What happens to your medical chart after the hospital is done with it? A startup just raised $9.5 million for hospital records AI training, and the privacy answers are thin.
According to a press release on PR Newswire, BioStack says its network now holds more than 100 million de-identified patient records. Those records come from hospitals in the U.S., India, Brazil and Argentina, and the company is a Y Combinator startup out of San Francisco.
Here is what it does, why it matters to you, and what nobody has said yet.
How BioStack turns health records for AI into datasets
Hospital data is scattered. Notes live in one system, scans in another, lab results in a third (it’s the medical version of a junk drawer). BioStack says it stitches those pieces into one timeline per patient, covering notes, labs, imaging, medications, treatments and outcomes.
The company then strips out identifying details and packages the result as datasets. According to its release, those datasets can support research, drug development, and the training and evaluation of healthcare AI models. The company says it has already combined several hundred thousand X-rays, MRIs and CT scans with pathology and clinical records.
The $9.5 million seed round comes from Peak XV, Afore Capital, DCVC, Emerson Collective, SV Angel, Verdict Capital, Streamlined Ventures and Y Combinator. The money goes to expansion, platform work and hiring engineers and researchers. The company disclosed no valuation.
The part buried below the funding news
The funding is the headline. The more interesting piece is how the data gets used.
In its earlier Y Combinator launch post, BioStack describes turning real patient records into practice environments for AI. A model gets a case and makes a clinical move. Outcomes, guidelines and clinician review then score that move. The example tasks are “diagnose this,” “order the next test” and “adjust the medication.”
In plain English, the AI practices medicine on simulated versions of real patients and learns from the score. Think flight simulator, but for diagnoses. That is a company description, not something we could verify.
Still, it explains why a de-identified record can be worth far more than a stack of paperwork. The company says it has 17 customers and prospects, including top AI labs.
Patient data AI training: your records, your questions
Here’s the thing: if you have been treated at a U.S. hospital, this deserves a minute of your attention. The release says BioStack works with U.S. hospitals, but it names none of them. It also does not say how many of the 100 million records belong to American patients, or what a “record” even counts. A patient, a visit and a single document are very different units.
On privacy, the company says only that it uses “custom workflows that protect patient privacy and are based on individual provider protocols.” That is a sentence, not a standard. The release does not name a de-identification method, an outside audit or a certification. It also does not say whether anyone told patients, whether they can opt out, or who may buy the data.
So the 100 million figure, the hospital footprint and the “de-identified” label are all claims from the company itself. We found no independent confirmation of any of them. A fair question for any health system: what exactly did you agree to share, and with whom?
This is not the only place AI is moving fast in medicine. Utah is letting AI prescribe medication without a doctor reviewing every prescription, and the FDA recently cleared an AI breast cancer risk score with unproven pieces.
Who wins and who loses in hospital records AI training
The upside is real. Better training data could make diagnostic tools smarter and faster. The company also points to an India program that connects cancer patients with an investigational cancer vaccine effort, using their clinical data to support the biotech work.
The risk, however, is lopsided. Large hospital systems with deep data become valuable partners. Smaller clinics with less to contribute may fall behind.
And patients, as usual, learn last how their information is moving.
What happens next
BioStack says it will keep expanding in the U.S. and abroad and hire more engineers and researchers. The company gave no timeline. Four questions remain open: which U.S. hospitals take part, what de-identification method the company uses, whether patients can opt out, and whether any outside group has audited the process.
For now, the money is real and the answers are not. In health data, that order tends to get fixed too late.
