Huma

Huma sells a regulated platform that hosts intelligence and ships some of its own. The company now calls itself an operating system for AI in regulated industries and names AI products (Huma Intelligence, the Hi Scribe documentation product built on NVIDIA, the eTriage emergency triage product and AI first primary care through eConsult), and its privacy policy describes nurse monitoring staff drafting patient messages with GPT 3.5 on Microsoft Azure.

The core of the remote monitoring offer, though, is the cleared platform itself: partners configure regulated disease management tools from pre built modules with no code, and a configured monitoring pathway can run on data collection, thresholds and workflow with little inference involved. The same estate also sells myGP, a primary care access app, and population messaging from iPLATO. The regulatory and configuration layer, not the models, is what the company leads with and what a monitoring partner buys, so AI is a feature layer on a product whose value stands without it.

Oversight is relocated to the configuring partner and the guardrail layer is not published. Partners assemble their own regulated tools from modules with no code, so what a deployed application does, when it escalates and what a clinician sees are set by each partner, and Huma describes no single oversight posture.

For its own monitoring service, the privacy policy says nurse monitoring staff may use a GPT 3.5 chatbot for assisted typing of patient messages, without stating that every message is reviewed before it is sent. Nothing describes which configurations are permitted, what clinical safety review a configuration undergoes before going live under the platform's regulatory status, or what the platform prevents.

Two named products sharpen this: eTriage makes acuity decisions in emergency and urgent care, and Huma Intelligence is marketed as deployed clinical grade intelligence, and neither has a published description of what it decides alone, what a clinician must confirm or its operating point.

Suppliers are named for two AI features, without version and update discipline. The mobile app privacy policy names GPT 3.5 on Microsoft Azure as the chatbot its nurse monitoring staff use for assisted typing, and a company case study describes the Hi Scribe documentation product as built on NVIDIA. The platform architecture is described clearly: five product layers, no code assembly from pre built modules with device connectivity, a development kit and a cloud agnostic hosting framework.

What is missing is the model discipline: GPT 3.5 is a model family with no pinned version or update practice stated, no base model is named for Hi Scribe, Huma Intelligence or eTriage, the validated algorithms the company refers to carry no performance figure, and no model card exists. Because the platform hosts partners' models, what it requires of a model before it may run, and what monitoring it performs on hosted models, would describe the whole ecosystem and is also unpublished.

The model provider is named for one path, with the data that reaches it and the contract that covers it. The mobile app privacy policy says the GPT 3.5 chatbot runs on Microsoft Azure, lists the personal data shared with Microsoft (gender, biological sex, healthcare provider's name, zip code and date of birth) and states contractual agreements with Microsoft for protected health information; a clinical trial protocol names Google Cloud Platform as host for an NHS deployment; Hi Scribe is described as built on NVIDIA.

Other recipients are listed only by category (IT and communications providers, cloud providers, call centers and others), anonymized data is provided to third parties for research, and no subprocessor register is published. The platform also hosts partners' models, so the chain for a given deployment can include parties Huma did not choose. Nothing says whether Microsoft or any other provider retains or trains on the data it receives.

Named deployments and research use are substantial, and most of it evidences the platform as a vehicle rather than Huma's own algorithms. The home page reports more than 100 applications built on the platform, more than 100 clients across pharmaceutical, provider and government buyers, and around 100 million patients supported by its clinician facing products, with no source.

Earlier company material reported more than 3,000 hospitals and clinics, 1.8 million active users and 650,000 research participants. Published case work includes an emergency department triage deployment in a London hospital, a decade long oncology real world evidence study, a lung cancer screening program that validated an established risk model and is described as forming part of a German national screening blueprint, a non interventional insomnia study across Germany and Austria for a pharmaceutical sponsor, and a kidney and diabetes program that recruited 4,500 patients a year ahead of schedule. These show the platform capturing data at scale and speeding recruitment; they do not report performance of Huma's own models or outcomes attributable to them.

Huma's mobile app privacy policy (Huma Therapeutics Limited, formerly Medopad, updated 7 March 2024) publishes specific commitments on the AI path and on secondary use. For the GPT 3.5 chatbot its nurses use for assisted typing, it names the data shared with Microsoft (gender, biological sex, healthcare provider's name, zip code and date of birth), limits the chatbot to US patients, and states contractual agreements with Microsoft for protected health information.

It says personal information may be anonymized or de-identified, aggregated with other users' data and provided to third parties for research, and that a patient may object by email. Retention is by criteria (purpose, sensitivity, risk and legal requirements), with research data kept for the study's duration, and no schedule.

A clinical trial protocol for an NHS deployment adds UK hosting on Google Cloud Platform, encryption in transit and at rest, cloud key management with rotation and least privilege service permissions. Nothing states whether platform data trains Huma's own models, and no safety engineering is published: nothing on guardrails for generated messages or how a safety event is handled.

Huma states business associate status for its US processing and supports it with a substantive privacy document. Its mobile app privacy policy (Huma Therapeutics Limited, updated 7 March 2024) says that where HIPAA applies the information is protected health information, that Huma operates as a business associate for it, and that it has executed contractual agreements with Microsoft to protect that data, and it describes Huma as generally a data processor for patient and provider data, with the customer as controller.

The quality and regulatory page lists NHS Data Security and Protection Toolkit compliance for UK work. What is not published is the agreement Huma signs with a US customer, the tier it applies at, or its subcontractor terms beyond Microsoft. The configurable model adds a question: when a partner configures the platform for its own patients, whether Huma is that partner's business associate or subcontractor depends on contract and architecture, and nothing published settles it.

Recognized security audits appear on the company's own quality and regulatory page: ISO/IEC 27001 for its information security management system, a SOC 2 Type II examination of its security controls, Cyber Essentials Plus (independently validated) and compliance with the NHS Data Security and Protection Toolkit, alongside ISO 13485 and the medical device software standards, which govern device quality rather than information security.

There is no published certificate, report period, scope statement or trust center, so the artifacts come only by request, and nothing states which entities and products the ISO and SOC 2 scopes cover now that the product line includes the eConsult and iPLATO products. The mobile app privacy policy describes access limited to those with a business need.

The platform holds a US clearance, and the AI products sold on it have no stated US position. The company's quality and regulatory page names FDA 510(k) K230214 (Class II) and EU MDR Class IIb. FDA's database lists K230214 as Huma RPM, cleared 2 June 2023 for Medopad, Inc. (Huma's former name), New York, product code MWI under 21 CFR 870.2300, a physiological patient monitor without arrhythmia detection or alarms. The home page says "One cleared platform, certified and registered worldwide. The Huma Cloud Platform is already regulated: a library of clinical applications ready to deploy", and lists AI products beside it: Huma Intelligence ("clinical grade intelligence"), Huma Intelligence Scribe, eTriage ("digital triage designed for Emergency and Urgent Care") and eConsult. The cleared label is placed on the platform, which holds a clearance; none of the AI products is itself called cleared, and the US clearance on file is for remote physiological monitoring, which does not reach triage, a scribe or clinical intelligence.

Earlier company material described the clearance as disease and device agnostic and as permitting the platform to host AI and machine learning models, and listed UK Class IIb, Australian, Saudi, Indian and Canadian approvals. Which AI function each jurisdiction's status covers, and how configurations and partner models are controlled under the platform's clearance, are not described. "Already regulated" therefore gives eTriage and Huma Intelligence no US position.

The regulatory basis of the AI products is left unstated, next to a platform clearance that is real.

The company frames governance as the platform's purpose and publishes no evaluation of model behavior. Its quality and regulatory page lists ISO 13485, ISO 14971 risk management, IEC 62304 software life cycle, IEC 82304-1 health software safety and IEC 62366 usability, and the platform holds US and EU device status; those govern device design and manufacture, not how the models behave.

The company's positioning, that general purpose AI cannot operate in regulated environments without a regulated home, is a statement of intent. No fairness testing, subgroup performance, calibration or drift monitoring, and no external audit of Huma's own models, is published.

The platform is built to host partners' models under its regulatory status, so what a partner model must show before it runs, who checks it for uneven performance and who answers for it are open questions that reach beyond Huma's own algorithms, across all ages and conditions and deployments in many countries.

One review mechanism is described and nothing stands behind an output. Huma's mobile app privacy policy (7 March 2024) says its nurse monitoring staff may use a generative AI chatbot, GPT 3.5 on Microsoft Azure, for assisted typing when generating messages to patients about their care, which keeps a nurse between the draft and the patient.

No service level agreement, accuracy warranty, uptime commitment, indemnity or remediation position is published, and no error rate is published for Huma's own models. The privacy policy's right to correct personal data covers the data Huma holds, not a clinical output.

The larger open question is allocation: partners deploy their own configured tools and models under Huma's regulatory status, so when a configured application harms a patient, whether the partner or Huma answers for it, and who is the manufacturer of record for that configuration, is not described. A platform carrying remote monitoring, triage and trials also has real time dependencies with no published availability commitment.

Device connectivity is a designed and cleared property, and record system integration is claimed without a system named. The platform is device agnostic, connecting to third party instruments such as heart rate monitors, glucose monitors and smart inhalers, reads Google Fit data in the app, and offers a development kit for partners to embed functionality in their own products.

A case study describes unifying fragmented systems into a single care flow in a hospital emergency department, and the home page describes the Huma Cloud Platform as a unified data foundation. No record system is named, no interface standard such as HL7 or FHIR is described, no marketplace listing appears, and nothing states whether monitoring data, triage outputs or generated documentation post to the patient's record, which decides whether Hi Scribe is a documentation tool or a drafting aid.

Hosting options and one committed location are documented, and the default residency and isolation model are not. The company describes its hosting framework as cloud agnostic, and a clinical trial protocol for an NHS deployment records the platform hosted in the United Kingdom on Google Cloud Platform with infrastructure managed by that provider.

The mobile app privacy policy says transfers outside the EEA use appropriate safeguards such as standard contractual clauses, still citing the EU US Privacy Shield, which was invalidated in 2020, and the US chatbot feature runs on Microsoft Azure.

No residency policy states where data sits by default or by region, no tenancy or separation model is described for a platform serving many partners, and nothing says whether a partner configuring its own application chooses its hosting region or inherits Huma's.

Nothing about cost is published, against a proposition that is explicitly economic. The home page offers a demo request and a Start Building link to Huma Workspace, and the site carries no pricing page, unit of charge, range, tier, implementation fee or minimum commitment. The platform is sold on partners inheriting regulatory status instead of running their own approval programs and configuring tools in weeks rather than years, and neither side of that trade is quantified.

Buyers span hospitals, national health systems, governments, pharmaceutical sponsors and research programs across monitoring, trials, documentation, triage and primary care access, which price on different bases, and nothing says whether charging follows monitored patients, configured applications, study participants, seats or an enterprise license, or how the development kit is licensed.

Coverage is named very broadly, with validation behind part of it. Earlier company material described the US clearance as covering monitoring of patients of any age with any condition, including children and pregnancy, with connection to third party devices such as heart rate monitors, glucose monitors and smart inhalers, and the company reports software built on the platform in more than 70 countries.

Use cases span remote monitoring, decentralized trials, clinical documentation, emergency triage, primary care access through myGP and eConsult, and diabetes in pregnancy through GDm Health. A regulatory scope is an authorization to operate, not a validation: validation stands behind the named case work (an emergency department in London, oncology real world evidence, lung cancer screening in Germany, insomnia in Germany and Austria, kidney disease and diabetes recruitment), not behind every condition and setting the scope allows. Configurability means a partner supplies the clinical specificity.