C8 Health

The artificial intelligence is the engine of a core module rather than the whole product, and the company's own history shows it. The platform was founded at Geneva University Hospital in 2019 and spread across the Swiss hospital network as a structured protocol access tool before generative models were in use. Remove the assistant today and a working product remains: a unified searchable knowledge base delivered by role, department and location, mobile access, adherence dashboards and the cross institution Knowledge Network.

C8 Panda AI, described on its product page as a generative AI based assistant that answers clinicians' natural language questions from the institution's own vetted knowledge base with inline citations naming source and author, is now the marketed center of the platform, and the about page calls the company an AI clinical performance platform. The quality improvement module describes AI-powered interventions tailored to each clinician's compliance patterns, a second application of the model rather than a restatement of the first.

What the AI does not do is reason about a patient. It retrieves and summarizes guidance a human institution authored, and the quality module works on compliance metrics rather than on the patient in front of the clinician.

The oversight structure is described and one part is missing. The Panda AI page states that the assistant sources information exclusively from the institution's vetted knowledge base and that answers include inline linked citations indicating the source and author, so every answer is bounded to content the institution approved and traceable to a named document and the colleague who wrote it. The clinician reads the guidance and decides; nothing is ordered, charted or suppressed by the system.

What is not published is the threshold at which the system stops. Nothing says what the assistant does when the corpus holds no answer, or when two departments or sites hold conflicting protocols on the same question, which is the realistic failure case in a multi site deployment. The product page encourages clinicians to keep refining their questions until they receive all the information they need, which raises the value of publishing that behavior.

The quality improvement module sends automated, personalized interventions to individual clinicians based on their compliance patterns; the page does not say whether a person reviews an intervention before it is sent. No absolute accuracy claim is made about the assistant.

The architecture is described in general terms and nothing under it is identified. The Panda AI page describes a generative AI based assistant that takes natural language questions, answers only from the institution's own vetted knowledge base, keeps conversational context so a question can be refined, and returns inline citations naming the source document and its author. The enterprise page adds that guidance is grounded in the customer's own content and data, and the quality improvement page describes AI-powered interventions tailored to each clinician's compliance patterns. That is a retrieval grounded design, stated clearly.

No model class, foundation model, model provider or version is named. Nothing is published on how the retrieval layer, the document formatting feature or the interventions are built or evaluated, and there is no release or update practice telling a buyer when the system changed. Nothing is published about what the assistant does when the corpus does not contain the answer.

The architecture is described and no model provider is named. C8 Panda AI is a generative assistant, so an institution's protocols and clinicians' questions reach a language model, and neither the model nor the company running it is identified on the product pages or in the privacy policy. The policy refers to service providers only by type (technical assistance, order fulfillment, customer service) and names Google Analytics for the website alone, and no subprocessor list is published.

The policy does set terms for the unnamed providers: agreements require them to use personal information only to provide the contracted service, keep it secure and delete it at the end of the engagement, and no third party may use it for its own business purposes. The enterprise and quality improvement pages state that protected health information is not needed for deployment, and the policy lists only clinician account data as what hospitals supply, which narrows what reaches the chain. It does not say whether a clinician's free text question may carry patient details, or what data feeds the quality module's provider level metrics.

No hosting provider is named; the privacy policy states that US customers' data is processed in the United States and EU customers' data in the European Union. A trust center built on Vanta is published at trust.c8health.com and may list the subprocessors.

Two peer reviewed studies of the platform are published, and both measure use rather than clinical outcomes or the accuracy of the assistant's answers. The more recent is a survey based usability study in JMIR Human Factors (5 June 2026, doi 10.2196/83547): a quality improvement initiative in the Department of Anesthesiology at MetroHealth in Cleveland, reported under the SQUIRE guidelines, in which 142 anesthesiology clinicians completed the validated mHealth App Usability Questionnaire, with an overall mean score of 5.73 (SD 0.81) and core items above 5.5. It was led from MetroHealth; the company's cofounder and chief medical officer is a coauthor, and the senior author declares a consulting and advisory board role with the company. The earlier study (JMIR mHealth and uHealth, 2020, e20025) analyzed the reach of the pre commercial Geneva University Hospitals deployment during the COVID-19 response, across more than 1,000 health professionals.

The company's headline claims are outcomes, and they rest on its own figures: enhanced recovery (ERAS) compliance at MetroHealth up 35 percent in five months, quoted by the department chief as roughly 65 to over 88 percent; perioperative glucose management at UTMB from about 72 to more than 81 percent in three months; more than half of clinical staff significantly improving compliance within six months across six metrics at UTMB and Henry Ford Health (2026, data on file); a 3.4 times increase in staff satisfaction from three pre and post surveys at MetroHealth, Lahey and UNC Anesthesiology, stated as significant at P<0.001 with no denominators; a doubling of quality of care with no definition; 40 or more clinical hours recovered per user per year (internal study, 2025, data on file); and more than $550,000 average annual savings per tracked quality metric (two academic medical centers, FY 2025 to 2026, data on file). None carries a published denominator, comparison period or control. The published research stops at use, and the compliance and savings claims that would show more are not published with their method.

Categorical commitments are published, with a retention window for customer data behind them and training use left unanswered. The enterprise page states that protected health information is not needed for deployment and that the customer's data never leaves its system, and the quality improvement page repeats that the platform is compliant without requiring protected health information for deployment.

The privacy policy (last updated 5 March 2025) applies to the platform as well as the website. It lists what hospitals supply as clinician account data only, states that customer data is kept for the whole business relationship and generally deleted, including any personal information, within ninety days of termination, and binds service providers to use data only for the contracted service and delete it at the end of the engagement.

Not stated: whether the institution's protocols or clinicians' questions are used to train or improve any model (the policy reserves the use of personal information to improve and develop products); how the quality module's provider level metrics are derived and whether patient level data reaches the company to compute them; and what happens to a question in which a clinician types patient details. Two first party statements sit uneasily together: the enterprise page says the customer's data never leaves its system, while the privacy policy describes the company processing customer data in the United States and the European Union.

No safety engineering is published: no guardrails beyond the corpus bound, no hallucination mitigation, and no process for handling a safety event.

The company takes a scope position a buyer can rely on for the knowledge platform, with a service privacy document behind it. The enterprise and quality improvement pages state that protected health information is not needed for deployment and that the platform is SOC 2, GDPR and HIPAA compliant, and the home page states the company is fully compliant with SOC 2 Type II standards, HIPAA, GDPR and CCPA.

The privacy policy (last updated 5 March 2025) covers the platform, not only the website, and lists what hospitals supply as clinician account data: name, work email, department, profession, role and level of training, with optional contact and specialty fields. That is consistent with the stated scope. No business associate status is stated, no business associate agreement or template is published, and nothing says which C8 entity would sign one.

The limit of the scope position is the quality improvement module, which tracks provider level compliance on metrics such as perioperative glucose management and antibiotic redosing. Those metrics derive from patient care, and no page says what data feeds them or whether patient level records reach the company to compute them.

A recognized certification is named in the company's own material without the artifact. The home page states that the company is fully compliant with SOC 2 Type II standards, with the type specified, alongside HIPAA, GDPR and CCPA, and the enterprise and quality improvement pages repeat SOC 2 compliance. No report date, auditor, trust services scope or renewal cadence is published outside the trust center.

A trust center is published at trust.c8health.com and linked from the site footer, built on Vanta, and it may list the reports, documents, controls and subprocessors and the terms on which it releases them.

No ISO 27001 or HITRUST certification and no penetration testing cadence is stated on the site. The privacy policy describes security in general terms: technical, administrative and organizational measures, including encryption and authentication tools in certain circumstances.

No device claim is made and none is apparent. The product answers clinicians' questions from the institution's own protocols and is marketed as knowledge management and quality improvement software.

The 21st Century Cures Act exclusion for clinical decision support turns partly on whether a clinician can independently review the basis for a recommendation. Here the basis is the institution's own published protocol, shown with an inline citation to the document and its named author, which a clinician can open. That is an observation about the design rather than a position the company states: no regulatory rationale and no intended use statement is published, and the peer reviewed usability study (JMIR Human Factors, 2026) describes the platform as a clinical decision support tool.

The quality improvement module delivers personalized interventions to individual clinicians based on their compliance with metrics such as CLABSI prevention and perioperative glucose management. These address the clinician's practice rather than a patient, and no clinical recommendation for a patient is marketed.

Governance appears as a design commitment with no evaluation behind it. The company's stated approach is that answers are grounded only in content the institution has vetted and approved: the Panda AI page says the assistant sources information exclusively from the institution's vetted knowledge base, and the enterprise page describes decisions supported by locally vetted knowledge and hospital approved data. Curation of that corpus sits with the customer, supported by a company account manager who uploads and organizes content.

Nothing is published on how the assistant's behavior is tested: no retrieval accuracy, no evaluation of failure modes by content type or department, no model card, no bias or subgroup evaluation, and no responsible AI policy. The one peer reviewed study of the current platform (JMIR Human Factors, 2026) measures usability, not model behavior.

A governance question sits in the Knowledge Network, which lets institutions and clinical societies share protocols. If the protocols of well resourced academic centers become templates for smaller hospitals, the guidance can carry staffing, equipment and population assumptions the adopting site does not share, and nothing published says who curates the shared library or how local applicability is assessed. Where a society guideline shared through the network and a local protocol conflict inside one corpus, nothing says which the assistant surfaces or who owns the update cycle.

Mechanisms exist that let a clinician challenge an answer, and nothing stands behind the output. The Panda AI page states that every answer sources exclusively from the institution's vetted knowledge base and carries inline linked citations naming the source document and its author. In a local corpus that author is usually a colleague at the same institution, so a clinician who doubts an answer can open the protocol and ask the person who wrote it, and a wrong protocol can be corrected at its source. That route runs to the customer's own staff rather than to the company, so it is traceability rather than recourse against the vendor.

The website terms of use (last updated March 2023) provide the website and the platform as is, disclaim warranties including error free operation, limit direct damages to $100 except as set out in the subscription agreement, and contain no provision addressing the assistant's answers. The subscription agreement is not published.

No accuracy rate, citation fidelity figure, error rate or correction commitment is published, and nothing states what the assistant does when the corpus holds no answer to the question asked, which is where a system retrieving from a bounded corpus is most likely to be confidently wrong.

Integration is claimed with no record system named and no data exchange described. The home and enterprise pages state that the platform works with the existing EMR, scheduling systems and learning management platforms, using IP based magic links within the EMR for login free access and integrating systems for scheduling, policies and analytics directly in the platform.

That is a launch and single sign on route into the platform from inside the record, not an exchange of clinical data: no HL7 interface, FHIR application or SMART on FHIR launch is described, and no record system is named. The design is consistent with the company's statement that protected health information is not needed for deployment, and it cuts both ways: little to build and maintain, and no patient context inside any answer.

The quality improvement module tracks quality metrics in real time, and no page says from which system those metrics come or through what interface.

Options and residency are stated, with isolation and the processing path left open. The platform is a hosted service reached through web and mobile access, with location tags and dedicated workspaces for multi site organizations. The privacy policy (last updated 5 March 2025) commits residency by customer region: the company processes the data of its US customers in the United States and the data of its EU customers in the European Union, and transfers of personal data from Europe to the United States rest on the European Commission's Standard Contractual Clauses.

Two entities operate the service, C8 Health Inc. (a Delaware company with a San Francisco contact address) and HeadToToe mHealth Sàrl (Geneva), which act as joint controllers for customers contracting with the Swiss entity. No hosting provider, tenant isolation model or on premises option is described, and the enterprise page's statement that the customer's data never leaves its system is not reconciled with the policy's description of processing in the two regions.

Implementation is published in outline: department wide deployment typically within three months including content migration and user training, led by a named implementation specialist, with no IT resources required for ongoing maintenance.

No price is published and the sales posture is discoverable. There is no rate card, no unit of charge, no indicative band and no implementation fee on any page read, and every route leads to a demo request, a free ROI consultation or a sales telephone line.

The shape of a deal is public even though the price is not. The product is sold as a department deployment (anesthesiology, perioperative services) and as an enterprise rollout; implementation typically takes three months department wide and includes content migration, content upload and organization by an account manager, user training, a named implementation specialist, and a dedicated site or customer success manager with quarterly business reviews; and the quality improvement module and the Knowledge Network are presented as parts of one platform.

The company headlines more than $550,000 in average annual savings per tracked quality metric, names the mechanism (fewer surgical site infections and shorter length of stay), the sample (two academic medical centers with more than 20,000 combined cases) and the period (FY 2025 to 2026), and marks the derivation as data on file. The unit of pricing is not stated, so a saving per quality metric cannot be set against what the platform costs to run.

Coverage is named, with validation behind part of it. The company anchors the product in anesthesiology and perioperative services, its first vertical, with dedicated solution pages for anesthesiology, perioperative nursing and enterprises, and it is an official collaborator of the American Society of Anesthesiologists.

The quality improvement page names metrics outside the operating room (CLABSI prevention, CAUTI protocols, antibiotic redosing, temperature management), the about page lists resident onboarding and institutional collaboration as use cases and records expansion to new verticals in 2024, and the enterprise page presents deployments from academic medical centers to community hospitals at more than 150 institutions in the United States and Europe (the quality improvement page says more than 100 healthcare organizations). Resident onboarding supports the workforce and training listing.

What sits behind the scope: the peer reviewed usability study covers one anesthesiology department (MetroHealth, 142 clinicians), and every published outcome figure is perioperative or anesthesiology and vendor reported. Performance in departments outside that anchor is not established on any page read.