Doctolib

The sixth product scoped platform vendor in this index and the first outside the US. What a practice buys is Doctolib: booking, practice management, and patient records across France, Germany, and Italy. The Consultation Assistant and the practice management AI assistants are capabilities layered onto that platform, and the ambient documentation technology itself was acquired rather than built, coming from the June 2024 purchase of Typeless. No practice selects Doctolib for the AI.

Two capabilities with quite different autonomy profiles, and no oversight design published for either.

The documentation assistant converts spoken consultation into structured clinical text. That is assistive by construction, since a clinician reviews and signs a note before it enters the record, and the professional obligation to verify what is recorded rests with them regardless of what the software produced. What is not published is the review design: whether the original audio or transcript remains available for checking, whether uncertain passages are flagged, and how a correction is captured.

The telephone assistant is different in kind and this is the more consequential of the two. It answers calls around the clock, categorises the enquiry, and transfers appointment bookings directly into the practice system. That last step is an action taken in a system of record without a person in between. A misunderstood request produces a wrong booking, a missed urgent call routed as routine, or an appointment made for the wrong person, and none of those announces itself at the moment it happens.

The questions follow. What the assistant will not attempt, how it recognises that a caller needs a human immediately, whether a patient is told they are speaking to software, what confirmation the patient receives, and what a practice sees to audit what was decided overnight.

Ask for the escalation triggers, the disclosure made to callers, and the review trail for actions taken without staff present.

Provenance of the core speech technology is unusually traceable: it came from Typeless, a spin off of EPFL and the Idiap Research Institute specializing in speech recognition, acquired June 2024, and the documentation capability is described as large language model based. Naming the acquired research lineage lets a buyer assess where the capability actually originates rather than accepting a generic AI claim. Held back from A because no model detail, accuracy measurement, or validation methodology was retrieved for the deployed assistants.

The origin of the core capability is traceable in a way almost nothing else in this lane is. The speech technology came from Typeless, a spin off of a named federal technical university and a named research institute, acquired in June 2024, and the documentation capability is described as language model based.

Naming the acquired research lineage lets a buyer establish where the capability actually comes from rather than accepting a generic claim of proprietary technology, and it also tells them which body of published research is relevant to assessing it.

The hosting side is bounded by certification rather than by enumeration: national health data hosting certification means the infrastructure holding clinical data has been audited against a specific regime and jurisdiction, which constrains where content can go even though it does not list who holds it. Held below the top grade because the present day chain is not enumerated.

No cloud or infrastructure provider is named, no foundation model provider is identified for the deployed assistants, and no sub processor list was located. One question is live rather than theoretical and should be pinned contractually rather than read from a policy page: whether consultation audio or transcripts contribute to model development, and on what default.

Changes to training defaults have been reported in this market and a default is a policy decision that can be revised, so the answer belongs in the agreement rather than in a frequently asked questions entry.

Platform scale is exceptional and it is not evidence for the capabilities indexed here.

The company is the dominant digital health infrastructure provider across three large European markets, spanning booking, practice management and clinical records. That footprint is real and it means distribution for anything the company ships is immediate, which is the strategic point already made on this record. It says nothing about whether the AI capabilities work.

What is published about those capabilities is a single vendor stated operational figure, that practices can save up to ten hours per week on administrative tasks, without a baseline, a denominator, a method or a cohort. Up to is a ceiling rather than a result. The documentation capability derives from an acquired research spin out with an academic pedigree, which is a reason for confidence in the underlying speech technology and is not a clinical evaluation of the product.

No published study, no accuracy measurement for generated clinical text, no error rate for the telephone assistant's categorisation, and no independent evaluation were located. That matters more for a documentation product than for most software, because the output becomes part of a patient's medical record and is relied on by whoever reads it next.

This is the same distinction applied to other platform vendors in this index: adoption of the platform is not evidence for a recent capability layered onto it. Ask for accuracy data on generated notes, correction rates in production, and any evaluation conducted with practices rather than by them.

Strong instruments and clear patient facing communication, with the question the AI capabilities raise left unanswered.

The instruments are among the best available: certification to the privacy information management standard and the cloud personal information standard alongside the core security standard, plus the national health data hosting certification. The company also communicates to patients directly rather than only to practices, stating that health data is encrypted, that only healthcare professionals the patient has authorised can access it, and that independent audits verify the protections. Publishing in plain language for the data subject rather than the customer is uncommon and creditable.

The unanswered question concerns the consultation assistant, and it is a real tension rather than a quibble. The company describes end to end encryption of health data. It also offers a capability that listens to a doctor patient consultation and generates structured clinical text from it. Something must process that audio in a form it can read. The two statements are reconcilable, and a buyer should ask how: whether processing happens on the practice's device or on a server, what is decrypted where, and what the encryption claim actually covers.

The rest follows from that. Whether consultation audio is retained after a note is produced and for how long, whether recordings or transcripts contribute to model development, and whether the patient is told a consultation is being processed by software at all, which in several jurisdictions is a question about consent rather than courtesy.

A scoping determination that closes cleanly, with a structural consequence a practice should understand.

The company operates in France, Germany and Italy. No United States operation was located, so the United States health privacy rule does not apply and the absence of a business associate posture is correct rather than a gap. Grading it as one would misdescribe the business.

What governs is a stack of European and national instruments, and the company names them: the general data protection regulation, the electronic privacy directive, the French data protection act, and the public health code provision requiring that any hosting of personal health data on behalf of a third party be entrusted to a certified host. Germany and Italy add their own layers, which is why the company's certification portfolio is organised by country.

The structural consequence concerns roles. Under the European framework a medical practice is the controller for its own patient data and the platform is its processor, while the platform is controller for the data it holds in its own right. That split determines who answers a patient's request to access or erase their data, and the answer is frequently not the platform. Where one processor serves many independent controllers, a patient's rights request must be directed to each practice that holds their record, and the platform cannot action it unilaterally on their behalf. That is legally correct and practically frustrating for patients, and a practice adopting the platform inherits the obligation to handle those requests itself.

Ask for the data processing agreement, the controller and processor allocation per data category, and the process for patient rights requests.

The most complete European security posture in this index, and the structure of it is the lesson.

The portfolio is per jurisdiction rather than generic, because health data hosting in Europe is nationally regulated rather than harmonised. The company holds the international information security management standard certified separately in two of its markets, the privacy information management and cloud personal information extensions to it, the French health data hosting certification, the German federal cloud computing criteria catalogue, an Italian national cybersecurity qualification, and further third party assessments. It publishes a dedicated certifications document. Auditing is by an internationally recognised certification body, with annual surveillance audits and full renewal every three years, and the company states that cycle openly rather than implying certification is permanent.

One published statement deserves particular credit because it argues against the company's own marketing interest and matches a distinction this index draws constantly. In announcing the certifications, the company wrote that these certifications do not demonstrate a specific level of security, that its hosting provider already complied with both, and that it pursued them in its own name anyway in order to be exemplary and transparent. That is the inherited certification problem articulated by a vendor about itself, and it is the exact opposite of the pattern this index more usually finds, where a subsidiary or customer points at a parent's or host's credentials as though they were its own.

What is still worth asking: the scope of each certificate across the platform and the AI capabilities specifically, and penetration testing disclosure, which was not located.

Graded against the regime that actually governs this vendor, which is not the United States device pathway. The row previously sat under a non canonical axis name and rendered nowhere; the content is unchanged and it now occupies the correct slot.

Operating under a materially different regime from the United States vendors in this index, which is the useful comparison. European regulators treat ambient scribes as software as a medical device, with the United Kingdom medicines and healthcare regulator classifying them that way, and European artificial intelligence legislation applies to clinical AI on a risk based basis. That is a stricter starting position than the United States, where documentation drafting sits outside device regulation entirely and this index grades peers against payer documentation standards instead.

The comparison is worth drawing explicitly for a buyer. An identical product can be an unregulated productivity tool in one market and a regulated medical device in another, purely as a function of where it is sold. A vendor operating under the stricter regime carries obligations on clinical evaluation, post market surveillance and change control that its American competitors do not, and that is a substantive difference rather than a paperwork one.

Ask which classification applies in each market of interest, and what post market surveillance obligations follow.

No governance framework, model documentation or evaluation was located for the AI capabilities, on a record where security and privacy documentation is otherwise exemplary. The contrast is the same one this index has found repeatedly at large platform vendors: mature disclosure in the established domains, nothing yet extended to the AI layer.

Three domain questions apply and none is addressed.

The first is language. The platform operates across three countries and the documentation capability converts spoken clinical dialogue into structured medical text in each. Speech recognition and clinical text generation degrade with accent, dialect, speech rate and code switching, and a doctor practising in a second language or a patient speaking one is exactly the situation where a scribe is most useful and least reliable. Nothing published reports accuracy by language or speaker characteristic.

The second is the telephone assistant, which categorises incoming enquiries. Categorisation determines what happens next, and a caller whose speech the system handles poorly experiences it as a practice that does not answer the phone properly.

The third is regulatory rather than technical, and this vendor sits inside it. European regulators treat ambient documentation tools as medical device software, and the European artificial intelligence regulation places obligations on providers of such systems including risk management, data governance and post market monitoring. A vendor of this scale operating across three member states will be inside that regime.

Ask for accuracy by language, the error and correction rate for generated notes, and the conformity work under the applicable European regimes.

This record introduces the clearest structural difference between European and United States vendors on this axis, and it is worth stating as a general finding rather than a fact about one company. Where a product operates under European data protection law, the recorded patient holds enforceable statutory rights over their own personal data, including rectification of inaccurate records, with a supervisory authority behind them and obligations that reach processors and not only the customer.

The contrast with the United States position should be drawn accurately rather than dramatically. Federal health privacy law does give an individual a right to request amendment of their record, so a patient there is not without any mechanism, but that request runs to the covered entity, which may refuse it and need only record the disagreement, and the individual cannot enforce it directly other than by complaint.

The European right is stronger in kind: it is enforceable, it is supervised, and it binds the processor as well as the practice. That is a real correction route for the affected person, created by law rather than granted by a vendor. Supporting evidence is unusually good.

The company holds certification to privacy information management, cloud personal information and core security standards, plus the national health data hosting certification, so the instruments are externally audited rather than asserted. It also communicates in plain language to patients directly, telling them their data is encrypted, that only professionals they have authorised can access it, and that independent audits verify the protections.

Addressing the data subject rather than only the paying customer is rare enough to credit on this axis specifically, because recourse begins with the affected person knowing the system exists. Held below the top grade because nothing stands behind the clinical output itself.

No accuracy or error figure, no warranty and no remediation commitment for the documentation assistant was located, and one published tension remains unresolved: the company describes end to end encryption of health data while also offering a capability that reads consultation audio, and a buyer should establish what is decrypted where before relying on either statement.

Distribution is the whole argument and it is structural rather than a partnership. Because Doctolib already operates the appointment system, practice management, and record for a large share of practices in its markets, ambient documentation arrives inside the workflow rather than beside it, and the telephone assistant transfers bookings directly into the same system. A standalone scribe must integrate to reach that position; Doctolib starts there. That advantage is confined to its own installed base, which is the correct caveat.

Answered with more specificity than almost any record in this index, and short of the top grade on the questions beyond residency.

What is published: data is hosted with a named cloud provider in data centres identified by city, in Frankfurt and Paris, so health data remains on European Union territory for storage. The hosting entity holds the French health data hosting certification, and so does the company itself. That second point is the one buyers most often miss: the certification attaches to the party hosting the data, and a software publisher that handles health data must be covered in its own right rather than relying on its host's certificate. Holding both is the correct structure and the company can show it.

The sovereignty question has also been litigated rather than merely asserted. A challenge concerning the use of a cloud provider belonging to a United States group was brought before the French supreme administrative court in 2021 and rejected at the interim stage. A buyer should understand that the question was tested, and also that the legal environment around non European cloud providers holding health data continues to develop.

What is not published: the tenancy model separating one practice's data from another's, retention schedules, and the subprocessor register beyond the hosting provider.

One live item to verify rather than assume. The French hosting certification framework has been revised, with a compliance deadline falling in 2026. Ask for the current certificate against the new reference framework rather than the previous one.

No public pricing retrieved for the AI capabilities. The company reports practices can save up to ten hours per week on administrative tasks with the AI enabled practice software, which is a vendor stated efficiency claim rather than a price. Establish whether the Consultation Assistant and the AI assistants carry incremental cost above existing Doctolib subscription, the standard question for platform vendors indexed under the scope rule here.

The platform is broad but the AI practice management product is not yet: it launched in November 2025 for general practitioners, pediatricians, and gynecologists, with further specialties stated as planned. Buyers outside those three specialties should confirm current availability rather than assume platform level coverage extends to the AI assistants. Geographic scope is France, Germany, and Italy.