Keona Health

AI agents sit on a contact center platform whose value stands without them. CareDesk is a healthcare CRM and call center platform (queues, messaging, scheduling, referrals, write-back to the chart) with a nurse triage module built on licensed Schmitt-Thompson protocols that guides nurses and agents through branching questions. The AI layer is newer: Kara and Flo answer calls and complete routine work (scheduling, refills, referrals, results routing, after-hours callbacks) and hand uncertain calls to staff; Engage offers AI self-scheduling and Elevate guides staff as a co-pilot.

The voice agents are real model work, and they are where most of the AI in the product lives; remove them and a complete CRM and triage product remains.

The agent FAQs promise the agents do not make unsafe decisions. The Kara and Flo pages ask "Will CareDesk Flo hallucinate or make unsafe decisions?" and answer "No", and the navigation says cardiology protocols are built in with "zero errors". That is an absolute claim that the product's output is never unsafe, yet the same page concedes that 90 percent of edge cases are flagged for nurse review, which leaves the rest.

The structure behind it is described: intent checks and fallback logic, uncertain cases handed to a person with full context in the agent console, about one call in eight escalated, and nurse triage run on Schmitt-Thompson protocols with escalation levels up to emergency referral.

The clinical content is named and the models are described only by their guardrails. The triage module runs licensed Schmitt-Thompson protocols; the voice agents are described as using intent checks, fallback logic and human review, handling unlimited concurrent calls and completing routine calls end to end. No speech or language model, provider, training data, evaluation method or version practice is published.

The host and the clinical content licensor are named; the model layer is not. Microsoft Azure hosts the platform and Schmitt-Thompson supplies the triage protocols. No speech recognition, language model or telephony provider is named for Kara or Flo, and no subprocessor list is published, so where call audio is processed is unknown.

Operating figures are the company's own and carry no method. The agent pages claim over 50 percent of scheduling calls deflected, 20 to 40 percent deflection depending on deployment, about one in eight calls escalated, and "independent audits" showing over 95 percent alignment with human decisions; the navigation claims 60 percent more calls handled without hiring, 99 percent scheduling accuracy with the co-pilot and 93 percent nurse accuracy with the triage protocols. None names a site, period, denominator or auditor, and no independent evaluation is published.

General assurances are published and the AI questions are not answered. The security pages say the company is a HIPAA-compliant organization, encrypts PHI in transit and at rest (AES-256), does not collect employee personal data or card data through CareDesk, and hosts on Microsoft Azure; the agent FAQs add end-to-end encryption, access controls and regular audits.

Nothing states how long call recordings and transcripts are kept, whether they are used to train or tune the agents, or how customer data is separated; the website privacy policy covers only the website. Safety engineering is described as intent checks, fallback logic and human review of uncertain calls, with no published results.

HIPAA compliance is claimed, and the only privacy policy covers the website. The security page says the company is a HIPAA-compliant organization that works with customer PHI and personal information, and the agent FAQs describe encryption and access controls; the published privacy policy defines its service as the website. No business associate status, agreement or scope is stated.

The platform reads charts and writes encounter notes, so the company is a business associate for its customers.

The company names a recognized certification and shows its controls through a monitoring portal. The security page says the company maintains SOC 2 Type I and Type II compliance, uses Vanta to monitor its controls continuously, and links a trust center showing control status and a SOC 2 trust report; the security policy describes AES-256 encryption, firewalls, intrusion detection, backups and Azure's security tooling. The trust center itself may say whether the report is open or available on request, and the audit period is not stated.

No device claim is made, and the clinical triage runs through nurses on a named protocol. The nurse triage module guides nurses and trained agents through Schmitt-Thompson protocols with the reasoning documented, the reviewable basis that clinical decision support outside device regulation relies on; the terms say the service is not medical advice and tell users to call their provider in an emergency.

The voice agent pages go further: they say Kara and Flo "match or exceed nurse triage benchmarks", and the dermatology tagline says the product routes "cosmetic-sounding requests hiding medical urgency correctly", which describes urgency sorting by the agent with no regulatory position stated.

Nothing is published on how the agents' behavior is tested beyond an unsourced figure. The Kara and Flo FAQs say the agents are "continuously validated against clinical data and call-center outcomes" and that "independent audits show >95% alignment with human decisions", naming no auditor, method, sample or comparison; no governance process, model documentation or subgroup result appears.

The voice agents depend on recognizing what a caller says, and recognition varies with accent, age and speech, so misroutes can fall unevenly on the patients least able to call back.

Decisions are documented and a return guarantee is offered; nothing stands behind a wrong answer. The triage module writes structured documentation of each decision against the protocol path and shows supervisors protocol adherence, and every interaction writes back to the chart, which lets a practice reconstruct and challenge what happened. The Flo page offers an ROI performance guarantee for qualified organizations ("Miss our targets, get credits back"), with the target, baseline and credit share unstated; it concerns return, not whether an answer was right.

The published terms disclaim warranties including accuracy and take no responsibility for information submitted or its misuse, and no correction route or remedy for a patient is published.

Write-back to the chart is described, with record systems named for sign-on rather than documented integrations. The integration page says every interaction writes back to the chart, documenting encounters and sending messages and tasks to providers and care teams, with single sign-on through EHRs such as Epic and Allscripts; the agent FAQs say standard APIs connect to EHRs and call center software.

Which EHRs run the write-back in production, through what interface, and at which customers is not published.

A single hosted service on a named cloud, with location not stated. The security policy says the application is hosted on Microsoft Azure using Azure's security products, and the terms ask customers to consent to the hosting provider's controls, backup and disaster recovery. No region, residency commitment or tenant separation is published, although the company serves organizations in Canada as well as the United States.

No price is published, and the pricing unit and entry path are. The Kara and Flo FAQs say cost is based on call volume rather than per-seat licenses, most organizations go live in four to six weeks, and qualified organizations get an ROI guarantee with credits back if targets are missed. No rate per call, minimum, platform fee or tier across CareDesk, triage, Kara, Flo, Engage and Elevate is given.

Coverage is named by specialty and workflow, with protocol breadth behind it. The site names orthopedics, cardiology, primary care, women's health, pediatrics, optometry and ophthalmology, urology and dermatology; the agents cover scheduling, refills, referrals, results routing, eligibility and after-hours calls; and the licensed triage protocols cover adult and pediatric topics for nurses and trained agents. The company serves practices, groups and health systems in the United States and Canada.

No named deployment or result is tied to a specialty.