Flexbone

Models are the engine of the core modules, on a platform that carries value of its own. The home page describes voice agents that answer and place calls and handle scheduling, intake and triage routing; document agents that extract and classify faxes, insurance forms and clinical notes; and an intelligence layer that surfaces patterns across operations, with the agents trained on each customer's own calls, documents and workflows. Those are model driven.

Alongside them sit browser and desktop agents that operate portals and legacy applications the way staff do, an integration layer into record systems, telephony and contact center platforms, and a forward deployed team that audits, builds and maintains each deployment. Driving a portal is closer to scripted automation than to inference, and the integrations and services would remain with the models removed.

An oversight structure is described, with its threshold unpublished. Deployments start with an audit and mutual sign off on what is automated and what stays with staff, then a supervised pilot week in which the customer's team reviews transcripts, escalation paths and the work written back into its systems before fees apply. In production, agents route exceptions to staff, every action is logged, and the dashboard shows each automated action; the demonstration feed shows a confidence score on a document extraction. A customer quote describes an AI coordinator handling confirmations, rescheduling and follow ups without any staff involvement.

What is missing is where the line sits. The confidence level or conditions that send a call or document to a person are not published, and nothing describes what happens after an agent writes something wrong into a record or resubmits a claim that should not have gone. Agents also run post operative check calls and nurse triage routing, where the escalation criterion matters most. How much of the work ends up with a person is not reported.

Three layers are described and nothing in them is identified. The home page sets them out: an integration layer into record systems, telephony, contact center platforms and legacy applications through REST and GraphQL interfaces, HL7 and FHIR, SIP, SFTP, direct database connections and automation hooks; an agent layer of voice, document, browser and desktop agents trained on the customer's own calls, documents and workflows; and an intelligence layer for analytics and decision support. The features menu names a voice state machine. After deployment the company says it monitors, surfaces new patterns and retrains on edge cases.

No model, model family or provider is named, no accuracy figure is published beyond a confidence score shown in a demonstration feed, and nothing describes how retraining is versioned or how a customer learns that an agent's behavior has changed.

Nobody behind the models is named. The home page describes voice, document, browser and desktop agents on an integration layer into the customer's record, telephony and contact center systems, and the privacy policy says data is shared with vendors and service providers including hosting, analytics and transcription providers, some possibly outside the United States under standard contractual clauses. Google Analytics is the only provider named, and that is for the website. No speech recognition, language model or hosting provider is named, and no subprocessor list is published, though the security page describes a vendor management program with security assessments and an active vendor list.

A call handled by a voice agent typically crosses telephony, transcription, a language model and the platform, and each is a party that may receive protected health information.

Figures from described but unnamed customers, with no method behind them. The home page reports a 73 percent reduction in no shows at a 40 provider multi specialty group in the south eastern United States, from 30 percent to single digits within the first month; a 40 percent reduction in call handle time at a national pharmacy benefit manager's contact center; and eligibility verification averaging 12 minutes at an orthopedic surgery center network, against 45 minutes per patient before. Each is the company's report of a customer's result, with no customer named and no period, volume or baseline beyond the quote.

No independent evaluation, publication or named reference appears, though a case studies page may name some.

A categorical commitment on training, with retention left open. The home page says customer data never leaves the customer's environment for model training and is never used to train models for other clients, while agents are trained on each customer's own calls, documents and workflows. The privacy policy says data collected for a specific purpose, such as voice transcription or eligibility verification, is used only for that purpose.

The same policy says the company may collect operational data such as audio recordings and EHR snapshots when a customer uses its services or pilots, keeps personal information as long as necessary for its purposes, shares it with vendors including hosting, analytics and transcription providers, and may transfer it abroad under standard contractual clauses. No retention period is given for call recordings, transcripts or record snapshots, and nothing says whether derived data persists after the raw data is deleted. The transcription providers that receive audio are not named.

A signed business associate agreement is promised and a privacy document reaches the service, but the agreement is unpublished. The security page says the company signs a HIPAA business associate agreement, encrypts protected health information in transit and at rest, applies role based access with single sign on and audit logging to every system that touches it, and scopes and logs data exchanged with record systems such as Epic and athenahealth, payer portals and clearinghouses, including claim and remittance files. The privacy policy covers the website and the company's other digital properties and addresses operational data, such as audio recordings and EHR snapshots, collected in services and pilots.

No agreement or template is published, and the policy allows transfers to service providers outside the United States under standard contractual clauses without saying whether protected health information is included. Which subcontractors the agreement binds, transcription providers included, is not stated.

Controls are described in detail and nothing independent stands behind them. The security page states the company is SOC 2 Type II aligned and designs its program around the SOC 2 Trust Services Criteria, and it lists the controls: protected branches and reviewed changes, role based access with quarterly reviews and revocation within 24 hours, enforced multi factor authentication, VPN for production access, segregated environments, vulnerability scanning, tested backups, incident response procedures, vendor security assessments and eleven named policies. It also states AES-256 encryption and a 99.9 percent uptime service level.

Aligned is the operative word: it describes controls the company has designed, not an auditor's finding that they operated over a period. No SOC 2 report, auditor, examination period, HITRUST or ISO certification, or independent penetration test is published; compliance documents are offered on request.

There is no clearance, authorization or submission, and none is needed. Answering telephones, checking eligibility and appealing denials is administrative work. The regulatory exposure that does attach is again not device law: automated claim correction and resubmission sits inside payer contracting and, at its outer edge, federal false claims liability, where the submitting provider carries responsibility for accuracy however the claim was produced.

Prior authorization automation likewise operates inside payer rules that vary by contract. A device framework is the wrong statute for this product; the live issues are claim accuracy controls and audit trails.

Nothing published on how agent behavior is governed or tested. The company says it keeps monitoring after deployment, surfaces new patterns and retrains on edge cases, which describes improving performance rather than governing it: no evaluation method, error rates, drift thresholds, subgroup analysis or accountable owner is named.

Two exposures are specific. Voice agents answer and place calls for scheduling, intake and triage routing, and speech recognition accuracy varies with accent, dialect, first language, age and emotional state; no per language or per group performance is published. And agents run post operative check calls and nurse triage routing, where what counts as abnormal enough to reach a clinician is a threshold somebody set; no validation of it, false negative rate or clinical sign off is published.

Mechanisms exist to trace an output, and nothing published stands behind it. Every agent action is logged with traceability across agents, the dashboard shows each automated action, and a supervised pilot lets the customer review transcripts and the work written back before fees apply. The security page's 99.9 percent uptime service level concerns availability, not whether an output is right.

The pricing page raises one possibility without committing to it: where results are measurable, part of the price can ride on outcomes, for example completed bookings rather than handled calls. That would put fees at risk against a result, but no measure, baseline or share is published, so it is an option rather than a commitment. No accuracy figure, warranty, indemnity or remediation term is published, and no customer terms appear on the site.

The actions carry consequences: agents write appointments and notes into records, verify eligibility and work denials and claim files, and a claim submitted wrongly is the provider's liability.

Named systems with reading and writing described, and nothing a buyer can verify independently. The home page names Epic, athenahealth, AdvancedMD, Dentrix and ModMed among record systems and Genesys, Five9 and NICE among contact center platforms, and describes connection through REST and GraphQL interfaces, HL7 and FHIR, SIP telephony, SFTP, direct database connections and automation hooks. Agents are described as reading, writing and acting inside those systems, logging appointments and follow ups to the record, and the security page says exchange with Epic, athenahealth, payer portals and clearinghouses, including claim and remittance files, is scoped and logged. Where no interface exists, browser and desktop agents operate the application the way staff do.

None of it is evidenced beyond the company's description: no marketplace listing, integration documentation or named production site is published. Nor is it said how an automation is maintained when a portal or screen changes.

A hosted service with a United States base, and nothing committed about where data rests. The privacy policy says the company is based in the United States and may work with service providers in other countries, transferring data under standard contractual clauses; the security page states a 99.9 percent uptime service level and segregated environments; and the home page says the platform connects into the customer's own systems and that customer data never leaves the customer's environment for model training. No hosting provider, region, residency commitment or tenancy model is named, and nothing says which components run in the customer's environment and which in the company's.

The forward deployed model, with the company's engineers embedded in each customer's operations, is part of the delivery, which makes access by the vendor's staff part of the design.

A pricing basis with figures is published, and the route in is an audit. The pricing page, reviewed September 2026, prices voice agent engagements as a monthly platform fee, typically $2,000 to $8,000 depending on the call types in scope and integration depth, plus usage of typically $2 to $6 per completed call, declining at higher volume tiers. Implementation is typically included, fees start after a supervised pilot week, pricing ramps as coverage grows, and part of the price can be tied to outcomes, such as completed bookings, where results are measurable. Multi site and custom compliance deployments are quoted individually, and revenue cycle and back office engagements are scoped in the audit.

The figures are ranges rather than tiers, and every quote comes from a free audit, so there is no route to start without a conversation. What counts as a completed call is not defined.

Wide across outpatient front desk and revenue cycle functions, with validation that rests on unnamed customers. Healthcare work spans call handling, scheduling, intake, triage routing, reminders, post operative follow up, eligibility verification, prior authorization, denial appeals and contact center operations, for health systems, provider groups, orthopedic practices, surgery centers and dental and oral surgery. The company now also sells the same platform to public safety agencies, logistics carriers and insurance agencies, though its privacy policy still describes it as a healthcare automation company.

The home page quotes a multi specialty group, a pharmacy benefit manager's contact center and an orthopedic surgery center network, none named. Geography is the United States.