Doctolib

What a practice buys is Doctolib: booking, practice management, and patient records across France, Germany, and Italy. The Consultation Assistant and the practice management AI assistants are capabilities layered onto that platform, and the ambient documentation technology itself was acquired rather than built, coming from the June 2024 purchase of Typeless. No practice selects Doctolib for the AI.

The documentation assistant has a published review design, set out in the vendor's own help center. The vendor states the failure mode rather than asserting accuracy. Its instructions say that because of the technology used, the generated notes may contain elements that were not said during the consultation and were not entered in the additional information field, or may omit information, and that checking the entire summary before validation is mandatory. Naming hallucination and omission as expected properties of the output, in the instructions a clinician actually reads, puts the warning where it will be seen.

The mechanism behind that obligation is described rather than asserted. Nothing reaches the patient record until the clinician validates it. Suggested history and lifestyle entries can be added as a set, deleted individually, or rejected entirely, so acceptance is granular rather than all or nothing. The transcript and the additional information field can be opened alongside the suggestions, so the generated text can be checked against its source. The note can be edited freely before validation, and the assistant can be restarted to extend it.

Two timing rules make the review a fail safe rather than a policy. Unvalidated suggestions are deleted 48 hours after creation, with a queue in the navigation bar showing what is awaiting review, so unreviewed output expires instead of persisting. After validation, the transcript and additional information are deleted within 48 hours.

An error route exists and is specific: a rating and comment field for reporting inaccuracy in the suggestions, which the vendor says feeds product improvement and model learning.

Parts of the structure are still unpublished. No confidence signal or flag marks an uncertain passage, so the mandatory check is uniform rather than targeted. No threshold is described at which the assistant would decline to generate. And nothing states what happens once a validated note is found to be wrong.

The telephone assistant is the more consequential of the two. It answers calls around the clock, categorizes the inquiry, and transfers appointment bookings directly into the practice system, which is an action taken in a system of record without a person in between. A misunderstood request produces a wrong booking, a missed urgent call routed as routine, or an appointment made for the wrong person, and none of those announces itself at the moment it happens. Nothing published describes what it will not attempt, how it recognizes a caller who needs a human immediately, whether a patient is told they are speaking to software, or what a practice sees to audit what was decided overnight.

Provenance of the core speech technology is unusually traceable: it came from Typeless, a spin off of EPFL and the Idiap Research Institute specializing in speech recognition, acquired June 2024, and the documentation capability is described as large language model based. Naming the acquired research lineage shows where the capability actually originates, rather than leaving a generic AI claim to be taken on trust. No model detail, accuracy measurement or validation methodology is published for the deployed assistants.

Substantial partial disclosure, with the model layer for this product still unnamed.

The patient privacy policy, dated April 2026, publishes a subprocessor annex giving each party's country of origin, server location and task. Health data is hosted by Amazon Web Services in the European Union and by S3NS in France, and Atos France hosts the company's encryption key. Microsoft Azure is listed for research and development processing. Microsoft Azure, Google and Anthropic are listed as providing the AI model for the Assistant Santé, which is the patient facing health assistant, not the consultation assistant. The speech technology behind the consultation assistant came from Typeless, acquired in June 2024.

The annex does not say which model the consultation assistant uses, and whether it runs on a model built in house, on one of the listed providers, or on another. The patient assistant's providers say nothing either way about the clinical one.

Platform scale is exceptional and it is not evidence for the AI features.

The company is the dominant digital health infrastructure provider across three large European markets, spanning booking, practice management and clinical records. That footprint is real and it means distribution for anything the company ships is immediate. It says nothing about whether the AI capabilities work.

What is published about those capabilities is a single vendor stated operational figure, that practices can save up to ten hours per week on administrative tasks, without a baseline, a denominator, a method or a cohort. Up to is a ceiling rather than a result. The documentation capability derives from an acquired research spin out with an academic pedigree, which is a reason for confidence in the underlying speech technology and is not a clinical evaluation of the product.

There is no published study, accuracy measurement for generated clinical text, error rate for the telephone assistant's categorization or independent evaluation. That matters especially for a documentation product, because the output becomes part of a patient's medical record and is relied on by whoever reads it next.

Adoption of the platform is not evidence for a recent capability layered onto it.

Retention, training use and de identification are each stated specifically enough to be contradicted.

Retention: audio is not kept after the consultation, transcripts and suggestions are kept for 48 hours so the clinician can validate or correct them, and validated content then follows the retention of the practice's record. Training: consultation recordings, transcripts and validated summaries are reused to train models only with the patient's consent, given or refused in their own account and withdrawable at any time, and consent for children under 18 sits with the account holder. De identification: voice is pseudonymized before any development use, with substitute identifiers in place of names, and in some cases fully anonymized; that data is kept for three years from collection. Processing and storage are on certified health data servers in France and Germany.

The patient privacy policy makes explicit consent the basis for research on health data unless the processing rests on public interest, so consent is not the only route it reserves. Separately, the practitioner page says audio is not kept while the consent program reuses audio, and nothing published explains how consented audio is retained when non consented audio is not.

On safety engineering the position is narrow but not empty. The vendor names the failure mode: its clinician instructions state that generated notes may contain elements that were not said during the consultation or may omit information, and it publishes a rating and comment route specifically for reporting inaccuracy. What it does not publish is mitigation. No guardrail, no confidence signal or abstention behavior, and no process for handling a safety event once one has occurred. Naming the failure and requiring a human to catch it is an oversight control rather than engineering that reduces the failure.

Doctolib documents its position under the European regime that governs it, and in depth. It does not appear to operate in the United States, so the absence of a business associate posture is correct rather than a gap.

The patient privacy policy, dated April 2026, names the instruments (the general data protection regulation and the French data protection act), sets out when Doctolib acts as controller and when it acts as processor for the practice, and lists the consultation assistant among the processor services: transcribing the consultation, proposing notes, and updating the record after the clinician validates them. It names a data protection officer and publishes a subprocessor annex with country of origin, server location and task for each party, including the health data hosts and the holder of its encryption key.

The practical consequence of the processor role is stated plainly: for consultation data, a patient's rights requests go to the practice, and Doctolib can assist the practice but cannot answer the patient directly. A practice adopting the assistant inherits that work.

The practitioner data processing agreement that governs the assistant is not published.

A European security posture organized by jurisdiction, because health data hosting in Europe is regulated nationally rather than harmonized.

The company holds the international information security management standard certified separately in two of its markets, the privacy information management and cloud personal information extensions to it, the French health data hosting certification in its own name since October 2021, the German federal cloud computing criteria catalog, an Italian national cybersecurity qualification, and further third party assessments. It publishes a dedicated certifications document. Auditing is by an internationally recognized certification body, with annual surveillance audits and full renewal every three years, and the company states that cycle openly rather than implying certification is permanent.

One published statement stands out because it argues against the company's own marketing interest. In announcing the certifications, the company wrote that they do not demonstrate a specific level of security, that its hosting provider already complied with both, and that it pursued them in its own name anyway to be exemplary and transparent. That is the inherited certification problem stated by a vendor about itself, rather than a host's credentials presented as its own.

Still unpublished are the scope of each certificate across the platform and the AI capabilities specifically, and any penetration testing disclosure.

The classification of ambient documentation in Europe is contested and market specific. What the vendor does publish is an intended purpose, in its own words. Its clinician instructions state that the Assistant de consultation is designed to facilitate note taking on the basis of a conversation with the patient, and that checking the entire generated summary before validation is mandatory because the output may contain things that were not said or may omit things that were. That is a stated purpose with a stated limit, and the marketed capability matches it: the assistant drafts, the clinician validates, and nothing enters the record unvalidated.

No clearance, classification or conformity assessment is claimed for either AI capability. Doctolib holds substantial certification elsewhere, including the French health data hosting certification in its own name, but health data hosting is a security regime rather than a device one and says nothing about device status.

The same ambient product can face different regulatory treatment depending on where it is sold, and a vendor operating under a stricter reading carries obligations on clinical evaluation, post market surveillance and change control that others do not.

Disclosure is mature in the established domains of security and privacy and has not yet been extended to the AI layer. No governance framework, model documentation or evaluation is published for the AI capabilities.

Three domain questions apply and none is addressed.

The first is language. The platform operates across three countries and the documentation capability converts spoken clinical dialogue into structured medical text in each. Speech recognition and clinical text generation degrade with accent, dialect, speech rate and code switching, and a doctor practicing in a second language or a patient speaking one is exactly the situation where a scribe is most useful and least reliable. Nothing published reports accuracy by language or speaker characteristic.

The second is the telephone assistant, which categorizes incoming inquiries. Categorization determines what happens next, and a caller whose speech the system handles poorly experiences it as a practice that does not answer the phone properly.

The third is regulatory rather than technical, and this vendor sits inside it. European regulators treat ambient documentation tools as medical device software, and the European artificial intelligence regulation places obligations on providers of such systems including risk management, data governance and post market monitoring. A vendor the size of Doctolib, operating across three member states, will be inside that regime.

Two things stand in its favor: a real review step, and the fact that the company addresses the recorded patient directly.

The consultation assistant proposes notes, and the record is updated only after the clinician validates them; the clinician can listen to the conversation again and correct the transcript or the summaries. Practices are told to inform patients that consultation audio is being captured, with a poster the company supplies or orally beforehand, and the patient can object to its use at any time. Patients are also asked directly, in their own account, whether their consultation recordings may be reused to train models.

Nothing stands behind the clinical output itself. No accuracy or error figure, no warranty and no remediation commitment for the assistant is published.

On encryption there is a partial answer. Audio is processed on certified health data servers in the European Union, exchanges are encrypted, and the encryption key is held by a French provider, so the content is readable by the service during processing rather than end to end encrypted from the practice.

Patients hold rectification rights under European data protection law, and for consultation data those run to the practice rather than to Doctolib.

Distribution is the whole argument and it is structural rather than a partnership. Because Doctolib already operates the appointment system, practice management, and record for a large share of practices in its markets, ambient documentation arrives inside the workflow rather than beside it, and the telephone assistant transfers bookings directly into the same system. A standalone scribe must integrate to reach that position; Doctolib starts there. That advantage is confined to its own installed base, which is the correct caveat.

Residency is answered with real specificity, and the questions beyond it less so.

What is published: data is hosted with a named cloud provider in data centers identified by city, in Frankfurt and Paris, so health data remains on European Union territory for storage, and the patient privacy policy adds S3NS as a second host in France and Atos France as holder of the encryption key. The hosting entity holds the French health data hosting certification, and so does the company itself. That second point is easy to miss: the certification attaches to the party hosting the data, and a software publisher that handles health data must be covered in its own right rather than relying on its host's certificate. Holding both is the correct structure and the company can show it.

The sovereignty question has also been litigated rather than merely asserted. A challenge concerning the use of a cloud provider belonging to a United States group was brought before the French supreme administrative court in 2021 and rejected at the interim stage. The privacy policy itself states that the host's United States parent may be compelled to provide access under United States law.

What is not published: the tenancy model separating one practice's data from another's. A subprocessor annex is published with the patient privacy policy.

The French hosting certification framework has since been revised, with a compliance deadline falling in 2026.

Pricing for the AI capabilities is not published. The company reports practices can save up to ten hours per week on administrative tasks with the AI enabled practice software, which is a vendor stated efficiency claim rather than a price. It is not stated whether the Consultation Assistant and the AI assistants carry incremental cost above an existing Doctolib subscription.

The administrative AI covers booking and front desk work: appointment booking across the platform, and a telephone assistant that answers calls around the clock, categorizes inquiries and transfers appointment bookings directly into the Doctolib system. The platform is broad but the AI practice management product is not yet: it launched in November 2025 for general practitioners, pediatricians, and gynecologists, with further specialties stated as planned. Outside those three specialties, platform level coverage is no sign that the AI assistants are available. Geographic scope is France, Germany, and Italy.