted AI matters for medical data

A patient writes: "Since the new dose I get chest pain when I climb stairs. Should I stop taking it?" Somewhere, software has to decide whether that message goes to a nurse now, a pharmacist today, or the admin queue tomorrow. That is a perfect job for AI classification. It is also one of the most sensitive pieces of text a company can hold.

This article explains why where an AI model processes medical text matters, what "Swiss-hosted" and "zero data retention" mean in practice, and which questions to ask any AI vendor before sending it patient data.

The problem with "just call an AI API"

Most AI APIs are easy to use and hard to reason about from a data-protection point of view. When you send a patient message to a typical hosted model, you often do not know for certain:

• Where it is processed. Which country, and whether a failover can move it somewhere else.
• Whether it is stored. Many providers keep request logs for abuse monitoring or debugging, sometimes for weeks.
• Who can access it. Logs held by a provider can fall under that provider's home-country law.
• Whether it trains anything. Policies differ, and they change.

For marketing copy none of this matters much. For a message about chest pain and medication, each item is a question your data-protection officer will ask.

What "Swiss-hosted" means at Laya Studio

Laya Studio is a decision API: you send text plus typed questions (for example "Is this urgent?" or "Which team should handle this?") and get a calibrated probability for each answer. Here is exactly what we claim about where that happens, no more and no less:

• GPUs in Switzerland. The primary inference pool runs on dedicated GPUs located in Switzerland. Every API response states where it was processed, in the x-laya-region header.
• Swiss-only mode. One switch per workspace (or the x-laya-residency: ch header per request), and requests are only ever answered in Switzerland. If the Swiss pool is unavailable you get an error, never a silent detour abroad.
• Zero content retention. The text and questions you send are processed in memory and discarded when the answer is returned. They are never written to a database or log, and never used to train anything.
• Account data in Zurich. Accounts, API keys (stored only as SHA-256 hashes), credit balances and usage metadata live in a Postgres database in the AWS Zurich region (eu-central-2).
• Minimal metadata, 30 days. For billing and debugging we keep request metadata only (time, status, number of questions, latency) for 30 days. Daily totals are kept for invoicing.
• Encrypted in transit. All traffic uses TLS. The API gateway runs on Cloudflare's network, which forwards requests encrypted and does not store their content. The GPU servers accept requests only from our gateway.

You can see how a request travels, step by step, on the Swiss data residency page.

Why zero retention matters more than location

Location gets the headlines, but retention is the bigger risk-reducer. Data that is never stored cannot leak from a log, be subpoenaed from a backup, or be reused for training. A Swiss server that keeps every request for 90 days is a weaker promise than one that forgets the content the moment it answers.

Put the two together and you get a short, auditable story: the text is processed in Switzerland, in memory, and then it is gone. Only operational metadata remains.

Why a decision model suits sensitive text

The model matters too, not just the hosting.

It generates no text. Laya reads the message and returns probabilities over the answers you defined. It cannot write a paragraph that echoes the patient's details back into a log, a reply or a downstream system. It also cannot hallucinate a category that does not exist.

It gives you a confidence you can act on. In clinical triage, the right design is rarely "let the AI decide". It is "let the AI sort the clear cases and send the unclear ones to a person". Laya's probabilities are calibrated (expected calibration error 0.081 after temperature fitting), so a threshold like "auto-route above 0.9, otherwise human review" means what it says. See calibrated probabilities.

It is fast and cheap enough to run on every message. A warm request takes about 120 ms end to end from Europe, and pricing is per input token at $0.0294 per million, 30% below Jev, with 5 free runs to start (pricing). You can screen every inbound message, not a sample.

It handles many languages. Patients do not all write in English. Laya routes automatically between an English model and a multilingual model covering 100+ languages.

Typical uses in health and adjacent fields

• Patient message triage. Urgent / needs clinician / admin, plus a yes/no "mentions a possible adverse reaction?".
• Clinical intake routing. Send forms to the right specialty queue.
• Pharmacovigilance signal screening. Flag messages that may describe a side effect for human review.
• HR and legal case sorting. Other text that should not sit in a third party's logs.
• Insurance claim classification. Route claims and flag the ones that need a closer look.

In every case the model sorts and flags. It does not diagnose, and a qualified person stays in the loop for anything that matters.

What we do not claim

Honesty is part of the security story, so here are the limits:

• Laya Studio is designed to support compliance with the Swiss Federal Act on Data Protection (nFADP, in force since 1 September 2023) and the EU GDPR. A Data Processing Agreement is available on request at privacy@laya.studio.
• You remain responsible for your legal basis to process personal and health data.
• Laya Studio holds no formal certification (such as ISO 27001) today and does not sign HIPAA BAAs.

If your procurement process requires one of those certifications, we are not the right fit yet, and we would rather tell you now.

Questions to ask any AI vendor

Before you send patient data to any AI API, get written answers to these:

1. In which country are requests processed, and can a failover move them elsewhere?
2. Is request content written to disk, logs or backups? For how long?
3. Is any content used for training or evaluation?
4. What metadata is kept, and for how long?
5. Can I force a single region per request, and what happens if that region is down?
6. Which certifications do you actually hold today, and will you sign a DPA?

Any vendor that cannot answer these clearly should not receive a patient's message.

FAQ

Is Laya Studio HIPAA compliant?

Laya Studio does not sign HIPAA Business Associate Agreements and holds no formal certification such as ISO 27001 today. It is designed to support compliance with the Swiss nFADP and the EU GDPR, and a DPA is available on request.

Does Laya Studio store the text I send?

No. Request content is processed in memory and discarded when the answer is returned. It is never written to a database or log and never used for training. Only request metadata (time, status, number of questions, latency) is kept, for 30 days.

Can I guarantee a request never leaves Switzerland?

Yes. Turn on Swiss-only mode for your workspace, or send the x-laya-residency: ch header. If the Swiss pool is unavailable, the request fails instead of being processed abroad.

Can I try it with sample medical text?

Yes. The Laya Studio homepage shows real answers for synthetic example messages without an account, and after signing up your first 5 runs in the playground are free and processed in Switzerland. Use made-up examples, not real patient data, when testing any tool.