NeuroFlow

The models carry the identification and a substantial platform carries everything after it.

Machine learning applied across claims, record system, admission discharge transfer and assessment data is what surfaces behavioral health risk a health system could not otherwise see, and that is analytical work, not reporting. The company's four step framing puts it first: identify population cohorts with likely behavioral health needs and stratify by acuity, then engage, connect and measure.

What sits around it would retain value without the models. Referral matching and routing to benefits and providers, care coordination, patient engagement between visits, assessment collection at scale, and outcome measurement for pay for performance reporting are workflow, infrastructure and labor. The company reports 6.61 million assessments collected, which is a data capture and engagement operation in its own right. Its own description is a combination of analytics, engagement and referral infrastructure, and the analytics are one of the three.

The identification layer is the reason a buyer chooses this over a care management platform, and it does not exist without the models. So this is real intelligence doing consequential work, inside a platform that is more than the intelligence.

The human element in the escalation path is a deliberate design choice rather than a dilution of the model's role.

A clinician stands between the model and the patient, and nothing published says what reaches that clinician or when.

The structure is described and it is the right one. The models identify and stratify; a person decides. Risk findings are delivered into the provider's existing workflow rather than acted on autonomously, the company describes its output as clinical decision insights supporting management, and routing is framed as an acuity driven next best action that a care team executes. Severity coverage is stated to span self guided support through crisis response, so the product acknowledges that its population includes people in acute difficulty.

What is missing is the operating point, and here the absence is specific rather than generic. This platform's stated purpose is finding people whose behavioral health risk is otherwise invisible, and it reports having identified 55,000 instances of suicidal ideation and rising risk. No sensitivity or specificity is published for the risk models, no false negative rate on suicide risk, no threshold governing what is surfaced to a human, and no stated time within which a flagged person is contacted. A detection system whose catch rate is unpublished is an unquantified detection system, and the quantity it would report is the one that matters most.

Earlier company material described a human staffed crisis capability operated by the vendor, which would be a materially stronger posture than shipping a score. That service is not named on the company's current pages, where crisis response appears only as the far end of a routing spectrum, though the company does publish a clinical team including a director of clinical operations with a crisis management background. Whether a staffed response capability is part of the product is not stated.

The inputs are enumerated and the company makes an explicit claim about the character of the models, which is unusual.

Four data sources are named individually: claims, record system data, admission discharge transfer feeds and assessment instruments. Naming admission discharge transfer specifically is meaningful, because real time movement data is what lets a risk model act on a current episode rather than a historical pattern. The company describes the approach as transparent machine learning, which is a deliberate positioning against opaque scoring and is the right claim to make for a product whose output is a clinician facing risk flag.

The capability set is described in four stages, identify, engage, connect and measure, so a buyer can tell which part does what.

What is absent is the substance behind the transparency claim, and it is the whole of the claim. No model class or architecture is described. Nothing explains what transparent means operationally: whether a clinician sees the features driving a risk score, the data that triggered it, a confidence band, or only the score itself. No accuracy, sensitivity, specificity or calibration figure is published for any model, no version or update cadence is stated, and no model card exists. A transparency claim that cannot itself be inspected is a positioning statement.

The gap has a practical consequence rather than an abstract one: the regulatory position of a decision support tool turns on a clinician being able to review the basis of a recommendation, and this is the disclosure that would establish it.

A published subprocessor register that does not cover the platform it would matter for.

The register exists. It is a standing page, effective from November 2021 and last revised 13 November 2025, naming each subprocessor with its purpose and country, and stating that the company performs privacy, security and confidentiality due diligence and executes an agreement before engaging any of them. A dated register with a described review process is real governance.

What it names is the commercial stack: HubSpot for marketing email, Salesforce for customer relationship management, Zendesk for support ticketing, GoToWebinar, DocuSign, and Typeform for assessments dispensed through the website. The page scopes itself accordingly, describing the subprocessors as providing client relationship management, customer support and email notifications, and the access described is to client and prospect contact details rather than to patient data.

No cloud platform, analytics framework, model or model provider appears anywhere on it, and none is named elsewhere. So the register shows who handles client and prospect contact details and nothing about who processes the claims, record system, admission discharge transfer and assessment data the models run on. The page states it lists all subprocessors, which leaves two readings: either no third party touches the clinical platform, which would make for a short chain, or the register does not extend to it.

The training question carries specific weight here because of the data type. Behavioral health information receives heightened protection in the United States beyond general health privacy rules, and substance use disorder records carry their own federal confidentiality regime. Whether population data from one health plan improves models sold to another is therefore both a competitive and a regulatory question, and nothing addresses it in either direction.

A February 2026 product expansion incorporated capabilities from acquisitions without those technology stacks being separately described.

Named deployments with outcome figures attached, published research short of independent validation, and no method a reader can check.

The outcome evidence is real and it is attached to named organizations. Independence Blue Cross is reported to have increased behavioral health access while lowering emergency department visits and inpatient hospitalization, reducing total cost of care by $28 per member per month. Jefferson Health is reported to have cut emergency department utilization by 34 percent. A medical center is reported at fourteen times the behavioral health screening rate with a threefold return. Prudential is reported to have found previously unidentified mental wellness needs in 19 percent of disability claimants. Magellan is reported at a 124 percent increase in digital cognitive behavioral therapy registrations. A separate case study reports natural language processing identifying individuals at risk of suicide earlier than assessment scores alone.

Published research exists alongside it. A journal item in the Academy of Consultation-Liaison Psychiatry on technology enabled suicide prevention in primary care, and eight conference presentations between 2022 and 2024 covering detection of suicidal ideation, engagement predicting symptom reduction, and collaborative care at scale. The clinical team is named with credentials and publication histories.

Institutional adoption is broad: Atlantic Health System, Emory Healthcare, Intermountain Health, Independence Blue Cross and the Department of Defense, with quotes attributed to named clinical leaders, and platform reach reported at roughly 15 million patients and 6.61 million assessments collected. A federal department carrying out its own procurement vetting is a meaningful signal, and the company was separately a finalist in a federal grand challenge on veteran suicide reduction, receiving $250,000 and advancing to a second phase.

Method is the gap. Every outcome figure is a vendor authored case study summary with no period, denominator, comparison group or attribution rate stated on the page, and the research is presented by company staff rather than independently evaluated. There is also a conflict: Magellan Health is named as a customer and led the Series B financing, so that reference is not disinterested.

Externally assessed controls, and the stewardship specifics unaddressed.

What is established is real: health specific certification at the implemented tier and a controls report at the second type, both externally audited, covering the platform rather than a subset. That is stronger assurance than an unaudited compliance claim, and both are stated with the qualifier that makes them assessable.

What is missing is everything about handling. No retention schedule, no encryption statement, no access control description, no data ownership or deletion position, no data minimization commitment, and no statement on whether population data contributes to model development. The published subprocessor register covers the marketing and support stack rather than the clinical platform, so it does not answer who holds the data either.

The sensitivity here is higher than the certifications alone convey, and it is specific to what this product does. The platform ingests claims and clinical data to infer that a person may have an undiagnosed behavioral health condition, and then acts on that inference by routing them toward care. That inference is a derived assertion about someone's mental health attached to an identifiable person, made without a clinician having examined them and without the person having sought help. Nothing published describes how such an inference is stored, who can see it, whether it enters the permanent medical record, how long it persists if it turns out to be wrong, or whether the person is ever told it was made.

A linked figure makes the scale concrete: the company reports 55,000 instances of suicidal ideation and rising risk identified. Every one of those is a record of that kind.

Two externally assessed credentials stated correctly with their tiers, and the agreement itself unpublished.

The company holds health specific certification at the implemented one year tier and a controls report at the second type, alongside stated privacy compliance. Naming the tier of the first and the type of the second is the precise usage, and it matters: the health specific framework maps a certifiable control set onto health privacy requirements and is assessed by an external party, so the compliance claim rests on something checkable rather than on a badge.

No business associate agreement posture, template or execution requirement is published, so a buyer cannot read the instrument before contracting or see the subcontractor flow down terms.

One dimension specific to this vendor is unaddressed anywhere, and it is not a formality. Behavioral health information carries protection beyond general health privacy rules in the United States, and substance use disorder records fall under a separate federal confidentiality regime with its own consent and redisclosure requirements, whose modernized framework reached its enforcement date in February 2026. A platform that surfaces undiagnosed behavioral health conditions from claims data across an entire population is operating directly in that territory: identifying someone from a substance use claim, and routing them somewhere on the strength of it, is precisely the disclosure that regime governs. Nothing published describes how those records are segmented from automated processing or what consent is relied on.

The published subprocessor register, covering the marketing and support stack, does not reach this question either.

Two credentials, both named with the specificity that makes them assessable.

The company states health specific certification at the implemented one year tier and a controls report at the second type, alongside privacy compliance. Both are externally assessed, and both are described with the qualifier that matters: the tier for the first, the report type for the second. Naming the tier of a health specific certification is the precise usage, because the entry level and implemented levels involve materially different assessment depth.

A dated subprocessor register sits alongside them, revised in November 2025, naming each party with purpose and country and describing a vetting and contracting process before engagement. Its scope is the commercial stack rather than the clinical platform, and the existence of a maintained register is a governance signal.

No trust center exists as a standing page, no report availability or request process is published, no audit period or assessor is named, and no penetration testing disclosure or vulnerability disclosure policy appears. Nothing shows which window either credential covers or when it renews, and a certification has a scope and a clock.

No device pathway is claimed and the classification is probably correct, on a product sitting close to the line.

Risk stratification delivered to a clinician who decides, referral routing and outcome measurement are decision support and care coordination rather than diagnosis. The company publishes a position consistent with that: findings are delivered into the provider's workflow, described as clinical decision insights supporting management, with the care team executing the next best action.

What makes the question live is the shape of the output. The product ranks a caseload by risk, built from claims, record system, admission discharge transfer and assessment data that the clinician did not witness, and reports having identified 55,000 instances of suicidal ideation and rising risk. The exemptions most regimes provide for clinical decision support turn on whether the clinician can independently review the basis of the recommendation. The company's answer to that is a claim of transparent machine learning, which it does not explain: nothing states whether a clinician sees the features driving a score or only the score. So the position is published and the reviewability that position depends on is asserted rather than demonstrated. That is a tension rather than a contradiction on the page.

The more immediate regulatory exposure is not device law but behavioral health confidentiality. Substance use disorder records carry a separate federal regime governing consent and redisclosure, and inferring behavioral health conditions from claims data across a population raises questions under it that nothing published addresses.

A transparency claim with nothing published behind it, against a bias risk that is close to textbook.

The company describes its approach as transparent machine learning, which is a governance oriented framing and better than the opaque scoring it implicitly contrasts with. No content supports it. No bias or fairness testing, no validation methodology, no performance breakdown by population, no calibration data, no drift monitoring output and no external audit is published, and the research page lists presentations on detection method rather than on subgroup performance.

The specific risk is structural and severe. Models trained on claims and clinical data to surface undiagnosed behavioral health conditions are learning from a historical record of who received care, and access to behavioral health care in the United States is patterned strongly by race, income, insurance type and geography. A population that historically had less contact with the system generates less signal, so a model can systematically under identify exactly the people the product exists to find. The company's stated purpose, surfacing conditions that would otherwise remain hidden, is the same mechanism by which the bias would operate invisibly: an unfound person produces no flag, no complaint and no record of the miss.

One figure makes the stakes concrete. The company reports 55,000 instances of suicidal ideation and rising risk identified. Whether that identification rate is even across the populations it covers is unexamined in public material, and it is the number that decides whether this product closes a care gap or widens it.

A clinician review step stands between the model and any action, and nothing stands behind the model.

The mechanism is real. Risk findings are delivered into the provider's workflow rather than acted on autonomously, so a person can disagree with a flag before anything happens to a patient. Severity routing spans self guided support through crisis response, and the company publishes a named clinical team including crisis management leadership, so the escalation path has people in it somewhere.

Nothing quantifies or contracts any of it. No detection sensitivity or specificity for the risk models, no false negative rate, no response time, no coverage hours, no escalation success measure, and no service level agreement, warranty, indemnity or remediation commitment is published. The transparent machine learning claim is a positioning statement rather than a falsifiable one, since nothing explains what a clinician sees behind a flag.

The allocation question is grave. If this system fails to identify a person at risk, the harm is not a denied claim or a misfiled note. Responsibility then sits somewhere between an unpublished model sensitivity, the health system's own configuration and staffing, and a vendor carrying no published commitment, and nothing in public material indicates where.

Earlier company material described a vendor operated staffed crisis capability, an operational commitment. The company's current pages do not name it, and nothing says whether it is still included or on what terms.

The data sources are named precisely and the connection layer is not described at all.

Four input types are enumerated: claims, record system data, admission discharge transfer feeds and assessment instruments. Consuming movement data alongside claims and clinical records means integrating with at least three distinct feed types, which is a harder engineering problem than record system access alone, and the company states that findings are delivered back into the provider's existing workflow, implying an outbound path as well as inbound. Deployments at several large integrated systems and a national payer are consistent with that work having been done.

No record system is named. No interface standard is described. No connection mechanism is specified. No marketplace or certification listing is published, and nothing states whether risk findings write into the medical record or sit in a separate application.

That last question carries weight here. An inferred behavioral health risk flag entering the permanent medical record is a materially different act from displaying it in a care management tool: it persists, it travels, it is visible to clinicians who were not part of the decision to generate it, and it is discoverable. The product exists to create exactly that kind of inference, so where the inference lands is a design question with consequences for the patient.

The delivery model is stated at the highest level and nothing beneath it. Tools are described as cloud based, which distinguishes them from installed software and is the whole of what is published.

No cloud provider, region, tenancy model, residency commitment, segregation description, backup or recovery posture or customer controlled option appears anywhere. The published subprocessor register names marketing and support tools and their countries, all in the United States, which establishes a jurisdiction for the commercial stack and says nothing about where the clinical platform runs.

Two factors sharpen the tenancy question. The platform ingests population level claims and clinical data from multiple health plans and health systems that compete with one another, so whether those datasets sit in shared or isolated environments is a commercial question as well as a security one, and a payer would reasonably want an answer before handing over its book. And the Department of Defense is among the named customers, which typically carries its own hosting and authorization requirements; nothing published states what environment serves that work or whether any federal authorization is held.

Nothing about cost is published. No pricing page, unit of charge, range, implementation or onboarding fee position, minimum commitment, pilot terms or return calculator appears anywhere, and site navigation offers a meeting request as the only commercial path.

The return figures are published in unusual detail by contrast, which sharpens the omission rather than softening it. Independence Blue Cross at $28 per member per month in reduced total cost of care, Jefferson Health at 34 percent lower emergency department utilization, a medical center at a threefold return, 6.5 minutes of clinician time saved per visit. The company's entire argument to a risk bearing organization is that unaddressed behavioral health comorbidity increases medical costs, and it supplies the savings side of that model with none of the cost side. A buyer is given a precise numerator and no denominator, so none of it can be turned into a decision.

The product structure makes a single basis implausible. Capability spans population analytics, engagement and assessment collection at scale, referral routing, outcome measurement for pay for performance reporting, and routing that reaches crisis response. Analytics over a covered population and a staffed escalation capability have completely different cost structures, and nothing indicates whether they are bought together, separately, or by volume.

Four buyer types compound it. A health plan, an integrated delivery network, a behavioral health provider group and a federal department have different procurement routes, contract vehicles and population sizes, and one undisclosed model cannot be assumed to serve all four.

Coverage is defined by where the product looks rather than by clinical specialty, and that framing is the point.

The target is behavioral health need appearing in settings not built to handle it: primary care, physical health services and general population management. Four buyer types are named and addressed on separate pages, each a distinct procurement context: health plans and payers, health systems with accountable care organizations and integrated delivery networks, the federal government, and behavioral health providers. Named deployments now sit behind three of them, including Atlantic Health System, Emory Healthcare, Intermountain Health, Independence Blue Cross and the Department of Defense.

Severity coverage is stated across a spectrum from self guided support through to crisis response, which is a wide range for one platform to claim. The veteran and service member population is addressed specifically, through a dedicated federal page and through federal challenge work on suicide reduction.

Depth by setting is not evidenced. The named customers do not distinguish which capabilities are deployed where, no figure separates health plan from health system deployment, and the severity claim is the least supported part of it: nothing describes what self guided support consists of or what crisis response involves operationally.

Nothing addresses pediatric or adolescent behavioral health, which is a distinct population using distinct instruments and a large share of unmet need. Nothing addresses markets outside the United States. Language coverage is not published.