Spring Health

The matching model is the engine of how care is assigned, and what is sold underneath it is a care delivery business.

The model does real and proprietary work. Precision Mental Healthcare uses machine learning to match a member to a provider and a level of care rather than handing them a directory, which the company describes as the first capability its architecture enabled. Guide extends that across the journey, surfacing the next step as needs change and carrying context between episodes. Compass, the company's own mental health record system, turns every provider patient interaction into measurement based care insight fed back to the clinician. None of that exists without the models, and the matching claim is the reason an employer chooses this over a traditional assistance program.

What remains if the models are removed is substantial and is what the customer actually receives: a credentialed provider network delivering therapy, medication management and coaching across all fifty states and internationally, a proprietary record system, scheduling and availability infrastructure, employer reporting, specialty and family care lines, and critical incident response. Members are seen by licensed humans; the platform books them, records the care and bills for it. That is a complete mental health benefit and it would still be saleable as one.

The company argues the other way. It describes itself as founded in 2016 as an artificial intelligence company rather than a therapy network that later added artificial intelligence, and distinguishes an AI native architecture from AI enabled features bolted onto an unchanged care journey. That is a real distinction about how the product was built. The product underneath is still a care delivery organization with a differentiating technology layer rather than a technology product.

Advisory to licensed clinicians by design, with a member facing layer that now needs its own answer.

The provider side is sound and consistently stated. Models surface matches, real time provider feedback and cues; a licensed clinician delivers the care and makes the clinical decisions. Human providers at the center is stated as a design principle rather than a disclaimer, clinical oversight is asserted across the platform, and an internal governance board oversees the tools. Both members and providers must consent to artificial intelligence assisted care, which puts a control in the hands of the two people affected.

The member facing layer is where the structure is thinner. The platform now runs an artificial intelligence that supports members across every stage of the journey, surfacing the next step as needs change, keeping people engaged between appointments and connecting them to human care when that is the right next step. Self guided care is described as including artificial intelligence support. The company is explicit about what it is not, saying it is not a chatbot, not an assistant and not a replacement for human care, and states that mental health artificial intelligence has to recognize risk and operate within clinical boundaries.

What is missing is the threshold. Nothing published states what the member facing layer does when someone discloses risk, what triggers a connection to human care rather than another suggestion, how quickly a person is reached, or what a member in distress sees before reaching one. Recognizing risk is named as a requirement the company sets itself, and no mechanism, criterion or evaluation result is published against it.

The company publishes a named responsible artificial intelligence framework for mental health, which is where those commitments would live, and no audit result against it is available.

No model card, named model family, published accuracy figure or evaluation methodology is published, and the company describes its matching technology as clinically validated without the validation being reachable.

The evidence very likely exists in the open literature. The company originated as a university research spin out, one founder is an active academic in machine learning applied to psychiatry, and the business publishes peer reviewed work and ties outcome monitoring to commercial contracts. A vendor of this profile can normally supply a bibliography rather than a marketing claim.

No peer reviewed publication underpinning the matching model is cited, and nothing says what outcome it was validated against, in what population, or whether the deployed system is the one that was studied. That last point matters for any model retrained since publication, and the company describes its architecture as always learning for continuous improvement with every interaction, which means the deployed model is by its own account not static.

The member facing layer is described functionally and not technically. It surfaces the next step, carries context between episodes and connects people to human care; no model, provider, version or update cadence is named for it, and nothing states what a member or a provider sees behind a recommendation.

The company also publishes commercial outcome figures, including return on investment multiples and a 52 percent reduction in mental health claims costs. These are financial claims made to employers rather than clinical ones, and they say nothing about model performance.

Nothing identifies any party in the chain. No model or model family, no foundation model provider, no hosting arrangement and no sub processor register is published, and no statement addresses whether clinical content is used to train models.

That last silence matters more here, because the company describes its architecture as always learning for continuous improvement with every interaction. Continuous learning from interactions is a training claim. Nothing published says what it learns from, what consent covers it, or whether a member's opt out of data sharing reaches it.

A second exposure comes from who the parties are. The paying customer is an employer, the person receiving care is that employer's employee, and the subject of the data is therefore not the customer. The company operates an analytics platform giving benefits managers insight and return on investment forecasting, so an employer facing reporting flow exists by design and is part of what is bought. Aggregate and de identified reporting is the correct arrangement and is presumably what is provided, and the question is granularity rather than intent: in a small team or a single site, utilization and outcome aggregates can identify individuals without naming them, and an employee has no way to know what their employer can infer. The family care line extends that to dependents.

A trust portal is referenced at a dedicated subdomain, which is where a sub processor register would normally sit.

Real peer reviewed outcome research on this program, and headline figures that the research does not carry.

The research is the strongest part of the case. A study of clinical and financial outcomes associated with this workplace mental health program was published in JAMA Network Open, a general medical journal with full peer review, and it reports both halves of what the company sells: clinical improvement and cost. That is outcome evidence answering an outcome question, which is the right shape. The company originated as a university research spin out and a founder is an active academic in machine learning applied to psychiatry, so the research posture is real rather than decorative.

What undercuts it is the distance between the published work and the marketing. The figures on the company's own pages are 92 percent of members reliably improved or recovered from depression or anxiety, a 52 percent reduction in total mental health claims costs for employers, and under one day to first appointment. Each is presented as being among Spring Health customers, with no period, denominator, comparison group or citation. The improvement figure published in the peer reviewed literature is a different number against a different measure, and nothing on the site lets a reader establish which population or definition either refers to. A cost reduction of that size across employer populations is the claim that most requires a controlled design, and it is the one with nothing attached.

The research library compounds the difficulty rather than resolving it. The company's research page is dominated by human resources guides, eBooks, whitepapers and executive briefs, and of the five items tagged as research, three are general psychiatry literature about exercise, transcranial magnetic stimulation and Mendelian randomization rather than about this product.

The company publishes a good deal on this, and the structural question its disclosures do not reach is the central one for this model.

What is stated: both members and providers must consent to artificial intelligence assisted care, members have transparency into how their data is used and can opt in or out of sharing, and an internal governance board oversees the tools. Dual consent suits this setting, since the therapist has a professional stake in whether software processes a session and the member has a personal one.

The weak point is who the parties are. The paying customer is an employer; the person receiving care is that employer's employee. The subject of the data is not the customer. The company operates an analytics platform giving benefits managers insights and return on investment forecasting, so employer facing reporting exists by design and is part of what is bought. Aggregate and de identified reporting is the correct arrangement and is presumably what is provided. The question is granularity rather than intent: in a small team or a single site, utilization and outcome aggregates can identify individuals without naming them, and an employee has no way to know what their employer can infer. The family care line extends this to dependents, whose data reaches a report their relative's employer receives.

Handling specifics are absent. No retention schedule, no encryption statement, no deletion position, and no statement on whether clinical content trains models, despite the company describing its architecture as always learning for continuous improvement with every interaction. That phrase is a training claim without a training disclosure.

A status stated without the instrument behind it.

Health privacy compliance is stated on member facing material, and European data protection compliance is claimed alongside it for the international footprint. A security statement, a privacy policy, a California resident notice, a member grievance route and an integrity hotline are all published, so the privacy posture is documented at the level of a statement.

No business associate agreement posture, template, execution requirement or subcontractor flow down position is published. For a company contracting with health plans, that instrument very likely exists; it is simply not on the site, so neither it nor its scope can be read before contracting.

One feature of this business complicates the agreement question. Where the customer is a health plan, the company is a business associate in the ordinary way. Where the customer is an employer, the employer is generally not a covered entity for its own workforce's care, and the relationship runs through the group health plan rather than the company, which changes who holds what obligation and who must be told about a breach. The family care line extends the same question to dependents.

Separately, a substance use disorder care line is marketed, and those records carry a federal confidentiality regime with its own consent and redisclosure rules that a standard agreement does not satisfy. Nothing published engages it.

Two externally examined frameworks and a published disclosure program, with the details that make a certification assessable still missing.

What is claimed: SOC 2 and HITRUST, alongside health privacy and European data protection compliance. Holding both examined frameworks is the substantive point because they test different things. SOC 2 evaluates controls an organization itself defines against trust criteria, so its rigor depends partly on what was scoped in. HITRUST is prescriptive: an assessor evaluates against a defined control set built for healthcare, so certification means meeting an external standard rather than one the company chose. A vendor holding both has been assessed on its own control design and against a healthcare specific benchmark.

A published vulnerability disclosure program sits alongside them and stands out on its own. It sets out responsible disclosure guidelines, a submission route, scope limits, and a commitment to respond within two business days.

A trust portal is referenced at a dedicated subdomain for deeper security, compliance and privacy detail, which is the route by which the artifacts would normally become retrievable.

Two details remain unstated. The SOC 2 report type is not given, and the distinction matters: a Type II tests operating effectiveness across a period, a Type I assesses design at a point. The HITRUST assessment level is not given either, and that framework offers tiers of very different depth. No dates or scope statement appear, and scope is a real question for a company operating a provider network, its own record system and an employer analytics platform.

The company makes no device claim and scopes the product accordingly, leaving one classification question unanswered in writing.

A substantial regulatory structure governs this business and the company engages with parts of it visibly. Mental health parity requirements shape how an employer sponsored behavioral benefit must be designed relative to medical coverage. Clinician licensure is state by state, and a network operating in all fifty states plus internationally manages licensure and cross border practice rules continuously. The company holds accreditation from the recognized behavioral health accrediting body, which examines clinical quality and crisis care and is an external assessment rather than a self claim. It also publishes a named framework for validated and responsible artificial intelligence in mental health.

None of that is a device pathway. Answering to the regime that actually governs a business is not a regulatory position on the software, and an accreditation of clinical quality says nothing about how a matching algorithm is classified. No clearance, classification, determination or statement that the product sits outside device regulation appears anywhere.

The classification question is live rather than academic. A system that directs a person toward therapy, medication management or coaching is making a recommendation about treatment modality, and the company now extends that to an artificial intelligence layer that surfaces the next step to the member directly as their needs change. Where software informs a clinical choice, the decision support analysis turns on whether the person acting on it can review the basis independently, and nothing published describes what a provider or a member sees behind a match or a recommendation.

A position is published alongside it, which is why this reads as a tension rather than a contradiction: human providers are stated to be at the center, the member facing layer is described as not a replacement for human care, and clinical oversight is asserted across the platform.

A named, published governance framework with process behind it, and no results measured against it.

The company published VERA-MH, a framework for validated, ethical and responsible artificial intelligence in mental health, and a named framework carries more weight than a values page. Around it sit stated process commitments: clinical oversight, member privacy and consent, transparency about how artificial intelligence supports care, human providers at the center, mental health specific safety evaluation, and ongoing research and testing. An internal governance board is named as an accountable function overseeing the tools, and dual consent, from both member and provider, is a control rather than a policy statement.

What is absent is evaluation output. No bias or fairness testing result, no performance breakdown by any population, no calibration data, no drift monitoring output and no external audit against the company's own framework is published. Mental health specific safety evaluation is named as a practice with no finding attached.

The risk is concrete for this product rather than generic. The matching model decides which provider and which modality a person is offered, drawing on their history and presentation. If matching quality varies by race, language, geography or plan type, the effect falls on who gets the right clinician first and who cycles through the wrong ones, and a member has no way to detect it. The international footprint adds language as a second dimension that nothing addresses.

The framework exists; the measurement does not.

Two mechanisms here address the affected person rather than the buyer, and nothing measures or stands behind the models.

Both mechanisms are real controls. Dual consent is the first: both members and providers must consent to artificial intelligence assisted care. That is the right design for this setting, because a therapist has a professional stake in whether a session is processed by software and a member has a personal one. Members also have stated transparency into how their data is used and can opt in or out of sharing, which is exercisable rather than declaratory. The second is an internal governance board overseeing the tools, weaker than an external body but a named accountable function. A published vulnerability disclosure program with a two business day response commitment sits alongside, and a member grievance route and integrity hotline are published.

Nothing measures the models. The matching technology is described as clinically validated without the validation being reachable, no accuracy figure, match quality measure or evaluation methodology is published, and no warranty, indemnity or remediation commitment exists. The member facing recommendation layer is described as needing to recognize risk, with no measure of whether it does.

The company publishes commercial outcome figures including a 52 percent reduction in mental health claims costs and net positive return on investment. Those are financial claims made to employers, neither evidence about model performance nor commitments about an individual result.

The vendor operates its own record system, described as an exclusive global electronic health record supporting documentation and measurement based care for its provider network, alongside calendar integrations maintaining real time availability across all fifty states.

Owning the record system solves internal integration completely and creates an external question the vendor does not address. A member's therapy notes, medication management and outcome measures sit in a system their primary care physician cannot see, and their medical record sits somewhere this platform does not reach.

That separation is not automatically a failing. Behavioral health records carry consequences other clinical records do not, many people deliberately keep mental health treatment out of their general medical chart, and a benefit accessed through an employer is one people use partly because it sits apart. Separation is protective as well as fragmenting.

Whether it is the member's choice or an artifact of architecture is not addressed. Nothing published says whether a member can direct that a summary be shared with their own physician, whether medication management is visible to whoever else prescribes for them, or what happens at the interface where it matters most, which is prescribing interactions.

No hosting model, region, tenancy or residency commitment is published. Delivery is a cloud platform serving members, providers and employer administrators, with the company's own record system beneath it.

Residency is a live question here rather than a formality, because of reach. The company serves members across a very large number of countries and claims European data protection compliance alongside the United States privacy rule. Those two regimes impose different obligations, and the European one treats mental health information as a special category with conditions on processing and on transfer outside the region.

The unanswered points are concrete. Where is a European member's clinical record held, and if it leaves the region, under what transfer mechanism. Whether the company participates in the current transatlantic framework or relies on contractual clauses. And whether residency can be committed by contract for a multinational employer, which is the buyer most likely to need it.

The employer analytics layer adds a second dimension. Aggregated reporting crossing borders is still derived from clinical data, and a multinational employer receiving one consolidated view is receiving something assembled from records held under several regimes.

A trust portal is referenced at a dedicated subdomain and is the likeliest place these answers sit, which makes this an absence on the pages a buyer reaches first rather than necessarily an absence altogether.

Enterprise contracting with no published basis, in a market where the buyer and the user are different people.

No rate card, unit of charge, per employee per month range, minimum commitment, term or pilot terms is published. Contracts are with employers and health plans, and member cost varies by plan; the consumer pages state coverage as low as $0 per session across hundreds of insurance plans and thousands of benefit plans, which describes what a member pays rather than what the benefit costs the organization buying it.

The returns are published in detail by contrast, which is the familiar asymmetry. Net positive return on investment is the headline framing, with a 52 percent reduction in total mental health claims costs stated among customers, and an executive brief published on precision mental health and total cost. A buyer is given the savings side of a financial model and none of the cost side, so none of it can be turned into a comparison.

The product structure makes a single basis unlikely. Therapy, medication management, coaching, self guided care, specialty care, family care covering dependents, manager and team support and critical incident response are separately marketed lines with different delivery economics, and nothing indicates whether they are bundled into one per employee figure, bought as modules, or charged on utilization. Sessions covered per member per year is the number that usually decides the price of a benefit like this, and it is not published.

Coverage is named across a very wide range and validated behind one part of it.

What is named is specific and it has grown. Care modalities: therapy, medication management, coaching, and self guided care including an artificial intelligence support layer. Service lines sold separately: specialty care, family care covering dependents, manager and team support, and critical incident response. A substance use disorder line is marketed with its own executive brief. Buyer types are distinct and each has its own page: employers, health plans, brokers, consultants, channel partners and providers. Geography is all fifty states plus international operation, with reach stated at more than 170 million people covered across hundreds of insurance plans and thousands of benefit plans.

Support sits behind the core. The published outcome research covers the workplace mental health program, which is the therapy and medication pathway for an employed adult population. That is the part of the offering with evidence attached.

What is not evidenced is everything around it. Nothing published validates the coaching line, the self guided care line, the substance use disorder line, or critical incident response. Family care raises the sharpest gap, because it reaches dependents and therefore children and adolescents, who use different instruments, different modalities and a different evidence base, and no pediatric position or validation appears anywhere. International operation raises a language and regulatory question that nothing addresses, and no language coverage is published.

The breadth sets it apart for an employer buying one contract instead of several. It also means the coverage claim and the evidence claim describe different products.