Lyrebird Health

Ambient capture and generation is the whole product and the company was founded to build it. No non AI business underneath and no platform the model is decorating.

Conventional draft and review. Notes and documents are generated ready for transfer into the record, with the clinician editing and approving before anything is saved, and Australian professional guidance reinforces that a clinician reviews every note. No acceptance rate, edit burden figure or confidence threshold is published.

The RACGP recommends obtaining patient consent before using any AI listening tool, and medical defense organizations support that position, so consent workflow is a deployment obligation here regardless of vendor design.

The vendor's current privacy policy names its models: Azure OpenAI (Microsoft) for language processing, and Deepgram and Whisper for speech to text conversion. Whisper is an identified speech recognition model, and Azure OpenAI identifies the family of language models producing the note, so what is being validated is known at both stages of the pipeline.

Version and update discipline is the gap. No model class or version is given for the Azure OpenAI deployment, nothing says whether Deepgram or Whisper handles a given consultation or how that routing is decided, and nothing published tells a customer when a model underneath the product has changed. No model card is published.

The performance claim offered is latency rather than correctness, notes generated in under 20 seconds, with no accuracy figure or evaluation methodology behind it. Multilingual consultation support is claimed without a statement of which languages are supported or how performance varies across them.

The model layer and the speech layer are both named.

The vendor's current privacy policy names Azure OpenAI (Microsoft) for language processing, Deepgram and Whisper for speech to text conversion, AWS for hosting and data storage, Supabase for authentication and database services, and Sentry and Honeycomb for system monitoring on pseudonymized data.

Enumeration is incomplete. The named parties cover the path the audio and the note travel, but the same list then falls back to unnamed categories, including data storage providers, web hosting and server providers, and analytics providers, so the list does not show that no other party touches the record. No standalone subprocessor list with per party terms is published, no model class or version is given for the Azure OpenAI deployment, and deployment type governs whether processing stays inside the nominated region.

The training question is closed in the vendor's favor: the terms prohibit training, fine tuning or benchmarking on customer data and require third party providers to be contractually bound by the same restriction, which reaches derived text and not only recordings.

A peer reviewed evaluation exists, the vendor links to it directly, and every author is affiliated with the health service or a university rather than with the vendor.

The study is Ryan, Hattingh, Wall, Stanich, Ross, Da Cal, Milne and Wenke, Acceptance of AI scribes within hospital allied health settings: a mixed methods study, DIGITAL HEALTH, published 18 June 2026, doi 10.1177/20552076261437234. It was run at Gold Coast Hospital and Health Service across allied health services, using surveys and semistructured interviews with clinicians and patients. The vendor reports 97 eligible clinician surveys, of whom 94.5 percent of adopters answering the question wanted to continue using the scribe and 88.9 percent would recommend it.

The vendor is candid about the limits. The endpoints are clinician acceptance and patient acceptability, not note accuracy, quality or safety. It is single site. Acceptance is a real finding and it is not performance.

The product is not named in the abstract or author list; the attribution to this vendor rests on the vendor's own statement alongside its link to the paper, and the full text may name it.

Separately, a second Gold Coast evaluation is in circulation and its attribution is disputed. A 16 week outpatient trial covering 100 clinicians, 7,499 consultations and 19 outpatient specialties was published as Memon and colleagues in BMC Health Services Research on 8 January 2026, doi 10.1186/s12913-025-13954-5. Third party commentary assigns it to this vendor; the vendor's own market comparison appears to assign it to a competitor.

The data lifecycle here is disclosed with enough precision to be argued with, and the detail is more interesting than a single headline figure.

Partner material describes all information and data processing as conducted exclusively within Australia, with data retained for 24 hours and then deleted. The vendor's own privacy policy and terms of service say otherwise, as set out below.

Residency. Application databases and transcripts, authentication and user data, speech processing and encrypted backups sit in AWS's Sydney region. The privacy policy then permits specific, named crossings: de-identified health information processed by Azure OpenAI in the European Union, with region pinning where available, plus United States processing of payment metadata, pseudonymized monitoring logs and non-health analytics. The trust center describes processing on respective local soil rather than in one country, consistent with a product now sold in more than one market. Disclosing the crossings is better practice than an unqualified onshore claim, and it is what a buyer running a cross-border assessment actually needs.

Retention. There is no single 24 hour window. Audio is deleted immediately after transcription by default; the terms permit encrypted audio to be held for up to two days during a transcription outage, with deletion at transcription or at two days, whichever is first, and the safeguard can be switched off. Notes default to seven days and are configurable from 24 hours to six months. Point-in-time backups run 28 days and follow the primary data's deletion. Twenty four hours is the shortest setting available, not the policy.

Training. The terms prohibit the vendor from using customer data, as defined there, to train, fine-tune, benchmark or otherwise develop a model, and require third-party providers to be bound by the same restriction. A contractual prohibition with flow-down is materially stronger than an assurance that data is not sent to a public model.

What is not published is the safety engineering: no guardrail description, no hallucination mitigation in the product, and nothing on how a safety event is handled. A clinical note evaluation framework separating hallucinations, inaccuracies, omissions and irrelevant inclusions is published on the research pages, which goes further than a statement of intent, but it is an evaluation method rather than a product control.

An Australian product that has begun making a United States claim, with nothing published behind it yet.

The United States rule applies because the vendor invokes it. There is a United States facing site, pricing in United States dollars and pounds sterling alongside Australian pricing, and a compliance description naming the United States health privacy rule beside the European data protection regulation and Australian law. A vendor that stays inside its home regime answers to that regime; once the claim is made, the claim is what counts.

What a counterparty can verify is thin. No business associate agreement or template is published, no scope statement says which processing activities the claim reaches, and no United States customer or deployment is named. There is no certification for the health privacy rule, so the statement is a self description rather than an independent examination.

Residency is where a United States buyer should press hardest, and the position has become clearer without becoming reassuring. The strongest and most repeated commitment in this vendor's material is jurisdiction specific: application databases, transcripts, authentication data, speech processing and encrypted backups sit in AWS's Sydney region. The trust center describes processing on respective local soil rather than in a single country, and the privacy policy permits de-identified health information to be processed by Azure OpenAI in the European Union with certain United States processing of non-health data. So a United States account is not simply served from Australia, and it is also not clearly served from the United States. Neither answer is disqualifying, because the rule imposes no localization requirement, but a business associate agreement has to reach every processor and enforcement runs across a border.

The underlying privacy documentation is substantive, with a retention schedule, named processors and disclosed cross border flows. What is missing is the instrument that turns any of that into an obligation owed to a covered entity.

Nothing published says which instance a United States account runs on, where its data rests, whether a business associate agreement would flow down to the European and United States processors named in the privacy policy, or at which tier it would be offered.

A trust center exists and no certification has been established.

A trust center is published at trust.lyrebirdhealth.com and is linked from the footer of every page on the marketing site. It is hosted on Vanta, a compliance automation platform, and may list certifications. A compliance platform hosting a portal is not itself an attestation.

What a counterparty can verify before contracting is limited. What is published outside the portal is architecture rather than examination: AES-256 encryption in transit and at rest, application data and backups in AWS's Sydney region, audio deleted immediately after transcription by default, and configurable note retention. That is a coherent data minimization posture. It is still a description of design.

Two outside facts support the finding. The vendor has been described as pursuing SOC 2 and ISO 27001 rather than holding them, and pursuing is not holding. Separately, an independent Australian market comparison identifies a competitor as the only Australian scribe carrying ISO 27001, which is external corroboration.

The segment makes this consequential. Australian buyer guidance in this market routinely tells practices to check for ISO 27001 or SOC 2 before adopting a scribe, so the certification is a published purchasing criterion here rather than an enterprise nicety.

No device pathway attaches and none is claimed. This is not an absence: a governing framework exists, the vendor names it, and it has built product to serve it.

In Australia the obligations on an ambient scribe come from privacy law, from the therapeutic goods regulator's guidance on digital scribes, and from medical defense organization position statements, rather than from a device authorization. All three converge on documented patient consent before a scribe is used in a consultation. The vendor sets that out plainly in its own guidance for clinicians, describes the practical options as verbal consent recorded at the start of each consult or written consent captured once at enrollment, and notes that most practices end up combining the two.

The consent obligation is met with a feature rather than an exhortation. The product timestamps verbal consent in a consent log. The consent log produces the evidentiary record a regulator or defense organization would actually ask to see. That is the right response to a regime where the duty sits on the clinician and the difficulty is proving compliance after the fact.

One gap is now open and should be tracked. The vendor has expanded beyond Australia, operating United States and United Kingdom facing offerings. Ambient documentation is treated as software as a medical device in the United Kingdom, where the regulator classifies these products accordingly and peers hold registrations. No United Kingdom classification or registration is published for this product, and the Australian position does not transfer.

The absence is sharper because the vendor now makes a robustness claim.

No fairness statement, no subgroup analysis, no accuracy breakdown by accent, dialect, language or speaker population, and no evaluation methodology is published.

What is published is an explicit capability claim. The product is marketed as built to listen, handling varied accents, speech patterns and multilingual consultations. That is an assertion about precisely the property in question, published with no number, no methodology and no breakdown attached. The efficiency benefit is quantified and the robustness claim is asserted.

Australia has substantial multilingual populations and Aboriginal and Torres Strait Islander populations whose speech patterns are least likely to be well represented in the data these systems are trained on. A scribe that performs less well for those speakers produces a worse record for those encounters, and nothing in the workflow surfaces it to the clinician reviewing the note. The claim to handle varied accents and speech patterns is exactly the claim that most needs evidence in that setting, and it has none.

The expansion into other markets widens the exposure rather than diluting it, since each new market adds speaker populations the training data represents differently.

This remains the single most valuable disclosure this vendor could add, and validated documentation quality instruments exist for it.

The published note evaluation framework separates hallucinations, inaccuracies and omissions, which shows the vendor has a working vocabulary for the ways a note goes wrong. Nothing published commits it to anything when one occurs.

On data handling, 24 hours is the shortest configurable setting rather than the policy. Audio is deleted immediately after transcription by default, notes default to seven days and are configurable between 24 hours and six months, and backups run 28 days. That schedule limits exposure without saying anything about correctness.

On output the position is the gap. No accuracy or error figure is published. The only performance claim offered is note generation in under 20 seconds, which describes speed rather than fidelity. Multilingual support is claimed without naming the languages or stating how performance varies across them, which is itself a liability question for a practice serving a multilingual population. No warranty, indemnity or remediation commitment is stated, and the contractual instruments that do exist govern data handling rather than what happens when the note is wrong.

Core processing sits in Australia, where privacy law gives an individual a right to have inaccurate personal information corrected against the holder of the record. The vendor also sells into the United Kingdom and United States, and the privacy policy permits deidentified health information to be processed by Azure OpenAI in the European Union with United States processing of certain data that is not health data, so which regime governs depends on the account.

Deep in one market rather than broad across many, and the depth is real.

Lyrebird runs inside Best Practice Premier, the dominant Australian general practice system, launching at the click of a button. The integration is bidirectional in the way that matters clinically: patient context including allergies, medications and history flows into the consultation rather than the scribe only pushing text back out. The vendor describes itself as the only scribe fully integrated with Best Practice, which is its claim rather than a verified count. Pro adds Genie and Gentu for specialist workflows, plus Cubiko and BetterConsult.

The depth is within the Australian estate. There is no evidenced integration with United States or United Kingdom record systems, and the published integration catalog is weighted toward general practice and hospital systems rather than allied health: Cliniko, Halaxy and Power Diary are not listed, which matters for a psychology, physiotherapy or podiatry practice that needs native write back into one of those.

That combination is the thing to weigh. A practice running Best Practice gets a deep integration for that system specifically; a practice running anything outside the supported Australian list gets a copy step, and the marketing does not draw that line clearly.

Partner material describes all data processing and storage as conducted exclusively within Australia, no audio as retained after the consultation and other records as deleted after 24 hours. That description does not match the vendor's current privacy policy or terms of service.

The actual position is more nuanced and better. Application databases and transcripts, authentication and user data, speech processing and encrypted backups rest in AWS's Sydney region. The privacy policy then documents the crossings by name: de-identified health information processed by Azure OpenAI in the European Union, with region pinning where available, and United States processing of payment metadata, pseudonymized monitoring logs and non-health analytics. The trust center describes processing on respective local soil, consistent with a product now sold into the United Kingdom and United States as well as Australia.

Where data rests is documented, and which processing crosses a border is documented rather than left to be discovered. A buyer running a cross-border assessment under Australian Privacy Principle 8, or its equivalent elsewhere, can do it from published material instead of a questionnaire.

One element is not established. Nothing published describes tenant isolation, and there is no evidence of a deployment choice beyond the single hosted service. The trust center may cover both.

Published, tiered and unusually granular. Rates are set separately for general practitioners and specialists versus allied health, and separately again for full time clinicians working 25 or more hours a week versus part time under 25 hours, quoted annually and excluding GST, with tiered discounting available for multiple clinicians.

Pricing to actual utilization rather than a flat per seat fee is buyer friendly, and core scribing is now free to Best Practice Premier customers with Pro features charged separately. One caveat: published figures differ between sources and periods, with a partner listing showing A$2,400 and A$1,200 a year for full and part time clinicians and a later review citing 1,920 and 960, so the tier structure is the durable fact and the current number is not settled.

Narrow geographically, unusually deep in document types. Core coverage is Australian general practice with expansion into specialist and hospital settings and a separate allied health tier. What distinguishes it is that it drafts the jurisdiction specific administrative artifacts that consume clinician time rather than just the clinical note: chronic disease management plans, mental health treatment plans, Centrelink and WorkCover certificates and NDIS documentation, alongside referrals, summaries and certificates, plus a dictation mode for custom documents. No United States or United Kingdom equivalent scribe attempts local statutory paperwork of this kind. No specialty count published.