// 6 apps · deploy as one
Medical Practice Stack
Patient document storage + OCR scanning + AI clinical assistant + audit logging + privacy passwords. Healthcare workflows under GDPR + national medical-records compliance.
What this stack is
Medical Practice Stack is a healthcare-grade document + AI workflow suite for clinics, medical practices, and small hospitals. One-click deploys patient document storage (Nextcloud), OCR scanning of medical records (Paperless), an AI clinical assistant (Open WebUI + Ollama), security monitoring + audit logging (Wazuh), and a credential vault (Vaultwarden) — all on a single VPS under the practice's own domain.
For the hosting provider, this is a vertical product that solves a critical healthcare problem: clinicians want AI for clinical note summarization, drug interaction checks, and document drafting, but cannot use ChatGPT, Copilot, Google Med-PaLM, or any cloud LLM with real patient data. This stack gives them AI without breaching healthcare data laws.
What it's for
- Patient records management — Nextcloud organizes patient folders, lab reports, imaging, consent forms with audit-logged access
- Paper records digitization — Paperless OCRs incoming faxes, lab reports, referral letters, auto-tags by patient ID
- AI clinical assistant — Open WebUI lets clinicians query Llama/Mistral about treatment protocols, drug interactions, differential diagnoses — with full RAG over the practice's own anonymized corpus, never leaves the VPS
- Security event monitoring — Wazuh tracks login attempts, file access patterns, anomaly detection, all logged for healthcare-grade audit
- Credential vault — Vaultwarden secures patient-portal logins, lab system credentials, pharmacy connections, with 2FA enforcement
- Audit-ready compliance — every patient record access, every AI prompt, every login event logged with full audit trail
Who it's for
- General-practice clinics (3-15 doctors) needing modern tooling under national healthcare data laws
- Specialist practices (cardiology, dermatology, psychiatry, etc.) with high-sensitivity records that must never touch SaaS clouds
- Dental practices wanting digital patient records + imaging + AI-assisted treatment planning
- Veterinary clinics — same data sensitivity needs minus the legal complexity
- Telemedicine practices in EU jurisdictions requiring full data residency on EU/national soil
- Mid-size hospitals (under 200 beds) wanting AI for triage + summarization without procuring enterprise EMR AI modules
Apps in this stack
| App | Role |
|---|---|
| Nextcloud | Patient folders, file sync, sharing, calendar, contacts, granular access control |
| Paperless | Medical document OCR, tagging by patient/date/type, full-text search |
| Open WebUI | Clinician-facing AI chat with RAG over practice's own anonymized corpus |
| Ollama | Local LLM runtime — Llama 3.3 + Mistral + medical-tuned variants (BioMistral) |
| Wazuh | Security monitoring, file integrity, anomaly detection, healthcare-grade audit log |
| Vaultwarden | Encrypted vault for portal credentials, lab logins, 2FA seeds |
Sizing & deployment
- Recommended VPS: 12 GB RAM, 6 vCPU, 300 GB NVMe storage (medical records grow fast)
- GPU optional — CPU-only inference works for clinical text. 13B models with 16GB RAM acceptable
- Encrypted at rest: VPS-level disk encryption mandatory; Nextcloud E2EE for highest-sensitivity records optional per folder
- Deploy time: ~30-35 min one-click, all SSL automatic via Let's Encrypt
- Backup profile: nightly encrypted off-VPS backup with 30-day retention minimum (required for most national healthcare regs) — Paperless + Nextcloud + Vaultwarden + Wazuh log archive
- Geographic isolation: deploy to a region matching the practice's national healthcare data law (Germany, France, Italy, Spain, etc.)
Why hosters sell this
Healthcare practices are highly price-tolerant for compliance but dramatically underserved by mainstream cloud — Microsoft, Google, AWS healthcare options start at thousands per month and require enterprise sales cycles. Sell this stack as a turnkey medical IT package.
Common resale shape:
- Solo practice tier — 1-3 practitioners, single VPS, CPU inference, mandatory off-VPS encrypted backup
- Group practice tier — 5-15 practitioners, larger VPS, GPU optional, dedicated support, SLA
- Mid-size clinic / specialist tier — 15-50 practitioners, dedicated VPS, GPU, white-label, named DPO contact, on-call SLA
Stack retail pricing is set by the hoster based on their cost stack (VPS + Bluix license + support + healthcare-specific operational overhead). See the suggested retail hint on this page as a starting anchor; refer to bluix.net/bluixapps.php for the Bluix module license layer.
Hosters can partner with regional medical-equipment vendors or dental/medical-software distributors for B2B distribution. National medical-association events yield high-quality leads at low conversion cost — compliance pain is universal and medical IT decision-makers convene in predictable channels.
GDPR & compliance profile
- Zero patient data leaves the VPS — no telemetry, no cloud LLM, no third-party processor in default config
- Audit log: every patient record access + every AI prompt + every login, with user identity, timestamp, IP, and Wazuh-validated integrity
- At-rest encryption: VPS disk-level mandatory + Nextcloud E2EE optional per folder
- DPA + healthcare-data-controller agreement templates included for processor (hoster) ↔ controller (practice) relationship
- National compliance: stack design satisfies EU GDPR Article 9 (special-category health data) + national healthcare data laws (Germany BDSG, Italy Codice Privacy, France LIL, Spain LOPDGDD)
- AI prompt isolation: all LLM inference on the same VPS as the patient corpus — no cross-tenant prompt leakage
- Backup retention: 30-day rolling encrypted off-VPS backup (Hetzner Storage Box EU / S3 EU region)
- Disaster recovery: documented RPO 24h / RTO 4h on standard tier; faster tiers available on Enterprise