Patients.app

The models do the screening, and the record retrieval beneath them stands on its own. Patients.app says it finds patient records across 95 percent of US hospitals through national data networks, then uses its models to extract findings, screen records against a center's criteria, flag missing labs and clearances, and draft intake, anesthesia and review committee reports; it also sells extraction through an API and has built a voice agent that calls patients for pre-operative assessment. Retrieving and assembling outside records is a service a surgical team would buy without any model.

The product promises completeness in absolute terms. The home page says the product "fills every missing piece in your pre-op charting - so your OR runs on time, every time," and a counter promises surgical cancellations within 22 days "down to 0." Human structures do sit downstream: nurses review pre-op output, transplant output goes to a review committee, every result links to its source, and the privacy policy says providers keep final responsibility.

None of that is described as a mechanism with thresholds, and a reviewer told every missing piece is filled has no reason to check for the one that was not. The company has also built an agent that calls patients to complete the pre-operative assessment.

The approach is described and nothing is identified. The company refers to its own models and to domain-tested large language models with evaluation infrastructure, and says its team has over 15,000 citations on AI and healthcare. No model, training data, version or update practice is published, and the 3,200-question comparison with residents has no method.

The architecture is described and no model provider is named. The company describes a private instance per practice and an on-premises option, and the privacy policy names Google Analytics and unnamed third-party service providers, some possibly outside the United States. Nothing names who hosts the service, which model provider processes records, or the retention and training terms that apply once records reach one.

One named practice and vendor figures with no denominator. The Ortho Rhode Island case study names the practice and its director of clinical operations, who tracked cancellation timing for four total joint surgeons: before the pilot half or more of cancellations came within 14 days of surgery, and during it every cancellation for clinical reasons came earlier than that and each slot was backfilled; a nurse's workup went from about an hour to 20 minutes.

It gives no dates or case counts, and five other case study pages carry the same Ortho Rhode Island text under other partners' names. The transplant figures (35 percent more waitlist additions, 40 percent more living donor evaluations, 42 percent of declined patients ultimately listed) name no center.

Customer data may be used to improve the product. The privacy policy (modified 27 May 2024, review date 23 Sep 2024) says the AI tools generally use anonymized and aggregated data, but that PHI, including medical records and clinicians' questions, may be accessed to improve products and services, and that anonymized data may be shared with third parties for any purpose, including research and marketing.

The FAQ describes a private, HIPAA compliant instance for each practice that does not share patient data. Retention is described only as ongoing business need and contractual deletion, and transfers outside the United States are reserved. The product assembles complete transplant and preoperative workups from other organizations, and the company publishes no retention schedule, no deletion trigger for a declined candidate and no contractual bar on training with a customer's records.

A privacy policy covering the service backs a stated business associate position. The privacy policy says Granville Labs is a business associate to providers and health plans, enters business associate agreements with them, and uses PHI only as those agreements and HIPAA allow; the FAQ says a business associate agreement is all a treating practice needs to start. The agreement is not published. The product also retrieves records from organizations that are not its customers, and the legal basis for each outside retrieval is not stated.

A recognized certification is claimed as the company's own without the artifact. The home page says "HIPAA & SOC 2 Certified" and the site header says "HIPAA + SOC 2 Compliant," with full end-to-end encryption; the SOC 2 type, period and scope are not stated, and no report request path or trust center is published.

No device claim is made, and the scope statement is narrower than the functions. FDA's 510(k) database lists no clearance, the terms say nothing on the site has been reviewed by FDA, and the FAQ says the AI does not diagnose or make any suggestions, with providers keeping ultimate responsibility.

The same site says the product highlights strong transplant candidates, surfaces contraindications, flags patients outside safety criteria, compares patients against specialty guidelines and matches them to trials. Screening runs against the center's own criteria with source links a clinician can review.

Responsible AI is committed to in policy language with no evaluation behind it. The privacy policy says the company strives to use AI in line with responsible AI principles, and the home page says the product was developed by researchers, is aligned with emerging regulation, and was tested over 8,000 hours (the FAQ says 4,000 hours across three sites). No subgroup evaluation is published.

It matters for the transplant product above all, which highlights strong candidates and surfaces contraindications against a center's guidelines in a field with documented disparities in who is referred and listed.

Source links let a reviewer check each result, and the company disclaims the rest. Every result links back to its source document, and reports can be sent into the EMR so documentation is auditable. The one error figure is a home page chart from a study of 3,200 questions showing 0.6 percent for the product against 2.4 percent for medical residents, with the measure unlabeled and no method published. The privacy policy states that the company is not responsible for any omissions or inaccuracies in the services, and no warranty, indemnity or remediation commitment attaches to the output.

Integration is claimed broadly with no system named. The company says it connects directly to major EMRs, accepts every format from FHIR to fax, reaches 95 percent of US hospitals through national data networks, and can send reports back into the EMR; it also fills UNOS and TIEDI forms for transplant programs. No EMR, network or registry interface is named or documented.

Options are stated, and residency for the hosted route is not. The FAQ describes a private instance for each practice, and the clinical teams section says the company can deploy on premises or on local cloud instances so data stays in the customer's environment. For the hosted route no provider or region is published, and the privacy policy reserves transfers outside the United States.

No price is published, and the sales routes are discoverable. The product is sold to ambulatory surgery centers, transplant centers and clinical teams, and to health technology companies through an API, with a demo request to start. The home page counts a "guaranteed revenue increase" of 15 percent with no terms.

Coverage is named with one named practice behind part of it. The product targets pre-operative screening at ambulatory surgery centers, transplant candidate evaluation, clinical teams in any record-heavy workflow, and health technology companies through an API. The pre-operative use is supported by the Ortho Rhode Island case study in orthopedic surgery; the transplant use rests on figures without a named center, and the oncology and anesthesia case study pages carry the orthopedic text.