Eleos Health

The NLP engine is the product. There is no services layer or staffing bureau underneath, and the company describes proprietary voice based natural language understanding built by clinical experts and trained on a large corpus of real-world treatment sessions. The behavioral-health-specific training data is the moat rather than a generic model with a healthcare wrapper, which is what separates this from horizontal scribes pointed at therapy.

Consistently framed as augmented intelligence rather than autonomous, and the company publishes the number that makes the claim checkable: providers accept roughly 80 percent of documentation suggestions, which means one in five is edited or rejected. Publishing an acceptance rate is a rare and useful autonomy disclosure, because it quantifies how much human correction the workflow actually requires rather than asserting that a human is in the loop. Compare CodaMetrix, graded down precisely because its human routing threshold is not published.

The approach is named specifically: voice based natural language understanding, session content decomposed into micro-dialogues, and identification of empirically supported interventions directly from the session. Methods appear in peer reviewed publications, which is more checkable than a marketing description. Graded B rather than A because no model card, base model disclosure or error profile by clinical population is published, and the accuracy figures are reported at aggregate level.

Better than most of this lane on both halves of the axis without reaching the top of either. On where content goes, the cloud provider is named and the residency position is expressed as a commitment rather than a default: storage and processing only on eligible infrastructure within the continental United States, with support for deployment to designated regions and a stated guarantee that data will not move outside the region originally designated.

A residency guarantee phrased as an undertaking is rare in this index and it is materially stronger than a statement of where servers currently sit. On whether content persists, session audio and transcripts are processed in real time and deleted shortly after the session, with audio analysed without producing a full transcript at all, so the most sensitive artefact is largely never created. Logical separation between clients is stated.

Held below the top grade because the model layer is unnamed, with no foundation model provider, class or version identified, and no sub processor list was located. One question follows directly from the deletion policy and is not answered by it: the policy covers audio and transcripts, while the retained artefacts are generated suggestions and derived text, and nothing states whether those are used to improve models or whether a customer can decline. Ask that, and ask for the sub processor list.

The deepest published evidence base of any documentation adjacent vendor in the index, and one of very few anywhere in it with a randomised trial. A randomised clinical trial at a community based clinic, published in the Journal of Medical Internet Research, compared the platform against treatment as usual for 47 adults in outpatient CBT for depressive or anxiety disorders and reported roughly double attendance and three to four times greater symptom improvement. A separate JMIR study validated a machine learning model predicting assignment of therapy homework, and a real world accuracy study evaluated performance across more than 2.83 million micro dialogues.

Two caveats a buyer should carry. The randomised trial is small at 47 participants and was conducted at a single community clinic, so it is a feasibility and preliminary efficacy study rather than a definitive one, and the headline outcome multiples are quoted in marketing without that qualifier.

The evidence is real and unusually good for this category, but the effect sizes are early.

Corrected from Not Rated. The previous note recorded no published detail on retention, de identification or training use, and observed correctly that this axis carries more weight in behavioural health than anywhere else in the index because the raw input is recorded psychotherapy. The company does publish a position, and it is a strong one.

The retention decision is the one that matters and it is made in the right direction. Eleos states that session audio and transcripts are processed in real time and deleted shortly after the session concludes, with only the elements needed downstream retained, being the generated suggestions and minimal session identifying information. It further states that audio is analysed in real time without producing a full transcript. For a system sitting inside a therapy room, discarding the recording rather than retaining it is the single most consequential control available, and it is stated plainly rather than implied.

Residency is specific too. Data is stored and processed only on eligible Amazon Web Services infrastructure within the continental United States, and the company states it supports deployment to designated geographic regions with a guarantee that data will not move outside the region originally designated. A residency guarantee expressed as a commitment rather than a default is rare in this index.

Access controls are stated at the level a reviewer can test: least privilege, single sign on and multi factor authentication, and logical separation of data between clients.

One question is not answered and it is the same one left open by peers elsewhere in this index. Nothing retrieved states whether customer sessions, generated suggestions or retained text are used to improve the models, or whether a customer can decline. Given that the retained artefacts are clinical content derived from psychotherapy, that is the natural next question and it should be settled in the agreement rather than assumed from the deletion policy, which covers audio rather than derived text.

Corrected from Not Rated. The previous note recorded that no business associate agreement terms were located. Eleos states that its privacy policy and its business associate agreement are both available on its security page.

Publishing the instrument is the route to an A in this index and very few vendors take it. The reasoning is the same one applied to GRAIL: a buyer, and in principle a clinician, can read what governs the relationship before entering it rather than discovering the terms in a procurement cycle. Alongside it the company states HIPAA compliance and also FERPA compliance, the latter reflecting school based behavioural health work, which is a scoping detail worth knowing since it means the platform operates under two different federal confidentiality regimes depending on the setting.

The role is straightforward. The provider organisation is the covered entity, Eleos processes protected health information on its behalf, and it is a business associate.

The gap is 42 CFR Part 2 and it is the standing question for this whole category. Substance use disorder records carry stricter confidentiality than the general health privacy rule, requiring specific patient consent for disclosures that would otherwise be permitted for payment and operations, and restricting redisclosure downstream. The modernised framework reached its enforcement date on 16 February 2026. Eleos sells into community behavioural health organisations serving Medicaid populations, which is precisely where substance use treatment sits. Nothing retrieved states whether the platform segments Part 2 records out of automated processing or how consent is tracked.

Ask for the Part 2 position in writing before contracting, and ask which federal regime the vendor treats as controlling in a school based deployment.

Corrected from Not Rated. The previous note recorded that no third party attestation was retrieved at the time of review. Eleos publishes one of the deepest compliance stacks in this index, on its own site and trust centre.

Held: SOC 2 Type II with the type stated, HITRUST certification, ISO 27001, ISO 27799 and ISO 42001. Supporting controls are specific rather than gestural: an independent agency contracted for annual penetration testing plus automated vulnerability monitoring, single sign on and multi factor authentication, access on least privilege, and logical separation of data between clients.

ISO 42001 is the reason this sits at A rather than merely being a long list. It is the artificial intelligence management system standard, and it is the only credential in common circulation that examines how an organisation governs its models rather than how it protects its data. Very few vendors anywhere in this index hold it. In a category with no product regulator, an external audit of the AI management system is the closest available substitute, and holding it is a substantive position rather than a badge.

Two qualifications a buyer should note. Full documentation, including the attestation report, sits behind a request gate rather than being downloadable, so procurement can get it but a smaller practice evaluating alone cannot self serve. And the wording is inconsistent across the company's own pages: the homepage correctly names SOC 2 Type II, while the frequently asked questions page says SOC 2 certified, which is not a thing that exists, since SOC 2 produces an attestation report from an accounting firm with no certifying body or registry. The same page also refers to a Deloitte certification, which appears to name the auditor rather than a standard.

Substance is strong and the phrasing is loose. Grade the substance and flag the phrasing.

Converted from Not Rated. The prior note already contained the correct analysis and simply had no grade attached, which is the reflexive Not Rated this index rules against. Where the Food and Drug Administration is inapplicable, grade against the regime that actually governs and say so.

The scoping holds. This documents and analyses sessions and surfaces insight to clinicians and supervisors. It does not diagnose or direct treatment, so it sits outside software as a medical device, the same treatment applied to Mendel. No clearance is needed and its absence is not a deduction.

What governs instead is threefold. Payer documentation and audit compliance is the primary surface, and the company productises it directly rather than leaving it to the customer. State Medicaid oversight applies, since the buyer base is community behavioural health organisations operating under state and federal review. And school based deployments bring a second federal confidentiality regime into range.

The grade sits at B rather than C because of an external credential that is unusual here. ISO 42001 certification is an audited artificial intelligence management system standard. In a category with no product regulator, an independent examination of how the organisation governs its models is the nearest available equivalent, and holding it is more than most vendors in this position can show.

It sits at B rather than A for two reasons. It is a management system certification rather than an assessment of the product against a clinical or operational standard, so it says how the company governs rather than how the system performs. And no position is published on 42 CFR Part 2, which is the specific federal regime most likely to bind a behavioural health platform serving Medicaid populations.

Standing ask for this category: does the vendor hold an accreditation or external review of the compliance function itself, and what is its written Part 2 position.

No demographic subgroup performance analysis located, and the exposure here is specific rather than generic. Speech recognition and language models are documented to perform unevenly across accent, dialect and speech patterns, and this system listens to psychotherapy sessions with clients who may have thought disorder, medication effects on speech, or intoxication.

Multilanguage support across 150 languages is a genuine access feature but is not the same as published performance parity, and auto-translating notes into English introduces a second unexamined error surface.

The route into this band is published method, and in this segment that is worth more than it would be elsewhere. The approach is described specifically rather than adjectivally, with session content decomposed into micro dialogues and empirically supported interventions identified directly from the session, and the methods appear in peer reviewed publications rather than on a marketing page.

That means an outside reader can examine how the system claims to work and what it was measured against, and a contradicting result would mean something. Almost nothing else in behavioural health documentation offers that. Held below the top grade for two reasons, and the second is specific to this population rather than generic. No warranty, indemnity or remediation commitment was located, so the disclosure is transparency rather than accountability.

And the accuracy figures are reported at aggregate level, with no error profile by clinical population. In behavioural health an aggregate figure conceals exactly the variation that matters, because the system is applied across presentations that differ in speech rate, affect, disorganisation, intoxication and language, and a model that performs well overall can perform poorly on the presentations where documentation matters most. Ask for performance broken down by presentation type, and for what the vendor commits to when a note or an intervention identification is wrong.

Structurally different from per-integration competitors and the difference is real. The platform embeds via a lightweight browser extension, making it EHR agnostic rather than dependent on a build per system, which the company frames as enabling rapid implementation without workflow disruption.

Third party listings enumerate compatibility across the behavioral health EHR landscape including Carelogic, Credible, InSync, SmartCare, MyAvatar NX, MyEvolv, EchoVantage, PCE, Kipu, Welligent, eHana and Exym. Behavioral health runs on a long tail of specialty EHRs that horizontal scribes typically cannot reach, so agnostic embedding is a genuine moat in this category specifically.

Browser-embedded SaaS spanning in-office, telehealth and field based settings, with the Outreach product built specifically for providers who travel to clients. Broad coverage of where behavioral health actually happens. No data residency or hosting architecture disclosure located.

No pricing published and no pricing basis disclosed; third party listings confirm pricing is available only on request and that the product targets mid-market and enterprise behavioral health organisations. The outcome claims are quantified but the commercial terms are not, which is the inverse of BrainCheck in the same batch.

Genuinely broad within its vertical: behavioral health, substance use disorder treatment, home health and hospice, spanning individual and group therapy, peer support, case management and prescriber workflows, across office, telehealth and field based settings. It also targets distinct user classes rather than only clinicians, including supervisors, organisational leadership and audit and compliance teams, and supports CCBHC certification and SAMHSA grant reporting workflows. That is unusual depth for a single vertical.