Marisa.Care

Conversational agents are the product across all three layers. The company's stated design point, no menu and no IVR with the agent accessing the real schedule and resolving requests end to end, is only achievable with the model doing the work rather than routing to it.

The agents operate autonomously on live patient conversations, booking against the real schedule and initiating outreach based on record contents, with no escalation path, human review step, or handoff criteria disclosed in retrieved materials. Proactive outbound contact triggered by a patient's diagnostic findings is a consequential action, and the absence of stated guardrails around what the agent may raise unprompted is the gap a buyer should close first.

No foundation model is named, no architecture is described and no evaluation methodology is published for the agents that read records, identify care gaps or hold conversations with patients.

The company commits to being transparent about decisions taken solely by automated processing, which is more than most vendors here offer, but qualifies that commitment as subject to its industrial and commercial secrets. That qualifier is lawful and common, and it also means the depth of any explanation is set by the company rather than by the person asking.

The single published performance figure, that 97.6 percent of patients had risks mapped requiring further action, is reported without a denominator definition, a comparison group or a method. For a product whose core mechanic is reading a record to find prescribed care that was never booked, the useful measures are how often it correctly identifies an outstanding order and how often it raises something that was not in fact outstanding. Neither is published.

The published data protection policy does more work than a security page, which is what lifts this above the floor. It identifies health data as sensitive rather than treating it as ordinary personal data, commits to specific handling where a data subject is under eighteen, defines security incident obligations, and provides data portability in a structured interoperable format.

Portability is worth naming because it is the practical half of a right that is usually theoretical: a person who can extract their data in a structured format can take it elsewhere, which is what makes the ability to leave real rather than nominal, and a policy that specifies the format has thought about whether the right is exercisable. Minor specific handling is also rare in this index and matters for a product reading records.

Held at C because the chain itself is unenumerated and the two live questions are unanswered. No model or model family, hosting arrangement or sub processor list was located for agents that read records, identify care gaps and hold conversations with patients, and nothing states a retention period or whether patient conversations and record content are used to train or improve those agents.

A policy that grants rights over data is a different thing from a description of where the data goes, and this record has the first without the second. Ask for retention, the training position, and a sub processor list.

Deployment at reference hospitals in Brazil and Mexico is stated, which satisfies commercial availability, but no customer names, volumes, conversion rates, or no show reduction figures were retrieved. The company is pre seed. The core mechanic, reading the record to find prescribed exams that were never booked and offering them proactively, is a sound and specific idea, but its effect size is unquantified.

Better documented than most records in this index, through the published data protection policy rather than a security page. It identifies health data as sensitive, commits to specific handling where a data subject is under eighteen, defines security incident obligations, provides data portability in a structured interoperable format, and states the right to request review of decisions taken solely by automated processing.

That last right is worth naming because it is the one this index most often finds absent everywhere: a patient can ask for a human to review an automated decision about them, and the company commits to explaining those decisions.

Two limits hold this at B. The transparency commitment on automated decisions is expressly qualified as subject to the company's industrial and commercial secrets, which means the explanation available to a patient is bounded by what the company treats as proprietary. And no retention period and no statement on whether patient conversations or record content are used to train or improve the agents were located. Ask for both, and ask what the trade secret qualifier excludes in practice.

Graded B because the framework does not apply rather than because the company is silent. This is a Brazilian company serving hospitals in Brazil and Mexico, so the governing regime is the Lei Geral de Proteção de Dados rather than the United States privacy rule, and there is no business associate relationship to document.

The equivalent instrument is published and it is substantive. The company puts a full data protection policy online in Portuguese and English, defines health data as sensitive personal data under the Brazilian statute, sets out the legal bases on which it processes including where consent is not required, and names an appointed data protection officer with a published contact address serving as the channel to data subjects and to the national data protection authority. Appointing and publishing that role is a statutory requirement met openly rather than assumed.

One forward looking point belongs here. The company states it is preparing a United States expansion. Nothing published addresses how it would operate as a business associate, and a US buyer should treat that as unanswered rather than inferring it from the Brazilian posture.

No ISO 27001, SOC 2 or equivalent independent attestation was located across two differently phrased searches, including one run in Portuguese against Brazilian sources, and no trust centre or security page was found.

The published data protection policy is a compliance instrument rather than a security examination, and the two should not be conflated. It states what the company undertakes to do; it does not evidence that an external assessor has tested whether it does.

Stage and market context, so the grade reads fairly: this is a small company by registered size with roughly three years of trading, and a formal attestation would be unusual at that point. The absence matters more than it otherwise would because the deployment footprint is not small. Named hospital groups and a public health system deployment reaching a stated five million lives is a large concentration of health data for an organisation with no published independent assurance, and that gap between footprint and assurance is the thing to raise.

No FDA pathway applies to a company selling in Brazil and Mexico. The relevant device regulator is ANVISA, whose software as a medical device framework governs there, with Mexican regulation applying separately. No registration or position under either was located, and none under FDA.

The grade rests on an inconsistency rather than on the missing United States clearance. Publicly the product is positioned as patient navigation, scheduling and care gap recapture, which is administrative. In material the company authored for a technology partner directory it describes its agents as detecting diseases and navigating patients. Disease detection and appointment booking are different regulatory propositions, and the first would sit inside a device framework in Brazil and in the United States alike.

The company also states it is preparing a United States expansion. A buyer should establish which description is accurate, what the agents actually assert about a patient's condition, and whether any regulatory analysis has been done in either market.

The published right to request human review of automated decisions is a real governance commitment and is credited on the safety axis. What is missing is any evidence about how the automation performs.

One published figure deserves scrutiny rather than acceptance. The company states that 97.6 percent of patients passing through its platform had health risks mapped and needed additional exams or actions. That is either a remarkable finding about unmet need or a very wide definition of what counts as a risk, and nothing published says which. A near universal positive rate is the shape that ordinarily indicates a threshold set to catch everything, and in a system whose revenue layer converts identified gaps into booked services, the direction of that incentive is worth naming.

Nothing published reports precision, how often a flagged gap reflects care the patient genuinely needed, or whether flag rates vary by payer type, given deployment across both private networks and the public health system. That last split is the obvious first analysis and the company is well placed to run it.

This record grants the recourse route this axis exists to find, and almost nothing else in the index does. The published policy states a right to request review of decisions taken solely by automated processing, and commits the company to explaining those decisions.

That is a route an affected person can actually use: not a citation to inspect, not a source to trace, but a stated entitlement to have a human look again at an automated determination about them and to be told what it rested on. Across hundreds of records this backfill has repeatedly found the affected party with no route at all, so a published one deserves the grade even where nothing is measured. Two limits hold it below the top.

The transparency commitment is expressly qualified as subject to the company's industrial and commercial secrets, which is lawful and common and means the depth of any explanation is set by the company rather than by the person asking, so the right to an explanation and the right to a useful explanation are not the same thing.

And nothing is measured: the single published figure, a very high proportion of patients having risks mapped requiring further action, carries no denominator definition, comparison group or method. For a product whose core mechanic is reading a record to find prescribed care that was never booked, the useful measures are how often it correctly identifies an outstanding order and how often it raises something that was not outstanding. Ask for both, and what the trade secret qualifier excludes in practice.

Integration is central rather than incidental. The core mechanic requires reading the medical record to find prescribed exams and consultations that were never booked, and writing back by booking against the live schedule, which means both read and write access to clinical and scheduling systems.

A listed partnership with a major health data platform vendor supports the claim, and deployment at named large diagnostics and hospital groups implies integration with systems at that scale rather than with a single small practice stack. The company describes itself as a single source of truth for those groups, which is a claim about consolidation across systems rather than a single connection.

Held at B rather than A because no specific electronic health record or hospital information systems are named, no integration method is described, and the Latin American vendor landscape differs enough from the United States that a buyer cannot infer support from familiarity. Ask which systems are live today and by what interface.

No hosting provider, region, tenancy model or data residency commitment was located, and no subprocessor list is published.

The channel is the finding here rather than the hosting. WhatsApp is the primary route to patients, which is the right choice for these markets and is a genuine design strength. It also means clinical communication runs over a consumer messaging platform operated by a third party. Message contents are encrypted in transit on that platform, but metadata is not, and business messaging is delivered through an interface where the platform operator is a processor in the chain.

Under the Brazilian statute the hospital remains the controller and answers to the patient and to the regulator for the acts of its operators, which makes the identity and terms of every processor in that chain the hospital's problem rather than the vendor's alone. Establish which messaging provider is used, what the platform retains, where records of the conversations sit, and whether the hospital has assessed that chain as part of its own compliance position.

No public pricing. Enterprise sales to hospitals. The value framing is revenue recapture per converted pending item and reduced no shows, which suggests outcome or conversion linked economics, though the model was not disclosed. If pricing is conversion linked, buyers should examine how aggressively agents pursue booking, since the incentive runs toward volume.

Scope is clear, hospital patient access and care gap recapture, and the geographic focus is a genuine differentiator rather than a limitation: the company serves reference hospitals in Brazil and Mexico and builds for WhatsApp as a primary clinical communication channel, which reflects how patients in those markets actually reach providers. Held back from A because the model's applicability outside Latin American communication norms and payer structures is untested.