A governed AI assistant that answers admin enquiries from approved practice information and books through Dentally, escalates anything clinical with a hard safety gate, and never gives clinical advice, with staff reviewing every non-templated reply.
Patient enquiries arrive around the clock, by web chat and form: availability, prices, opening hours, "can I book," and sometimes symptoms and pain. The front desk cannot cover all of it, so after-hours enquiries went unanswered and patients booked elsewhere. And the symptom questions are a governance minefield: answered informally they are unsafe, and answered by software they turn the tool into a regulated medical device.
01 The Challenge
Most enquiries are routine admin: when can I come in, what does a check-up cost, are you open Saturday, can I move my appointment. But they arrive 24/7, and a small front-desk team cannot keep up, so after-hours messages sat unanswered overnight and turned into lost patients. Threaded through them were the questions that must never be handled casually: "my tooth is throbbing, what should I do?" Answering that informally is unsafe, and if the software itself advises on symptoms, under NHS England and MHRA rules it becomes a regulated medical device.
A patient asking about pain at 9pm needs a safe answer, not a clinical one, and not silence.
02 The Approach
The governing rule: the assistant handles administrative tasks (booking, FAQs from an approved corpus, hours, pricing) within tight bounds, escalates anything clinical to a safe templated response plus a human, and never gives clinical advice.
The decision that governs everything is staying firmly administrative, so the system is decision-support, not a medical device. A hard clinical-safety classifier gates every message. Anything clinical gets a clinician-designed templated response ("I can't advise on symptoms, but I can book you an urgent appointment, or you can call us, and if you have [red-flag], contact 111 or urgent dental care") and a handoff to staff. Facts come only from an approved practice-information corpus, cited, never invented. And every non-templated reply is reviewed by a person before it sends.
What we deliberately did not do: no clinical advice, diagnosis, or symptom triage by the model (that is a regulated device); no autonomous action beyond booking within policy; no patient health data sent to third parties; and no prompt-only guardrails, the clinical gate is a deterministic classifier and rules, not a line in the prompt hoping the model complies.
03 The Build
Code orchestrates; the model decides only within bounds. Every inbound message runs input validation, then a Claude Haiku 4.5 clinical-safety classifier. Clinical messages get the templated safe response and escalate to staff; admin messages route to a handler. FAQ answers are grounded in an approved practice-information corpus (retrieval with citations), never free-generated, and Claude Opus 4.8 drafts the conversational admin replies using only that grounded content. Booking and rescheduling call the Dentally API within availability rules, behind an idempotency key so a retry never double-books. A Temporal workflow carries the conversation, the booking, and the human-review gate durably. Patients use a TypeScript widget; staff work a console that shows the queue, the assistant's sources, and one-click approve or edit for every non-templated reply. Patient identifiers are pseudonymized at the model boundary and traces are PII-redacted.
Deliberately administrative by design: a deterministic clinical gate, grounded-and-cited facts, and a human on every non-templated reply are what keep it provably safe and outside medical-device scope.
04 The Results
Roughly 70% of enquiries (the admin ones) are now resolved end to end without the front desk, and after-hours messages are answered and booked instead of lost. The clinical-safety gate held at zero advice given, audited monthly against a rubric with zero tolerance. Staff were freed for chairside and in-practice work and now touch only the escalations and the non-templated reviews. And because the system is provably administrative, it stays out of medical-device scope, which is exactly where a dental practice wants it.
05 What's Next
Bookings flow into the same practice spine as the attribution, lifecycle, and marketing work on the dental shelf. The governed-assistant pattern (safety gate, grounded answers, human review, durable workflow) extends to other admin flows like appointment confirmations and payment-plan questions, and the safety case and hazard log are reused as the group rolls it out per practice.
A vision LLM tags every ad creative into structured attributes and joins them to your attribution and margin data, so you see which creative traits drive the cheapest, highest-margin new customers, not which ad id got clicks.
An LLM reads each retailer's vendor manual into machine-enforceable rules that drive your order-to-cash pipeline, so violations get caught before they ship, not billed back after.
Numbers you can trust, operations that run themselves, all built into your stack and owned by you. Tell us where you want the edge, and we'll build it.
You'll hear from an engineer the same working day, not a sales sequence.
A short call, then a plan, and we start with Proof Week or a full build.
A fixed fee agreed before anything starts, for Proof Week or the full build.