Telepatia

Built AI native from launch in July 2025 rather than adding models to existing software, which the company and its investors frame as the advantage of building in a market without decades of accumulated health IT. Documentation, decision support, and error detection are all inference; there is no legacy product underneath.

The position is stated explicitly and is notable given the company markets a suite it describes as AI healthcare employees including AI doctors and nurses: it supports clinicians rather than making decisions, with the physician always making the final call and retaining clinical responsibility. Error flagging in real time so the clinician can adjust course is decision support by design, since the system surfaces a concern rather than acting on it. Holding a clear ceiling while using employee framing in marketing is a distinction that matters, and here the ceiling is documented.

The suppliers are named on the vendor's own privacy policy: ElevenLabs for speech to text, Google's AI models for speech to text, de identification and language model processing, and OpenAI for de identification and draft generation. The training corpus is also characterized: the company states its system is trained on peer reviewed literature, clinical guidelines and local institutional protocols.

What is missing is the version and update discipline. No model versions are given, nothing says which language model produces which output or how often suppliers change, and the policy reserves the right to add subprocessors for the same purposes. No evaluation methodology is published.

Grounding a clinical system in each institution's own protocols is a real differentiator, because recommendations reflect what that hospital has decided rather than a generic standard. It also creates obligations nobody has described: how protocols are ingested, who validates they were captured correctly, how they are kept current, and what the system does when a local protocol conflicts with a published guideline.

The model layer is named on the vendor's own privacy policy, in a section listing its main artificial intelligence subprocessors and what each receives.

ElevenLabs receives encounter audio for speech to text and processes it without durable storage. Google, through Google Cloud Platform and Google's AI models, provides speech to text, de identification, language model processing and hosting, and receives audio, transcripts and hosted platform data. OpenAI receives transcripts for de identification and draft generation and processes them without durable storage. Each is bound by data processing agreements, including business associate agreements, and prohibited from using the data for its own purposes. Transmissions are encrypted with TLS 1.2 or higher.

Two gaps remain. The list covers the main subprocessors currently engaged, and the policy reserves the right to engage others for the same purposes, so it is not a complete enumeration and changes may not be announced. And no hosting region is stated for Google Cloud.

Institutional protocols raise a supply chain question as well. The system is described as grounded in each institution's own protocols, and nothing states whether one hospital's protocols stay in a model serving only that hospital.

Unusually specific for a company one year old, with named sites and figures: protocol adherence reported rising from 84 percent to 99 percent, 1.7 to 2 hours recovered per physician daily, 60,000 errors flagged in real time, over 5 million consultations processed, and Mater Dei reporting roughly eight hours of daily use per physician. Sustained daily use at that intensity is a strong adoption signal because it is hard to fake. All figures are vendor or investor stated without published methodology, and nothing defines what the errors prevented count includes or how prevention is demonstrated.

The training and de identification questions are answered in the vendor's privacy policy.

The policy states that identified personal data is not used to train its models. By default, data that has been de identified may be used to improve the company's models unless the client institution disables this in the platform's administrative settings, which it can do at any time. De identification is a named processing step, with Google and OpenAI removing personal identifiers from transcripts before draft generation, and two of the three named subprocessors process data without durable storage. Encounter audio is described as temporary data.

The weak point is retention. The policy says retention and removal follow the policy contracted with each institution and its platform settings, and that data is retained by default, so no default retention window is published. Nothing describes the de identification method or how its effectiveness is tested, or the safety engineering behind the copilot's recommendations.

The platform's breadth matters for the training default. Alongside documentation it operates a clinical copilot, an interoperability layer and analytics that retain clinical activity data over time, and institutional protocols are part of what the system is grounded in, so the default reaches several classes of content.

The United States health privacy rule is not the governing regime for this vendor, and the home regime is documented to real depth. The privacy policy is issued by Telepatía S.A.S., domiciled in Medellín, under Colombia's Law 1581 of 2012 and Decree 1074 of 2015. It defines health data as sensitive, sets out controller and processor duties, names the function handling requests, and publishes response times for data subject consultations and claims of ten and fifteen business days. It also names the main subprocessors and states they are bound by data processing agreements, including business associate agreements.

Two scope points limit it. The policy applies where the company acts as data controller, and states that processing performed by health professionals falls under the provider's own policies, so the institution's agreement with the vendor, which is not published, is the instrument that governs encounter data. And the English policy is written to Colombian law, while the company's deployments reach Brazil and Mexico, whose regimes impose their own conditions on health data and international transfer.

The company has described itself in press as HIPAA compliant. No customer facing business associate agreement is published to support that description.

Controls are asserted and nothing independent stands behind them on the vendor's own material.

The privacy policy describes encryption in transit using TLS 1.2 or higher and encryption at rest for platform data, and commits to technological, administrative and physical protocols for sensitive health data. No attestation, certification, audit report, penetration testing cadence or trust center is published, and the site footer links only the terms, the privacy policy and social accounts. In a Colombian press interview the company described itself as ISO 27001 compliant, HIPAA compliant and GDPR compliant. Compliant is a claim of alignment rather than a certification, and no certificate, registrar or scope is given.

Scale raises the expectation. The platform is deployed across more than twenty five hospital systems in several countries, and its subprocessors include Google Cloud and OpenAI, whose own attestations cover their services rather than this vendor's controls.

Two features enlarge what an examination would need to cover: an interoperability layer that moves information between hospital systems, and analytics that retain clinical activity data over time.

The markets that matter for this vendor sit outside the United States device pathway, and no device clearance is claimed in any of them.

The vendor positions the product as supporting clinicians rather than deciding, and its privacy policy states that draft documentation is returned to the health professional, who reviews and approves it before it is confirmed. The regulatory position rests on that scoping.

The compliance environment in its primary markets is still forming. Brazil's Senate has approved a risk based artificial intelligence framework pending further approval, and Colombia has sent its own bill to Congress. A framework adopted after deployment can impose classification, evaluation or transparency duties on systems already in clinical use, and the buyer typically absorbs the remediation.

One feature sharpens that exposure. Alongside documentation the vendor operates a clinical copilot that flags potential errors and delivers evidence based recommendations and institutional protocol guidance at the point of care. Under a risk based framework, systems influencing clinical decisions are the ones most likely to attract classification and evaluation duties, while documentation alone is unlikely to, so the two capabilities may end up on different sides of that line. Existing software as a medical device rules in each country may already apply to the copilot.

No fairness statement, subgroup analysis, accent or dialect performance disclosure, or evaluation methodology is published.

The absence sits directly underneath this vendor's founding thesis.

The company's central argument is that clinical AI built elsewhere serves its region poorly, and that a system trained on regional literature, regional guidelines and local institutional protocols performs better for the populations it serves. That is a claim about differential performance across populations. It is exactly what fairness testing exists to check, and the vendor has made it the basis of its business without publishing evidence for it.

The linguistic terrain makes it harder rather than easier. The markets served span Brazilian Portuguese and several national varieties of Spanish, with substantial regional and social variation within each, indigenous language speakers, and clinical vocabulary that differs between countries. A single accuracy figure across that range would conceal more than it revealed, and the company publishes no figure of any kind.

The evidence is also unusually obtainable here. Physicians at a named institution are reported using the product for around eight hours a day, which generates the volume that makes performance measurement across speaker populations feasible rather than anecdotal.

When the output is wrong, nothing the vendor publishes commits it to anything.

The review step is stated in the vendor's own legal material: the draft clinical documentation is returned to the health professional, who reviews and approves it before it is confirmed. That is review before commit.

Nothing stands behind the output. The page published as terms of use reproduces the opening sections of the privacy policy and ends there, so no service terms, warranty, liability position or remediation commitment is published at all. No accuracy figure is published either.

One exposure is distinctive. The system is grounded in each institution's own protocols. Recommendations are only as current as that ingested corpus, and a model still carrying a protocol the institution has since revised will keep recommending the superseded version confidently, with nothing published about how the corpus is refreshed or who validates it.

Correction rights exist and are published, but they run to a different party for this purpose. The privacy policy sets out rights to update and rectify personal data, with response times and a complaint route to Colombia's Superintendence of Industry and Commerce, and it applies where the company is controller; encounter records processed by clinicians fall under the provider's own policies.

The vendor operates a dedicated interoperability product alongside the scribe and states that more than fifty systems are integrated, with information flowing automatically rather than being copied by hand.

That is a substantial claim. Without the mechanism it does not describe delivered capability, and the mechanism is precisely what is unstated. No interface standard is named, no interoperability specification is referenced, and no distinction is drawn between systems reached through a permissioned connection and systems reached by driving a user interface. The second can be described in language that sounds like the first, so the published wording does not settle which applies.

The regional context makes the question sharper rather than pedantic. The markets served have less standardization of health record interfaces than the United States or United Kingdom, where certification programs and mandated interfaces give a vendor something concrete to build against. Achieving fifty integrations in that environment is difficult and is more likely to involve bespoke work per site, which raises different questions: what a given hospital's integration actually consists of, who maintains it, and what breaks when the underlying system is upgraded.

The count is therefore not a product specification.

Hosting is named and location is not committed. The privacy policy names Google Cloud Platform as the host for platform data, and ElevenLabs and OpenAI as processors of audio and transcripts without durable storage. No hosting region is stated for any of them.

The policy also reserves broad transfer rights: storage on the company's own or third party servers inside or outside the country, including in countries the Colombian data protection authority does not consider secure, where required for the company's activities. A cross border path is expressly contemplated rather than excluded.

Residency is a specific question here. The platform operates across several countries whose data protection regimes each impose their own conditions on international transfer of health information, and a vendor domiciled in one serving hospitals in others is making cross border transfers as a matter of ordinary operation. A hospital's regulator will ask where its data is processed and on what legal basis.

The interoperability layer adds a second dimension: what transits the vendor's infrastructure when information moves between hospital systems, and what persists there afterward.

Tier structure is public even though enterprise pricing is not: a free tier exists for independent private practice physicians, with hospital system agreements negotiated separately. Publishing a free entry point tells an individual clinician exactly what they can access without a sales conversation.

Deliberately scoped to Latin America and localized rather than translated: models are trained on local institutional protocols alongside clinical guidelines and peer reviewed literature, which is what makes protocol adherence measurement possible. Deployed across more than 25 hospital systems in Brazil, Colombia, and Mexico.

A free tier for independent private practice physicians extends reach to clinicians outside institutional settings, which matters in a region the company cites as having 43 percent fewer physicians per capita than the OECD average.