Luminai

The models do the part the rest of the platform depends on. The platform page describes an engine that ingests faxes, PDFs and chart notes, structures them into downstream ready data, and then connects, executes, enforces rules, escalates and closes across record systems and portals; in its worked example, the company's own models parse clinical details and classify document types on every inbound fax before anything else happens. The company's April 2026 funding announcement describes the platform as healthcare trained AI models, a configurable workflow engine and human in the loop validation. Turning a referral packet or a denial letter into structured data is a document understanding problem, and that capability does not exist without the models.

The rest carries value of its own: connecting to record systems and portals, executing multi step actions and applying standard operating procedures and decision logic is workflow engineering.

People handle the exceptions here, and the boundary that defines one is unpublished. The platform page lays out an engine that enforces standard operating procedures, compliance rules and decision logic, and escalates true exceptions to people with full context. In the orders and referrals example, the platform queries the record system to confirm the patient and provider, flags mismatches or missing records for human triage, and transcribes the order directly into the record. The company's funding announcement names human in the loop validation as a core component.

What is missing is where the line sits. Nothing says what counts as a true exception, who sets that boundary, what share of work reaches a person, or how an action already written into the record is found and reversed when it was wrong. That matters because the platform acts rather than advises: it transcribes orders into the record, contacts patients to schedule and updates downstream systems, and it states that it processes all faxed orders and referrals in near real time.

The engine is described step by step and the models are not. The platform page names seven stages (ingest, structure, connect, execute, enforce, escalate, close) and a worked orders and referrals flow in which the company's own models parse clinical details and classify document types. The security page adds that AI model processing is zero retention and that data passes through models in transit only. No model, model family or provider is named, no accuracy is published for extraction or classification, and nothing describes how models or workflows are versioned or how a change reaches a customer.

Extraction accuracy is the number that matters, because every downstream step inherits whatever the parser got wrong, including an order transcribed into the record.

The infrastructure chain is enumerated and the model layer is not. A dated subprocessor list (July 2026) names each party processing customer data or metadata, with the service, data categories and processing location: Amazon Web Services and Google Cloud for hosting, and Google Workspace, Slack, Atlassian, Linear and Stripe for operations. The security page names Infisical among the supported credential stores.

No model provider appears, yet the security page says the company signs business associate agreements with open source vendors where applicable, and the service level terms exclude outages of third party AI services and models. So third party model services sit in the chain unnamed, and whether the Google Cloud entry covers model services is not stated.

One named health system and a set of company figures with no method. The home page announces a partnership with Cleveland Clinic, linking an April 2026 Forbes article, and says the largest health systems trust the company. It publishes more than 12 million automations run, an average of seven use cases per customer, 48 days average time to value and a 5.3 times return on investment. None states a period, a denominator, how the return was calculated or which customers are counted, so each is the company's report of its own results, and automation volume is scale of use rather than benefit.

No case study, peer reviewed publication or independent evaluation is published, and no error or exception rate is given for any workflow.

Categorical commitments are published, and the contract reads more broadly than they do. The security page commits to zero data retention for AI models, with data processed in transit solely for automation, and describes encryption at rest (AES-256 on AWS storage with keys held in AWS KMS), TLS 1.2 or higher in transit, isolated execution environments, role based access, and credential storage and rotation through Infisical, AWS Secrets Manager or the customer's own tools. Hosted workflows run using the customer's own credentials, and on premise and air gapped deployment is supported.

The published enterprise terms (March 2026) license the company to use customer content for hosting, operating, improving and providing the services and its other related products, and to derive de identified aggregate data that excludes personal health information. So the security page's solely for automation describes model processing, while the contract permits improvement use of customer content more widely, and nothing sets a retention schedule for workflow data outside the models. The de identification method behind the aggregate data is not described.

A HIPAA position is stated and supported by substantive material, with no agreement published. The security page states the platform meets HIPAA, SOC 2 and GDPR requirements, runs continuous monitoring of HIPAA controls, and establishes business associate agreements with its open source vendors where applicable, which places the company in the business associate chain. That is backed by a dated subprocessor list naming each party that processes customer data, the data categories and where they process, and by specific encryption, isolation and credential controls.

The agreement itself is not published. The enterprise terms that govern the platform do not mention HIPAA or a business associate agreement, and nothing states how obligations differ between on premise, customer cloud and managed deployments, or whether any model vendor is bound.

A recognized framework is named as the company's own and no report is available to read. The home and security pages carry a SOC 2 badge and state the platform meets SOC 2 requirements, with continuous control monitoring through a unified compliance platform and security agents on every employee device. The controls are described specifically: AES-256 encryption at rest with keys in AWS KMS, TLS 1.2 or higher in transit, isolated execution, role based access, and credential storage and rotation.

The report is the gap. No type, audit period, auditor or scope is stated, there is no trust portal or request process, and nothing describes penetration testing or vulnerability disclosure; continuous monitoring is a compliance tool, not an attestation. Scope matters because the platform authenticates into record systems and portals with customer credentials, and whether the report covers the managed deployment and the credential store is not stated.

Most of the platform is administrative and makes no device claim: document intake, patient and provider verification, insurance checks, scheduling outreach, pre visit preparation and revenue cycle work. That sits outside device regulation and needs no position.

One step in the published orders and referrals flow is clinical in name and in function: clinical triage that prioritizes high risk patients and flags missing information on inbound referrals. Ranking incoming patients by clinical risk decides who is scheduled first, and the page states no regulatory position on it and does not say what the ranking is based on or what a clinician sees behind a priority. The inbound fax remains the source document.

Nothing published on how model behavior is governed or tested: no evaluation method, drift monitoring, subgroup analysis, model documentation or external audit. The continuous monitoring the security page describes covers compliance controls, not model performance.

Two published steps make the absence specific. Referral triage prioritizes high risk patients, and nothing says whether that ranking has been checked across age, language, insurance or other groups for whom access is already uneven. And document parsing feeds patient verification and order transcription, where extraction tends to degrade on names, addresses and identifiers outside the patterns a model saw most, and on poor quality faxes from smaller practices; a registration or matching error falls on the patient.

Mechanisms exist to challenge an output and the contract stands behind none of it. The platform escalates exceptions to people with full context and flags patient and provider mismatches for human triage, which lets staff catch what the system knows it cannot resolve. The published enterprise terms (March 2026) provide the platform as is, state that the company has no liability for loss or damage arising from input or the use of output, cap total liability at twelve months of fees, and indemnify only against intellectual property claims. The only service level is 99 percent monthly uptime, which excludes outages caused by third party AI services and models.

That allocation matters for a platform that acts: an order transcribed wrongly into the record, a registration error or a missed appeal deadline lands with the customer by contract. No error rate is published for any workflow, and nothing says how automated actions are marked in the record's audit trail so a wrong one can be traced.

Integration is claimed broadly and no system is named. The platform page says it integrates with any record system and interfaces with multiple record systems, portals and internal systems, and its worked example queries the record to confirm patients and providers and transcribes orders directly into it; hosted workflows act using the customer's own credentials. No record system, interface standard, marketplace listing or integration documentation is published, and the enterprise terms place third party services the customer connects outside the company's responsibility.

Working through user interfaces reaches systems that expose no interface, and it is brittle when a screen changes. Nor is it said how a broken screen is detected and repaired.

Options, residency and isolation are documented, and the model path is left open. The company offers on premise and air gapped deployment, deployment in the customer's own cloud, and a managed option. The dated subprocessor list (July 2026) names Amazon Web Services and Google Cloud as hosts of customer data, processing in the United States, with project tooling holding customer metadata in the United States and Australia, and the security page describes isolated execution environments.

Where model processing happens is not documented. The security page says data passes through AI models in transit and that the company signs business associate agreements with open source vendors where applicable, and the service level terms exclude outages of third party AI services and models, yet no model vendor appears on the subprocessor list and nothing states where that processing occurs or whether it stays inside the customer's perimeter in on premise deployments.

How it is sold can be read from the terms; what it costs cannot. The enterprise terms (March 2026) set fees in each order form against a licensed volume or services capacity, with usage above it billed as the order form describes; fees are non refundable, and changes take effect at the end of a term on 30 days' notice. The service level terms publish a 99 percent monthly uptime target, a weekly maintenance window and standard support hours. The home page lists eight workflows and reports an average of seven use cases per customer.

What no page gives is the unit of licensed volume or a rate: per document, per automation, per workflow or per system, and whether the deployment model changes the price. The overage rate, the price of additional workflows, implementation fees and the minimum term are not published.

Coverage is named and one health system stands behind it. The home page lists eight workflows (referral intake, provider inbox automation, patient registration, orders and referrals processing, pharmacy renewals, payor contract management, denial appeals and underpayment recovery), and the platform page walks through orders and referrals end to end, from fax intake to closing the loop with the referring provider. The setting is large United States health systems, with a partnership with Cleveland Clinic announced on the home page.

Which workflows run at Cleveland Clinic, and at how many other organizations, is not stated, and the average of seven use cases per customer names no customers.