Graph RAG · Hybrid retrieval · Agentic AI

Compliance intelligence for clinical data.

CliniData AI connects HIPAA, GDPR health-data rules, 21 CFR Part 11, ICH GCP and India's DPDP Act to your controls, evidence and risks in one knowledge graph. Specialist AI agents find the gaps, cite the exact obligation, and send every critical finding to a human approver before anything changes.

Run a live gap analysis See how it works
Example findingCRITICAL

Query: "Which controls cover breach notification across HIPAA and GDPR?"

Breach procedure CTL-IR-01 commits to notification within 30 days. That meets HIPAA §164.404's 60-day limit but misses GDPR Art. 33 and DPDP §8(6), which both require 72 hours.

Compound obligation Residual risk 5.0 / 25 Awaiting CCO approval

From the live demo's fictional tenant. Each claim links to a node in the graph.

91%
retrieval precision@10 with hybrid search + reranking, vs 74% dense-only
+24 pts
gap-detection precision from domain-routed instructions vs a generic prompt
34%
of regulatory findings come from cross-regulation obligations that single-framework reviews miss
Weeks → hours
target for a full regulatory gap review

Figures are design targets from the ECRIP v2.0 platform specification that CliniData AI is built on, not independently measured results.

Why a graph

Compliance questions are multi-hop questions

"Are we covered for GDPR Article 32?" means following a chain: regulation → obligation → control → evidence → risk → asset. Flat vector search returns loose paragraphs. A knowledge graph returns the whole chain, with an ID at every step you can cite and audit.

◎

Typed knowledge graph

Seven node types (Regulation, Obligation, Control, Risk, Asset, Entity, Evidence) linked by typed relationships, including MAPS_TO between equivalent obligations in different frameworks.

⇄

Hybrid retrieval

Dense semantic search catches paraphrased policy language. Keyword search catches exact article numbers and deadlines. Rank fusion and a reranker combine the two.

✓

Grounded, approved output

Every AI claim must cite a graph node or it gets flagged. CRITICAL and HIGH gaps wait for a CCO or senior compliance manager before any remediation starts.

How a gap analysis runs

Six phases, each one logged

  1. Plan & routeThe orchestrator reads the question, scopes the frameworks and articles, and picks 4–6 domain instructions from the adaptive codebook.
  2. RetrieveA hypothetical policy passage (HyDE) drives dense search in Pinecone while full-text search runs in parallel; results are merged with RRF and reranked.
  3. TraverseRetrieved nodes seed a multi-hop Neo4j traversal that pulls in controls, evidence, risks and cross-framework equivalents.
  4. VerifyGap Mapper, Constraint Verifier and Cross-Reference agents check coverage, evidence, deadlines (e.g. 72 h vs 60 days) and compound obligations.
  5. ReportClaude writes a cited analysis, and a hallucination guard rejects any node ID that is not in the retrieved subgraph.
  6. ApproveCRITICAL gaps go to the CCO and HIGH gaps to a senior compliance manager. Once approved, remediation tasks are created with deadlines.
Frameworks in the demo

Built for regulated clinical data

Hospitals, CROs, sponsors and pharmacovigilance teams handle several regimes at once. CliniData AI links their obligations so that a control is judged against every framework it serves, not only the one it was written for.

HIPAA Security RuleHIPAA Privacy & Breach Notification GDPR Art. 9 · 15 · 28 · 32 · 33 · 3521 CFR Part 11 ICH E6(R3) GCPICH E2A safety reporting DPDP Act 2023ISO/IEC 27001:2022

Try it on a fictional clinical research organisation

Sign in, ask a question such as "Show all HIPAA §164.312 gaps", and watch every agent step, citation and approval gate as it runs.

Open the demoRequest a walkthrough