Counsel Health

The AI handles the first contact and resolves most of it. The company states its medical AI gathers context and offers initial evidence based guidance, with a physician joining only when medically necessary, and reports that most concerns are resolved on the platform. The company describes itself as built ground up with AI native workflows rather than layering AI onto existing processes, including a self built EMR because no off the shelf system suited asynchronous care. Physicians are the safety layer, not the throughput engine.

The clearest oversight architecture among patient facing AI in this index, because the boundary is drawn at a specific and defensible line. The AI provides information and context gathering; diagnosis, prescription, and referral require a board certified physician from an in house medical group licensed in all fifty states, who can join a conversation typically within fifteen minutes during clinical hours.

A company physician has stated publicly that there remain decisions only a physician can make, naming prescribing, referring, and delivering a diagnosis. The design also supports continuity, with patients messaging over days as symptoms evolve, which is a safer failure mode than a single stateless answer.

The architecture is described at the workflow level and partially at the engineering level. The company describes a clinician cockpit integrating patient records, specialty guidelines, and academic research, and its agent infrastructure has been publicly described as built on a named third party agent framework with encrypted at rest storage shared with physician patient conversations.

What is not published is the underlying model, evaluation methodology, or any accuracy measurement of the AI guidance itself, which is the number that matters most for a product giving medical information.

A third party in the chain is publicly identified, which puts this ahead of most of the lane. The agent infrastructure has been described publicly as built on a named third party agent framework, with encrypted at rest storage shared with physician and patient conversations, so a buyer can establish that a supplier exists, what it does, and that clinical conversation content sits inside it.

Naming the framework rather than describing the technology as proprietary is the disclosure this axis asks for, and it lets a reviewer read that supplier's own commitments rather than inferring them. The onward data flow is also documented rather than hidden: the company states it documents every patient interaction and shares it with health information exchanges and record systems so the rest of the care team stays informed.

That is a genuine safety benefit and it widens the set of parties holding the content, and a buyer should see both halves rather than only the first. Held below the top grade because the model layer itself is unnamed, with no foundation model provider, class or version identified, and no sub processor list was located covering the wider set. Ask which model produces the clinical guidance, for a sub processor list, and for the list of exchanges and record systems that receive interaction records.

Evidence is utilization and self reported avoidance rather than clinical outcome. The company reports that survey data shows it helped 77 percent of users avoid in person care, and describes serving tens of thousands of patients through health plan and provider partnerships across multiple states. Avoided care is a cost metric that cuts two ways: it demonstrates resolution but does not distinguish appropriate avoidance from care that should have happened. No published clinical quality, safety, or diagnostic concordance evidence was located, which is the gap for a product this close to clinical decision making.

The platform holds longitudinal clinical conversations and medical history, which the company states is used only to deliver personalized care and kept private. HIPAA and SOC 2 compliance are stated on the company's own site alongside encryption commitments, and its agent infrastructure has been described as HIPAA compliant and SOC 2 secure with encrypted at rest storage.

The company also states it documents every patient interaction and shares it with health information exchanges and EMRs so the rest of the care team stays informed, which is a genuine safety benefit and simultaneously widens the data flow a buyer should understand.

HIPAA compliance is stated directly on the company's site alongside SOC 2, with a stated commitment to the highest standards of security and encryption. As an operator of a physician group the company is a covered entity in its own right rather than only a business associate, which changes the contracting posture for payer and employer buyers. No explicit BAA commitment language was located, which is what separates this from an A.

SOC 2 compliance is stated publicly and corroborated in a third party engineering account describing the platform's agents as SOC 2 secure. The SOC 2 type is not specified and no trust center or downloadable attestation was located, so a buyer's diligence still runs through sales rather than self service.

Converted from Not Rated. The prior note contained the full analysis and it holds: no device pathway is claimed, the architecture keeps the product outside device regulation because the model provides information while a licensed physician makes every diagnostic and prescribing decision, and the regime that actually governs the business is medical practice regulation rather than software regulation.

That second half is the part worth expanding, because it is a heavier compliance surface than the one this axis usually measures, not a lighter one.

The company operates its own medical group with physicians licensed across all fifty states. Medicine is licensed state by state, so a national asynchronous service must match each patient to a clinician licensed where that patient is located at the time of the encounter, and maintain that mapping as clinicians and patients move. States also differ on whether a physician patient relationship can be established asynchronously at all, on what modality is required for a first encounter, and on documentation standards.

Prescribing adds a further layer. Authority to prescribe following an asynchronous encounter varies by state and by drug class, and controlled substances sit under a separate federal framework with its own telemedicine conditions that have been repeatedly revised.

The corporate structure deserves a question too. An affiliated medical group employing the clinicians is the standard arrangement, and where it sits relative to the technology company determines who carries clinical liability and who holds the record.

Ask how state matching is enforced, what the position is on asynchronous establishment and on controlled substances, and which entity is the treating provider.

The company describes built in guardrails with board certified physicians safeguarding every interaction, and positions its AI explicitly against consumer tools that cannot tell a member what is safe or covered. That is a governance posture expressed through clinical structure rather than a published program.

No bias evaluation was located, which matters because the company notes some of its most engaged users are women over 65, a population where symptom presentation and model performance frequently diverge from training distributions.

Two passes located no accuracy figure, no error rate, no published limitations, no evaluation methodology and no warranty, indemnity or remediation commitment for the guidance the product gives, and that is the number that matters most here because of what the product is. This is not documentation of a clinician's decision, it is a patient facing service delivering medical information, so an error reaches the person directly rather than passing through a clinician who might catch it.

The absence of any published characterisation means a patient cannot know where the system is weak and neither can the clinician supervising it. One design choice cuts both ways and belongs on this axis rather than only on stewardship. Every patient interaction is documented and shared with health information exchanges and record systems so the wider care team stays informed.

That is a real safety mechanism, because a downstream clinician sees what was said rather than discovering a gap later, and it also means an inaccurate or misleading exchange propagates into the permanent record and into systems the vendor does not control, where correcting it is somebody else's process. Ask for accuracy on the guidance, what a patient is told about the system's limits, and how a correction reaches every system that already received the record.

The company built its own EMR for asynchronous care rather than adopting an existing one, and states it documents every patient interaction and shares that documentation with health information exchanges and EMRs so a patient's other clinicians stay informed. Outbound HIE participation is a meaningful interoperability commitment that many virtual care companies skip. For enterprise buyers it offers APIs, single sign on, and rollout kits to embed the experience in an existing platform. No named EHR integrations were located.

Converted from Not Rated. No hosting, region, tenancy, retention or subprocessor terms were located. The product is delivered as a cloud service with embeddable interfaces and single sign on for enterprise partners, and no infrastructure terms are published.

The embedded distribution model is what makes this worth more than a standard absence note. The service is sold to payers, employers and health systems and surfaced inside their properties, so a patient may reach it believing they are using their health plan's or employer's service. That produces two questions a purchasing organisation should settle before launch.

The first is where the encounter record lives. The company describes a purpose built record system of its own design for asynchronous care, and its clinicians are the treating providers, so the clinical record is the medical group's rather than the purchasing organisation's. A health system embedding this is therefore creating records it does not hold, and an employer is in the unusual position of having sponsored care it must not see.

The second is what the enterprise partner receives. Single sign on means the partner knows who used the service. Whether it learns anything about what was discussed is a design decision with real consequences where the partner is an employer, and the separation should be explicit rather than assumed.

Ask where the platform and the record system are hosted, what retention applies to conversations including voice messages, who at the purchasing organisation can see what, and what happens to the clinical record if the contract ends.

No published pricing for the payer, employer, or health system offerings. The company frames value in terms of avoided high cost claims and per engaged member savings from avoided care and utilization, which suggests a per member arrangement, but no rate or structure is disclosed.

Positioned as enterprise virtual primary care, a front door spanning general medical questions, symptom evaluation, lab result interpretation, medication refills, and lifestyle guidance, with escalation to in network care when needed. The physician group is licensed in all fifty states, which removes the state by state coverage gaps common in telehealth. Specialty depth is handled by steering to point solutions and in network specialists rather than in house, so this is breadth of access rather than depth of specialty care.