Droxi

The model is the engine of the inbox's language work, and the platform carries value beside it. Droxi Unbox summarizes faxed consult notes and clinical documents, extracting diagnoses, treatment plans and medication changes with each point linked to its source text; writes plain-language lab notes; and for abnormal or borderline results generates a provider summary and a suggested patient message from the newest labs and the patient's history.

Those capabilities do not exist without a learned model. Other parts of the product are functions rules can perform and are described that way: normal results auto-close 'based on your settings', refill requests arriving by fax, portal or e-prescription are consolidated with medication history, last refill date, recent labs and diagnoses, and duplicates are flagged. Droxi Unlock, the second product, identifies Medicare patients eligible for Advanced Primary Care Management and supports enrollment and documentation.

The oversight structure is described for each item type, with the scope of what runs without review published. Normal lab results auto-close 'based on your settings' with a patient notification the practice words, and the product page says this includes results 'slightly outside reference ranges when clinically insignificant'; the FAQ says the practice controls which results auto-close and how patient messages read.

Abnormal or borderline results go to the provider with a summary and a suggested patient message. Refills are laid out for the provider ('The decision stays yours'), and document summaries link each point to the source text for the provider to check. Droxi publishes how much runs unattended: 38 percent of routine work handled automatically, illustrated in the FAQ by one clinic closing 172 of 455 lab review items in a single week.

The terms add that AI-generated summaries and suggestions must be reviewed by qualified personnel before being relied upon. What is missing is what happens after the gate is wrong: no audit or sampling of auto-closed results is described, no result type is named as never closing automatically, and no rate is published for results closed as insignificant that should have reached a provider. The FAQ line 'You still make every clinical decision' describes the configured policy; on the auto-closed side the provider's decision is the setting, made in advance.

No model is named, no model card exists, and there is no statement of whether foundation models are first party or licensed, nor any published methodology for how clinical insignificance is determined. The source traceability the product offers is real, but it makes outputs auditable rather than explaining how the system works.

The architecture is described and no model provider is named. The FAQ says data is processed in real time inside the customer's record system and not stored separately. The privacy policy (updated 10 June 2026) says Droxi may engage third parties to provide the Service, naming the kinds of work (scheduling, analytics and hosting) but no company, and binds them not to use the information for other purposes; the terms say Droxi and its licensors own the Service's software and models, which leaves open whether any model is licensed. No subprocessor list is published, and no model provider, hosting provider or region is named.

The headline claims are 5.1 or more hours back per provider each week, a 51.9 percent reduction in after hours clinical inbox work, and 38 percent of routine work handled automatically. No method, baseline, period or site is given for the first two. The third is illustrated in the FAQ by one count: Dr. Brandon Zabukovic's clinic (South Bend) closed 172 of 455 lab review items in a single week, with no date for the week.

Named clinicians at Blue Ridge Health, Valley Health, Salience Health and South Bend give testimonials (one calls the summaries accurate), and two athena Marketplace reviews are quoted without names. Case studies for Blue Ridge Health, Valley Organized Physicians and South Bend sit behind a download form and may carry more detail.

No peer reviewed study or outside evaluation is published, and nothing measures the two things a tool like this most needs measured: how often an automatically closed result should have reached a provider, and how often suggested patient messages go out unedited.

Categorical commitments are published without a retention schedule behind them. The FAQ says Droxi processes data 'real-time inside your EHR so we don't need to store it separately', that patient data is encrypted in transit and at rest with access limited and activity logged, and that 'Droxi processes data solely to provide the service - it is never sold or used for unrelated purposes.'

The privacy policy (updated 10 June 2026) says Droxi acts as a business associate, processes protected health information only as the business associate agreement permits, and retains and returns or deletes it under that agreement and the customer contract. The same policy lists improving and developing the Service among the uses of information it collects, and nothing says whether patient data trains or improves the models.

No retention period is stated, the 'not stored separately' line and the policy's retention clause are not reconciled, and de-identification is not addressed. Safety engineering, meaning guardrails on generated summaries and patient messages, hallucination mitigation and how a safety event is handled, is not published.

Business associate status is stated and supported. The FAQ says 'Droxi enters into a Business Associate Agreement with every customer organization before any protected health information is processed', which also answers the tier question: every customer.

The privacy policy (updated 10 June 2026) says Droxi acts as a business associate for the platform and processes protected health information only as the agreement permits, and the terms of service say processing is governed by that agreement and that none should be submitted without one. The agreement itself is not published, so a buyer cannot read it before contracting or confirm that it binds subcontractors.

Controls are asserted with nothing independent behind them. The home page and FAQ say Droxi is 'HIPAA compliant with enterprise-grade security', that patient data is encrypted in transit and at rest, that access is limited to authorized personnel, and that activity is logged and monitored; the privacy policy (updated 10 June 2026) cites administrative, technical and physical safeguards consistent with industry standards and the HIPAA Security Rule. No SOC 2 report, HITRUST or ISO/IEC 27001 certification, penetration test or trust center is named on the home, product, FAQ, about or resources pages or in the privacy policy and terms.

No clearance is claimed and no regulatory position is stated. The terms of service call the Service 'a workflow and clinical decision-support tool' that 'does not provide medical advice, diagnosis, or treatment', make providers solely responsible for clinical decisions, and say AI-generated summaries and suggestions must be reviewed before being relied upon. That is a responsibility clause, not a regulatory analysis.

Beside it, the product page says Droxi 'automatically closes normal lab results, even those slightly outside reference ranges when clinically insignificant, and sends a customizable message to your patient.' The FAQ puts that sort in the practice's hands: results auto-close 'based on your settings', and the practice controls which results auto-close and how patient messages are worded.

Abnormal or borderline results go to the provider with a summary and a suggested patient message, and every recommendation is traceable to the source data. The tension is on the closed side: a result closed as insignificant, and the message the patient receives about it, is never seen by a clinician, which the terms' review sentence does not reach.

There is no public account of how the AI's behavior is governed or tested. The site, its privacy policy and its terms carry no responsible AI policy, no evaluation of how accurately results are judged clinically insignificant or how faithfully documents are summarized, and no results by patient group, lab type or document type.

The terms' requirement that AI-generated summaries and suggestions be reviewed before reliance is an instruction to users, and the source links on summaries are a check at the point of use; neither says how the model is tested. The product closes results without review, yet nothing published says who checks its classification accuracy or summary faithfulness.

Droxi Unlock, sold on the same platform, identifies patients for a Medicare program the practice bills, so the vendor reading the chart also selects patients for enrollment, and no checks on those determinations are described.

Source traceability is the mechanism, and nothing stands behind the output. The product page says every lab recommendation is traceable to the source data and every document summary point links to the source text in the original, so a provider can check an output against the record before acting; refills are laid out for the provider to decide, and the terms say AI-generated summaries and suggestions must be reviewed before reliance.

The terms of service then disclaim all warranties, say the Service is provided 'as is', cap liability at twelve months of fees, and run indemnity from the customer to Droxi, not the other way. No accuracy or error rate is published for auto-closed results or summaries, no remediation commitment attaches to the output, and no route is described for a patient whose result was closed when it should not have been; privacy requests about patient information are directed to the provider.

Runs natively inside the EHR with no separate login and no parallel application, and is listed on the athenahealth Marketplace with public customer reviews, which is evidence of a working production integration rather than an asserted one. athenahealth is the only EHR named anywhere in public materials. Within that scope, refill intake is multichannel, consolidating requests arriving as fax, portal message or electronic prescription into one queue, which is more than a single API surface.

A single hosted service with location implied rather than committed. The FAQ says Droxi processes data in real time inside the customer's record system so it does not need to store it separately, and the privacy policy (updated 10 June 2026) says protected health information is retained and returned or deleted under the business associate agreement and that hosting is among the services third parties provide.

No hosting provider, region, tenancy model or on premise option is stated, and nothing says where processing happens. Droxi AI Ltd.'s terms are governed by Israeli law, and its named customers are in the United States.

Neither product carries a published price, and every commercial route is a booked call. The shape of the sale is public even so: the terms of service say fees are set in an order form for a subscription term and are nonrefundable unless the order form says otherwise, Droxi Unbox and Droxi Unlock are sold as two products, and implementation is described as minimal with setup support.

The one dollar figure on the site is a payer rate, not Droxi's price: 'CMS pays roughly $16 to $116 per patient per month, depending on tier' for the Advanced Primary Care Management program Unlock supports. That is revenue the practice bills, so the benefit side is quantified and the cost side is not.

Scoped to primary care ('built specifically for primary care providers') and to three inbox item types: lab results, refills and clinical documents, with a separate page for health centers. The site names Blue Ridge Health, Valley Health and Valley Organized Physicians, Salience Health in Texas and Primary Care Partners of South Bend.

It also names Aspire Rural Health System, Northern Counties Health Care, Stedman-Wade Health Services, Borum Family Health Clinic, CPC Center for Primary Care and Rainbow Pediatric, a list that spans rural and community health centers and a pediatric practice. Validation sits behind part of it: the FAQ's South Bend count (172 of 455 lab review items closed in a week) and named clinicians at four of those organizations. It does not claim inpatient, emergency or specialty inboxes, or the general portal and staff message traffic that makes up the rest of a clinical inbox.