ScribeMD

Ambient capture and note generation are the entire product, delivered self serve with an API alongside. No services layer or platform business underneath.

A third party claim about human oversight runs against the vendor's own account of the product.

A third-party review described this product as operating a hybrid model combining machine learning with human oversight. If accurate that would place it in the human-review cluster and would materially change the record, since an intermediate human reviewer is a different product with different confidentiality, cost and latency consequences. The claim reappears on a further aggregator listing and is supported nowhere in the vendor's own materials.

The vendor describes the opposite shape. Its own account of the workflow is that the clinician starts a session, records the visit, and the software generates a draft note which the clinician reviews, edits and exports. No intermediate reviewer appears anywhere in that description, and vendors operating a human review layer market it prominently, because it is the expensive part and the differentiator.

The claim is treated as unsupported. Aggregator listings copy one another, so a claim appearing on two such sites is one source rather than two, and repetition across directories is not corroboration.

That leaves the ordinary position. The clinician is the only reviewer and the signature is the control point, which is not a weakness in itself. What is missing is any published detail about how well that control performs: no confidence threshold, no acceptance or edit rate, no description of what the system does when uncertain, and no statement of whether anything is flagged for closer attention.

The multi-speaker capability sharpens one question. A product supporting up to nine speakers will face attribution errors, and a note attributing a symptom to the wrong person reads as fluent and correct.

Nothing is published about what produces the output. No model or model family is named, no architecture is described, no training data is characterized, and no model card, evaluation protocol or versioning statement exists.

The figures circulating for this product, a transcription accuracy percentage and a sub-second processing time attributed to a proprietary large language model, come from a third-party software directory rather than from the vendor, and carry no methodology, reference standard or date. Nothing on the vendor's own estate substantiates them. They are not evidence: a number a buyer finds in a directory is not a representation the vendor has made, and the vendor cannot be held to it.

That distinction is the substance here. A buyer researching this product will encounter those figures, will reasonably assume they came from the company, and has no way to tell from the directory listing that they did not.

What the vendor does say about itself is a superlative rather than a disclosure: that it is the number one artificial intelligence medical scribe, which is unfalsifiable and identifies nothing.

What counts is the vendor's own silence and its own unfalsifiable claim.

Nothing identifies any party in the chain. No model or model family, no foundation model provider, no hosting arrangement and no subprocessor list is published.

The one claim about the model layer, that the product runs on a proprietary large language model, appears in a third party software directory rather than in the vendor's own material. So the only statement a buyer can find about what sits behind the product was not made by the company selling it, and a claim of proprietary technology carries weight only when its author is accountable for it.

What the vendor does publish about content handling is better than the enumeration gap suggests, because it governs what happens to data once it reaches whoever is in the chain. Data is stated to be automatically deleted fifteen days after recording, and patient data is stated never to be used to train models. Those retention and training terms are specific enough to be held to.

What remains missing is the names themselves, and one structural point compounds it. The hosting position is described as audited infrastructure without naming the provider, so a buyer cannot tell whose data center holds the recordings or in which country, and the product's own privacy policy contemplates transfers to the United States from another jurisdiction entirely.

Retention configurability being reserved to the top commercial tier means a customer on a lower plan takes the fifteen-day default as given.

Adoption is claimed at more than 3,000 physicians. That is a scale claim, not an outcome, and it is unattributed: no institution, practice or health system is named anywhere, and no deployment of any size is described. A count of users tells a buyer the product sells; it says nothing about whether the notes are accurate.

No study, controlled evaluation, accuracy benchmark, third-party performance rating or independent assessment exists. No customer is named. No case study is published.

The accuracy figure a buyer will encounter while researching this product does not come from the vendor at all. A transcription accuracy percentage in the high nineties circulates in a third-party software directory, with no denominator, methodology, reference standard or date, and nothing on the vendor's own estate states it. It is not a claim the vendor has made and cannot be held to as one: a figure with no author is not a figure a buyer can test.

The vendor's own performance language is a superlative rather than a measurement, describing the product as the number one artificial intelligence medical scribe.

None of this is difficult to remedy at this company's stage. A single named practice willing to describe its experience, or one accuracy figure with a stated method, would change the picture.

Retention and training use are both published.

Retention is stated as a specific window: all data, including notes and customer details, is automatically deleted fifteen days after recording. That is short, it is a number rather than a posture, and a customer can hold the vendor to it.

The training position is stated plainly and in the direction a buyer wants: patient data is never used to train models. Encryption in transit and at rest is stated, alongside audit logs and role-based access.

What is missing is the third element. No de-identification practice is described anywhere: nothing states whether identifiers are stripped before processing, at what point, or by what standard. For a product processing conversational audio that is the element with the most engineering behind it and the least said about it here.

One commercial structure qualifies the retention answer rather than contradicting it. The ability to customize retention and deployment is listed as a custom enterprise tier feature, so the fifteen-day default applies as given on the free and standard plans and cannot be extended or shortened there. For most buyers that is fine and arguably preferable; for one with a records-retention obligation of its own, the inability to lengthen it is the constraint to check.

The free tier deserves a note of its own. Sign-up is self-serve, so patient audio can begin flowing before any agreement or configuration conversation has happened.

Availability is published in two places on the vendor's own estate: it states plainly that it can provide a business associate agreement on request, and lists the agreement as available among its security statements. Status is therefore acknowledged and the instrument is offered; what is unpublished is the agreement itself and its scope.

The supporting material is substantive. The vendor states data is encrypted in transit and at rest, that patient data is never used to train models, that retention is customer-controllable, and that all data is automatically deleted fifteen days after recording. Audit logs and role-based access are described.

One feature of the commercial model creates a real exposure. Sign-up is self-serve with a free tier, so a covered entity can begin putting patient information through the product before any agreement exists, which under the United States rule is the violation rather than a technicality. Nothing in the adoption path prompts the question, and the tier at which an agreement is actually executed is not stated.

There is also a jurisdictional oddity. The privacy policy published for this product is drafted for South African data protection law, names the operating entity as a differently named corporation, and states that personal information may be transferred to the United States where the servers sit. For a product sold principally to United States clinicians under a health privacy claim, which policy governs a given account is not obvious.

The vendor's own material names a recognized certification rather than a near attestation formulation. Two things limit it, and the second is the more important.

The report type is not stated. A Type I attestation describes controls as designed at a point in time; a Type II describes them as operating over a period. Those are materially different assurances and a buyer reviewing a vendor cannot treat them as interchangeable. No audit date, period or scope is given either, so the certification has neither a clock nor a boundary attached to it.

More significantly, the vendor uses two different formulations across its own estate. One page states the product is certified. Another states it is hosted on audited infrastructure. Those are not the same claim: the second attributes the certification to the hosting provider rather than to the vendor, and an attestation covering a data center says nothing about the application running inside it. The company does not say which of the two describes the actual position, and the difference changes the answer entirely.

A third formulation, security practices described as aligned to the health privacy rule, appears alongside both. Aligned is an aspiration rather than an examination.

What is described concretely is better than the heading suggests: encryption in transit and at rest, audit logs, role-based access, a stated retention window and a statement that patient data is never used to train models. Those are checkable commitments.

No clearance is claimed and none is required for ambient documentation. The clinician reviews, edits and exports the draft, and that signature is the control point.

Two scope items sit around the documentation core.

The product is marketed to dentists as well as physicians. That does not change the device analysis but it does change the professional and payer context, since dental documentation runs through different coding sets and different payer rules, and a note structure built for medicine does not automatically serve it.

More substantively, the vendor markets artificial-intelligence-driven pre-authentication aimed at faster claim approvals. Prior authorization is a payer-facing function rather than a documentation one. It sits on the reimbursement side of the boundary and raises a question note generation does not: what the system submits to a payer on the practice's behalf, and who is accountable for the accuracy of that submission. A prepared request a human reviews and sends is a different object from one the system transmits itself, and only the second puts the vendor's output directly in front of a payer under the practice's name.

Beyond that the product is narrow. No coding engine, no decision support module and no patient facing product exists, which keeps the core regulatory position simple.

Markets are wider than the United States. Capture is claimed across more than thirty languages and the site is localized into eight, while ambient documentation is treated as software as a medical device in the United Kingdom and European Union. No registration or classification under that regime is published, so nothing shows that the United States position travels.

Multilingual operation with no subgroup performance, where the vendor markets recognition quality as a strength, is the situation here. No governance or responsible use commitment in policy language exists either.

No fairness statement, subgroup analysis, accuracy breakdown by accent, dialect or speaker population, evaluation methodology or model card is published. Nothing describes how the model is tested before a release or monitored after one.

The absence is more conspicuous here than for a single-market vendor, because of what the product sells. Capture across more than thirty languages is a headline claim, the site is localized into eight, and a nine-speaker capacity is marketed as a differentiator. The range of accents, dialects and language backgrounds this system encounters is therefore wide by design. A vendor that chooses breadth has taken on the harder version of the recognition problem and has published nothing about how it performs across it.

The one figure circulating makes the point rather than answering it. A single headline accuracy percentage, spanning every language and speaker configuration at once, cannot distinguish strong performance in one language from weak performance in another. The average conceals exactly the variation that matters, and it does not come from the vendor in any case.

The nine-speaker capability adds a second dimension. Speaker attribution errors rise with the number of voices, and a note attributing a symptom to the wrong person reads as fluent and correct.

The vendor states that all data, including notes and customer details, is encrypted and automatically deleted fifteen days after recording. That is a specific, short window a customer can hold the vendor to.

The mechanism is the workflow itself. The vendor's own account is that the clinician records the visit, the software generates a draft, and the clinician reviews, edits and exports it. Review precedes anything leaving the product.

Nothing stands behind the output. No accuracy or error figure, no published limitation and no warranty, indemnity or remediation commitment exists, and no route is described for a patient who finds an error.

The figures circulating for this product, a transcription accuracy percentage and a sub-second processing time on a proprietary language model, come from a third-party software directory rather than from the vendor, and carry no methodology, reference standard or date. Nothing on the vendor's own estate substantiates them. A number a buyer finds in a directory is not a representation the vendor has made and cannot be relied on as one. The site does describe the product as the number one artificial intelligence medical scribe, which is unfalsifiable.

One commercial structure still bears on recourse. Customizing retention and deployment is listed as a feature of the custom enterprise tier, so while the fifteen day default is published, changing it is not available below that tier.

An integrations page and a public application interface both exist, which is positive evidence of an integration surface rather than a copy-and-paste-only product, and the vendor states that the note syncs to the record system.

What cannot be established is any of the detail that makes the difference. No record system is named anywhere. No integration architecture is described, no write-back mechanism is specified, and nothing states whether a note lands as discrete fields or as a block of text in a free-text box. No marketplace listing or integration documentation is published against any named platform, and no customer is named on any system.

Integration is claimed through an interface layer, with no system named and nothing a buyer can verify before contracting.

The gap matters more for this product than it would for an enterprise one, because of how it is bought. Signup is self serve on a free tier, so a clinician can adopt it individually and discover only later what their practice's record system actually receives. There is no implementation conversation in that path to surface the question.

The public interface is the one surface where the answer is checkable: what it exposes, whether it writes as well as reads, and what authentication it uses say more than the integrations page does.

Nothing published shows what a specific record system receives, and no practice is named running any connection.

A single hosted cloud option with the location stated in one place and committed nowhere.

The hosting provider is not named. What is published is that the service runs on audited infrastructure, which describes the provider's assurance posture without identifying the provider, so a buyer cannot tell whose data center holds the recordings.

The only published location statement sits in the privacy policy, which says servers are in the United States. That is useful and it is the closest thing to a residency answer the company gives, but it comes with a significant qualification: the policy it appears in is drafted for South African data protection law and frames the United States as the destination of an international transfer. For a product sold principally to United States clinicians, a residency fact stated only inside another jurisdiction's policy is not a commitment a United States buyer can rely on, and it is not clear the same policy governs their account at all.

No region options, no residency commitment by contract and no subprocessor detail is published for any tier.

Deployment is listed as customizable on the custom enterprise tier, alongside a branded mobile application, which establishes that options exist above the published plans without describing what they are. Below that tier there is one configuration and it is the one you get.

The self-serve free tier means audio can begin leaving a practice before any of this has been established.

A complete published ladder with the limits stated rather than implied. The free tier is 10 conversations a month with nine speaker support and a 48 hour support response commitment. The paid tier is $99.99 a month for unlimited conversations, adding analytics, custom note formatting and a 24 hour support response. The enterprise tier is custom quoted and names what it adds: a branded mobile application, customizable data retention and deployment, one hour support response and team management.

Publishing support response times per tier is unusual and useful, since support quality is a real differentiator that almost nobody commits to contractually.

The coverage here is claimed rather than validated, and no deployment is named in any of it.

What is specific, and unusual, comes first because it is the reason a buyer would look at this product.

It publishes a multi-speaker capacity as a number rather than a category: support for up to nine speakers, where competitors say only multi-speaker. Nine speakers covers family consultations, pediatric visits with both parents present, interpreter-mediated encounters and small case conferences, which are exactly the situations two-voice models handle badly. That capability sits in the free tier rather than behind an upgrade, so the buyer least able to pay is not the one excluded from it.

Language reach is also real rather than gestural. The vendor states capture across more than thirty languages, and its own site is localized into eight, including Korean, Japanese, Arabic and Greek. Localizing a product estate is a commitment of a different order from listing languages on a feature page.

Depth is missing. A claimed fifty or more specialties is a count, and no specialty instrument is named anywhere: no score, staging system or structured measure that a given specialty actually records. Dentistry is named as a supported note structure, which is a specific and uncommon claim, but nothing describes what the dental note contains. That is the difference between a template library and domain depth.

No recognition performance figure is published for any language or speaker count.