Pabau

Consistent with how this index has graded ModMed and Elation Health: the artificial intelligence is a module inside a platform whose main business is something else. Pabau Scribe is a real ambient documentation product, and it sits alongside booking, payments, inventory, marketing, photography and reporting, most of which would function unchanged if the scribe were removed.

The suite here is if anything wider than a specialty record system, since it extends into point of sale, stock control and marketing campaigns. The company's own argument is a platform argument rather than a model argument: that documentation belongs inside the system that already holds the record, so patient data never passes to an external tool with separate governance. That is a good argument and it is an argument about architecture, not about the model.

The oversight step is published explicitly rather than left to be assumed: notes are generated ambiently and reviewed by the clinician before entry into the record. Stating the review point in product material is better practice than most of this lane manages, and it is checkable.

Role based permissions add a second layer that is described concretely, with reception staff able to book appointments and take payment but unable to edit clinical notes. Held at B because nothing describes what the reviewing clinician is shown, whether the generated text is distinguishable from what the clinician wrote, or what happens to the underlying recording after the note is approved.

No model, architecture or training description is published, and no accuracy figure of any kind is offered for the scribe.

The specialty tuning claim is the part a buyer would most want evidence for. Aesthetic consultation language is genuinely ambiguous in ways general transcription handles badly, since the same phrase can describe anatomy or a product quantity, and configurable specialty templates are a formatting feature rather than evidence that the underlying recognition handles that ambiguity. Nothing published distinguishes the two.

This vendor publishes the artifact this axis asks for, which puts it ahead of most of the lane. A data processing agreement is published with sub processors and security measures listed, so a buyer can see who else touches the data without asking for it, and that is the document that answers this axis rather than a privacy policy or a trust page badge.

It is accompanied by a correct and explicitly stated allocation of roles, with the clinic named as data controller and the vendor as processor, which many vendors leave vague and which determines who carries the obligations to the patient. Encryption is stated at a named strength rather than as bank grade, and audit trails cover every clinical record interaction. Held below the top grade for one specific reason a buyer can resolve in a minute.

Whether a foundation model provider appears on that published list could not be established from the located material, and that is the entry this axis most wants to see, since a model provider processing consultation content is a sub processor like any other. Read the published list and look for it. Two further questions are unaddressed by the document: retention of the underlying consultation audio once a note is approved, and whether any customer content contributes to model development. Ask both, and ask whether the list is versioned with change notification.

Adoption is stated at more than 3,500 healthcare practices worldwide, which is a real commercial fact and not evidence of benefit.

The only quantified claim located is a reduction in practice management overhead of up to 60 percent. A figure expressed as up to sets a ceiling rather than reporting a result, and it is unfalsifiable as written: any outcome from zero to sixty percent is consistent with it. No study, no named customer measurement, no baseline and no denominator were located for the scribe or for the platform.

The control detail is specific rather than generic. Protected health information is stated to be encrypted at rest and in transit using 256 bit encryption, with role based access controls, full audit trails of every clinical record interaction, and patient consent management tools.

Two further disclosures lift this above the norm. The company states plainly that the clinic remains the data controller and Pabau acts as processor, which is the correct legal characterisation and one many vendors leave vague. And its data processing agreement, published with its subprocessors and security measures listed, means a buyer can see who else touches the data. What is not addressed is retention of the underlying consultation audio after a note is approved, or whether any customer content contributes to model development.

Support for the United States health privacy security and breach notification rules is stated, dual coverage with European data protection law is a genuine selling point for a clinic operating in both, and the underlying hosting infrastructure holds an independent health privacy attestation.

Two things hold this at C. No business associate agreement posture for Pabau itself was located, only a European style data processing agreement. And the platform is described as having a one click compliance toggle, which is worth noticing rather than passing over: presenting a regulatory obligation as a setting implies the platform can also run with it off, and a buyer should establish exactly what that switch changes and what the default is.

A dedicated trust portal exists and the grade is C, but the reason is worth reading before that is taken as criticism, because the disclosure here is more honest than most vendors scoring higher.

The portal presents a wall of credentials: payment card standard attestation, a health privacy attestation report, an ISO 27001 certificate, a European operational resilience assessment, cloud security registry material and a privacy recognition for processors report. It then states directly that all of these are the certifications of the cloud and data centre providers hosting the platform, named as DigitalOcean and CoreSite, and that only the data protection registration is held by Pabau itself. That registration is an entry on a public register, not an audited certification.

So the honest position is that Pabau holds no independent attestation of its own controls, and it says so. Inherited certifications describe the building, not the tenant. This index has repeatedly found certification claims that do not transfer, and this is the first case where the vendor labels the non transfer itself. The grade reflects what is actually assured; the candour is credited and belongs alongside the other honest disclosure records.

No device pathway applies and none is claimed. Documentation, scheduling and practice management software of this kind sits outside device regulation in both jurisdictions the company serves.

The regulatory surface that does apply is unusual for this index and larger than a scribe alone would carry. The platform handles payments and holds inventory of prescription injectables, so payment card rules and controlled product record keeping apply alongside health privacy law, and the company operates under two different data protection regimes at once. None of that is device regulation and all of it is real compliance exposure.

Nothing published on model evaluation, subgroup performance or monitoring.

The exposure has a shape specific to this setting. Speech recognition accuracy varies with accent, dialect and first language, and this platform serves clinics across the United Kingdom, Europe and the United States, so the spread of speakers is wide by design. There is a second and less obvious dimension: an aesthetic consultation is a conversation about a patient's appearance, and a documentation model trained on that material is learning the descriptive vocabulary practitioners use about bodies and faces. What that vocabulary encodes, and whether the generated note reproduces it evenly across patients, is not addressed anywhere.

The band is reached through a combination of the governing regime and two things the vendor does that most of this lane does not. The regime first: operating under United Kingdom and European data protection law, the recorded individual holds enforceable statutory rights over their own data including rectification of inaccurate records, with a supervisory authority behind them and obligations reaching the processor as well as the clinic. Then the vendor's own contribution.

It states plainly that the clinic is the data controller and it is the processor, which is not a courtesy but the allocation that tells a clinic where its obligations to patients actually sit, and vagueness on that point is how those obligations get quietly overlooked. And it ships patient consent management tools, so consent is a function in the product rather than a paragraph in a policy, which matters on this axis because recourse begins with the recorded person having been asked.

Held below the top grade because nothing stands behind the output. No accuracy or error figure of any kind was located for the scribe, no warranty, indemnity or remediation commitment, and the specialty tuning claim is the one a buyer would most want evidence for.

Aesthetic consultation language is genuinely ambiguous in ways general transcription handles badly, since the same phrase can describe anatomy or a product quantity, and a configurable template is a formatting feature rather than evidence the recognition resolves that ambiguity. Ask for accuracy on the terms specific to the specialty, and for what the vendor commits to when a note is wrong.

The interoperability question inverts here, because Pabau is the record system rather than an application sitting on top of one. The relevant issues are therefore what comes in, what goes out, and how hard it is to leave.

No interface standard, export mechanism, prescribing network connection or third party integration was located for Pabau itself in this pass. The company's own positioning reinforces the concern rather than resolving it, since the pitch is that one platform replaces several subscriptions, which is a consolidation argument that says nothing about portability. Graded C on what was retrieved and flagged for re verification.

Cloud only, and better documented than most because the subprocessors are named. Hosting is attributed to specific cloud and data centre providers, and the data processing agreement lists subprocessors and security measures, so a buyer can trace where the data physically sits and who else has access.

Operating under both United Kingdom and European data protection law and United States health privacy law implies a residency answer exists for each market, since the same arrangement would not satisfy both. The specific regional split is not published, and no on premise or customer controlled option is offered or would be expected for a product of this kind.

No pricing was located in this pass and the grade is provisional rather than a finding. Published tier pricing is common in this category, with competitors criticised in third party comparisons specifically for hiding rates beyond an entry tier, so a buyer comparing platforms here will have numbers for some vendors and should expect them.

What is clear is the commercial argument: one platform replacing several subscriptions covering booking, records, payments, marketing and stock. That is a total cost claim, and evaluating it requires both the platform price and the price of the subscriptions it displaces. Flagged for re verification against the vendor's own pricing page.

Wide across private and elective outpatient practice rather than deep in one specialty. Named settings include aesthetic clinics, medical spas, general practice and multi specialty clinics, with multi location support coordinating clinicians, rooms and equipment across sites, and a stated base of more than 3,500 practices.

The clinical content is tuned toward injectables, dermatology, intravenous therapy and aesthetic procedures, which is where the specialty templates and the injection plotting and body mapping tools point. Geographic coverage across the United Kingdom, Europe and the United States is genuinely broader than most records in this lane, and it is the private pay sector throughout, with no evidence of use in publicly funded or hospital settings.