Health data is sensitive personal data under PDPA Section 40, and since the 2024 Amendment, that obligation extends directly to processors, not just the healthcare provider. That makes compliance the starting constraint for healthcare AI, not a feature added later — getting it wrong isn't a UX problem, it's a regulatory one.
Teh Tarik Digital's healthcare AI work is built the other way around: architecture designed to the compliance requirement first, features second. This is the same approach behind NURI, our clinical AI platform — the depth of that work is what this page draws on.
Built for operators who need a straight answer on compliance before they'll take a second meeting — not a generic clinical-AI pitch. If a vendor can't tell you who's the Data Controller and who's the Processor before you've signed anything, that's not a detail to sort out later; it's the whole risk profile of the engagement.
Four capabilities, each one designed around the compliance obligation first — not retrofitted after the fact. That ordering isn't a nice-to-have in healthcare; it's the difference between a tool a compliance officer can actually sign off on and one that gets stuck in review for months while someone tries to reverse-engineer where the data actually goes.
Dictated notes structured into records automatically — built to retrieve and structure from your actual dictated notes, not locked to a single language or a fixed template.
Automated deterioration scoring (NEWS2-aligned) routed to the duty officer already defined in your escalation chain — the system flags and routes, it doesn't override clinical judgment.
Data Controller/Processor roles defined up front, not left for a Terms of Service page to sort out later; on-premise or Malaysian-region deployment; zero external data dependency by default.
Built around local documentation standards and clinical escalation patterns from the start — not a Western scribe tool with Malaysian terminology bolted on afterward.
The compliance question most vendors don't answer: before adopting any clinical AI tool, an operator needs a straight answer to who is the Data Controller, who is the Processor, what's the legal basis for processing sensitive personal data under s.40, and what happens on a breach under s.12B. Our NURI Privacy Notice answers all four in writing — worth reading even if you're evaluating a different vendor, as a benchmark for what a healthcare AI vendor should be able to tell you.
NURI is pre-pilot — we're not going to overstate where it stands. What's actually built (the sovereign LLM, voice engine, EWS analytics) and what's still ahead (HIS integration, the Q3 2027 pilot) are two different lists, and we're keeping them separate rather than blending them into one confident-sounding pitch.
Compliance gets architected before a single feature ships — not the other way around. A clinical AI tool built feature-first and patched for compliance later is a liability wearing a product's clothing; we start from the s.40 obligation and build the feature set inside that boundary.
Clinical workflow audit, data flow mapping, Controller/Processor role definition — this is the phase most vendors skip past to get to the demo, and it's the one that actually determines whether compliance holds up later.
On-premise or Malaysian-cloud deployment plan, PDPA s.40 legal-basis documentation — written and signed off before deployment, not assumed and revisited after a breach.
Voice documentation, escalation scoring, handover automation live on your systems — integrated with what you already run, not a separate tool your clinicians have to context-switch into.
Ongoing support under a defined processing agreement, not an open-ended SaaS relationship — the Controller/Processor split from stage one stays enforceable for the life of the engagement.
Not healthcare-specific, but the closest proof we have — compliance-grade document extraction under real regulatory pressure.
How we built a compliance-aware extraction pipeline with per-field confidence flagging — the same discipline sensitive healthcare data requires. Full case study →
The compliance questions that come first, every time — answered honestly, including where NURI is still pre-pilot. We'd rather you read a "not yet" here than find out the hard way after signing.