AI for GP practices: the letters that end up in the chat
It is rarely the clinical system that gets pasted. It is the referral letter somebody wants shortened, the discharge summary a GP wants turned into plain English for the patient, the reply to a complaint the practice manager has been drafting since Tuesday. Each of them opens with a few lines that point to one person, and those lines are what the chat receives first.
They carry the patient’s name, date of birth, address and NHS number. In Scotland the number is the CHI number, and in Northern Ireland the H&C number, because the NHS number itself covers England, Wales and the Isle of Man. A practice in Glasgow or Belfast that reads NHS number on a product page should check which identifier is actually meant.
AI for GP practices therefore starts with a letter and a question about what is left in it when it arrives. The provider keeps what it receives on its own terms, and our guide to how OpenAI keeps and shares a UK user’s chats sets those terms out. Nonimo works one step earlier, on the practice computer.
Can GP practices use ChatGPT? What the AI sees after the key
Mark the passage and press the one key. The names, dates and numbers Nonimo spots become tags such as PERSON_1 on the practice computer, and only the tagged letter travels. When the answer returns, the tags are filled back in so that the GP reads it with the patient’s real details. The same happens on Mac and on Windows, entirely on the desktop, as our security page sets out.
For patient details, you watch every swap happen, with one line of explanation and the option to reverse it. Names, dates of birth and the NHS number become tags such as PERSON_1 or BIRTH_DATE_1, so the assistant still knows what kind of detail stood there. Whoever pastes sees the tagged letter exactly as the assistant will read it.
In the made-up referral, tested on 25 September 2026, NHS No sits in front of a number from the range kept for testing, and it is tagged; so would a real number keyed in with one digit wrong. The greeting and the clinical history are left alone. Why a tagged letter is still personal data is in our guide to pseudonymisation under the UK GDPR.
Before: what gets pasted
Dear colleague, Re: Mr Joe Bloggs DOB: 30/02/1970 NHS No: 999 234 5675 Thank you for seeing this gentleman with a six-month history of exertional chest pain.
After: what the AI receives
Dear colleague, Re: Mr [PERSON_1] DOB: [BIRTH_DATE_1] NHS No: [REFERENCE_1] Thank you for seeing this gentleman with a six-month history of exertional chest pain.
AI in GP practices: who owns the decision
Deciding what staff may put into an AI tool is a decision somebody in the practice owns. The ICO’s anonymisation guidance, quoted here, suggests that for some organisations a Senior Information Risk Owner takes responsibility for key decisions. It is a recommendation, not a rule, and whether your practice names a SIRO is its own choice, but the question of who decides remains.
In England the practice also completes the NHS Data Security and Protection Toolkit every year, and the 2018 Act adds a personal element at section 170, where releasing personal data the controller never agreed to release is a criminal offence if done “knowingly or recklessly” by “a person”. Whoever pastes the letter is that person, which is why a step on their own desktop matters.
Tags do not make the letter anonymous. They can be reversed on the practice computer, so for the practice the letter remains personal data, and a rare condition in a small town can still point to one patient. Our guide on what stays identifiable in a document explains why, and how to test a letter before it leaves.
AI for GP practices: price and the first install
Nonimo’s desktop application runs on Mac and on Windows, installed on each computer in the practice. Nonimo’s free plan stops at a set number of words each month. Leave an email address on our licence page and a free licence file comes back that removes the cap until 31 January 2027, with no account to set up.
Installation is per computer. On managed machines, whoever looks after your IT can push out the browser extension by policy instead, which covers text unasked and, where the practice decides, blocks; hello@nonimo.ai sets it up. Staff carry on using ChatGPT, Claude or Copilot as before, in the browser they already have open.
A reception desk and a GP’s consulting room can start on different days; each computer simply begins tagging once the app is in place, with nothing to configure first. A good first letter is the next referral somebody wants shortened: select it, press the key, and read the tags before it goes.
- Free today, on Mac and Windows
- With a monthly word allowance
- The free licence lifts it until 31 January 2027, no account needed
Questions from the practice
Can GP practices use ChatGPT?
That is the practice's own decision, and nothing we have read makes it for you. NHS England publishes its own information governance guidance on AI, and the practice should read it alongside the ICO's. If the practice decides yes, Nonimo is a step on each computer: the patient details it spots are tagged before the letter is sent, and staff see every tag.
Is ChatGPT safe for GP practices?
The risk sits less in the tool than in the letter pasted into it. Under the 2018 Act, at section 170, disclosing personal data that the controller never agreed to release is a criminal offence when done “knowingly or recklessly” by “a person”, and the person is whoever pastes. Nonimo shrinks what they send: a labelled NHS number, a birth date and the names it knows become tags first.
Does Nonimo recognise NHS numbers?
Yes, when NHS No or NHS number sits immediately before the number. The NHS number belongs to England, Wales and the Isle of Man, and a number keyed in with one digit wrong is still tagged when the heading is there. The tag appears in the AFTER before the letter is sent, and the real number is filled back in when the answer returns.
We are a practice in Scotland. What about the CHI number?
Yes, and the H&C number in Northern Ireland as well. Both are covered the way the NHS number is in England, with their heading in front: CHI No, CHI number or H&C number. The name and the birth date in a Scottish letter are tagged too, and the AFTER shows every tag before anything is sent, so whoever pastes sees exactly what the assistant will read.
Can it stop staff pasting patient letters into ChatGPT?
The desktop app does not stop anyone: it tags what it recognises when someone presses the key, and it blocks nothing. Blocking lives in the browser extension, which IT deploys by policy and which blocks where the practice decides. Whether staff may use an AI tool at all is a decision the ICO's guidance places with a named owner, the SIRO approach, in the organisations that adopt it.
Will it help with our Data Security and Protection Toolkit?
Not directly. In England the practice completes the NHS Data Security and Protection Toolkit every year, and that return is the practice's own work. The app logs none of the swaps, and a practice-wide dashboard only counts them by category. What it gives you is a technical step on each desktop that you can describe in your own words and that staff can see working every time they paste a letter.