TORTUS

The models and the safety layer around them are the whole product. OSLER, the agent, listens to the consultation and combines voice, vision and click based interaction to read what is on screen and act inside the record, generating notes, referral letters, patient communications and coding for clinician approval. The Shell verifies each generated statement against the consultation before anyone sees it, and CREOLA, the company's clinician in the loop evaluation system, measures where the models go wrong.

There is no non AI business underneath. Without the speech recognition, generation and verification models there is nothing left to sell.

Filtering happens before the clinician sees anything, not only after. The Shell verifies every generated statement against the consultation itself and removes anything unsupported, so a reviewer is never shown a fabrication to miss, and the rate at which that filter works is published. Clinician approval remains the final gate, which a deploying clinician frames as professional responsibility rather than a workflow step.

OSLER also acts inside the record through vision and clicks, a wider surface than note generation, and the published safety metrics cover documentation content rather than those actions.

How the models fail, and how often, is documented. The Shell removes 92.7 percent of detected hallucinations on the live platform, and a peer reviewed paper in npj Digital Medicine reports a 75 percent reduction in major hallucinations. CREOLA, the company's clinician in the loop labeling platform, produced a clinical ontology of hallucination and omission in ambient scribes, sorting errors by type and by their potential to affect diagnosis or treatment, from a study that reviewed more than 49,000 transcript sentences and 13,000 clinical note sentences with over 100 clinicians.

A taxonomy with rates attached turns a vague worry about AI notes into a defined list of failure types a trust can monitor. Which underlying models generate the drafts is not stated; OpenAI appears on the company's subprocessor list.

The pipeline is set out step by step: speaker diarized audio is encrypted on the device, a draft is generated, and every statement passes the Shell's check against the consultation before a clinician sees it, with transcriptions, summaries and letters not stored in the system. TORTUS's trust center lists five subprocessors: Google Cloud Platform as cloud provider, OpenAI for engineering with an EU location, Auth0 for identity, Datadog for monitoring and LaunchDarkly. OpenAI is the one AI model company on the list.

Which steps use OpenAI's models, and the retention and training terms that apply to data reaching it, are not published. The addendum flows TORTUS's own obligations down to every subprocessor and offers a copy of any subprocessor agreement on request.

The evidence comes from prospective, multi site, publicly funded work rather than vendor commissioned studies. TORTUS co ran a nine site ambient voice evaluation covering more than 17,000 patients with £500,000 of NHS England backing, evaluated independently by Great Ormond Street Hospital's DRIVE unit for NHS England, with results feeding the UK Government NHS Ten Year Plan for ambient voice technology and a Lancet submission under review.

A Phase II evaluation at Great Ormond Street Hospital, published with a named author list, studied ambient AI for pediatric documentation and reports better note quality and lower clinician cognitive load. Separate peer reviewed work in npj Digital Medicine underpins the safety figures.

Neither patient audio nor training data is kept from customers. The company states that no model is trained on customer data and no data is retained, gives patient audio retained at rest as zero by design, and its data processing addendum says transcriptions, summaries and letters are not stored in the system; deleted data is cryptographically erased. Great Ormond Street Hospital independently tells its own patients that no patient data are held by the organization or used to train the AI, which puts the deploying hospital's name behind the commitment. A data processing impact assessment, now at version 9, sits in the trust center alongside full UK GDPR processor terms.

Beyond the Shell's statement checking, how a safety event is identified, escalated and closed is not described.

UK data protection law is the regime here. HIPAA is not claimed on the company's own material and appears only in third party listings, and the subscriber terms are limited to clinicians authorized to treat patients in the United Kingdom.

That home regime is documented in depth. The published data processing addendum names the subscriber as controller and TORTUS as processor and carries the Article 28 obligations in full: processing only on documented instructions, audit rights, flow down to subprocessors with a copy of any subprocessor agreement on request, breach notification without undue delay, help with data subject requests, transfer restrictions, and deletion or return of data at termination. It gives an ICO registration number and an NHS toolkit organization code. Those terms date from November 2024, before the current device certification, and a newer data processing agreement sits in the trust center.

Whether a business associate agreement is offered for United States use is not stated.

TORTUS holds ISO 27001:2022 certification from LRQA under UKAS accreditation, ISO 13485:2016 for its medical device quality management system since February 2026, and Cyber Essentials Plus. It exceeded the standards of the NHS Data Security and Protection Toolkit for 2024 to 2025 and meets the NHS Digital Technology Assessment Criteria. Its trust center holds the certificates, a January 2026 web application penetration test report, a data flow diagram and the DCB0129 clinical safety case report, and the published addendum commits to penetration testing at least once a year.

The certificates and reports are released on request rather than open to a visitor.

A UK Approved Body, Scarlet (8536), certified the product on 24 June 2026 as a UKCA Class IIa medical device, described as clinical decision support, under a quality management system audited to ISO 13485. That replaced an earlier Class I self declaration: Class IIa requires an Approved Body to review the technical documentation and clinical evaluation, and carries an active post market surveillance plan. TORTUS also took part in Phase II of the MHRA AI Airlock and keeps DCB0129 and DCB0160 clinical safety documentation.

The certified intended purpose, whether it covers the whole product or specific functions, and the version certified are not stated publicly, and how far the certificate extends to OSLER acting inside the record through vision and clicks is not said. There is no FDA pathway and no United States market presence.

Accent performance has been tested by a deploying hospital. Great Ormond Street Hospital states publicly that its extensive evaluation covered a wide variety of accents and found the tool transcribed accurately across them, which addresses the failure mode in speech products where accuracy drops for speakers underrepresented in training.

CREOLA classifies errors by their potential clinical consequence rather than by frequency alone, so a documentation error that could change diagnosis or treatment counts for more than one that could not. A DCB0129 clinical safety case report sits in the trust center.

The error rates can be checked against their methods. A peer reviewed paper in npj Digital Medicine reports a 75 percent reduction in major hallucinations, the live platform figure of 92.7 percent of detected hallucinations removed comes with its method, and the CREOLA ontology sorts errors by their potential to affect diagnosis or treatment. As a certified Class IIa device the product also carries a post market surveillance obligation, which TORTUS says its verification layer serves by monitoring live hallucination and omission rates.

The contract carries less. The published subscriber terms provide the service as is, disclaim any warranty of accuracy, cap liability at six months of fees, and require the subscriber to defend and indemnify TORTUS against third party claims, including claims from patients about the subscriber's care. Liability for death or personal injury caused by negligence is not excluded, as English law requires, and the manufacturer remains answerable under the device regime for defects in design, claims or monitoring.

Under UK data protection law a patient can have an inaccurate record corrected through the practice, and the addendum obliges TORTUS to help the controller do so. Those terms date from November 2024, before the device certification.

Integration runs inside NHS electronic patient records, natively and through an SDK, deep enough at Great Ormond Street to pick up patient identity automatically rather than relying on manual selection. General practice is reached through the X-on Health partnership, where TORTUS powers Surgery Intellect, which works with X-on's Surgery Connect telephony. OSLER can also operate a record system through its interface using vision and clicks, a route to breadth that does not wait for each record vendor to build an integration.

Integrations are concentrated in the NHS estate, and none outside the United Kingdom is named.

Google Cloud Platform hosts the service, and the G-Cloud listing places data storage and processing in the United Kingdom and the European Economic Area; OpenAI appears on the subprocessor list with an EU location. Little is held to begin with: patient audio retained at rest is zero by design, notes and letters are not stored in the system, and deleted data is cryptographically erased. Deployments go through NHS governance approval at trust level under UK GDPR.

Which Google Cloud regions are used, and which processing steps happen in the EU rather than the UK, are not stated.

NHS prices are listed on the government's G-Cloud 15 framework. TORTUS Enterprise for NHS trusts costs £200,000 a year for up to 100,000 hours of audio processed, with unlimited user licenses across departments, then £2 an hour beyond that, and includes onboarding, site visits, template customization and a live reporting dashboard. Pilot offers, priced excluding VAT, ran until May 2026: three months with unlimited licenses for £30,000, three months for up to 100 or 30 licenses at £15,000 or £5,000, and a small pilot at £44 per license per month.

The listing also offers a free month of full service, and trusts can buy by direct award through the Crown Commercial Service marketplace; general practices get TORTUS through X-on's Surgery Intellect. Early adopters describe saving an average of four minutes per consultation, a figure reported by users rather than measured in a controlled comparison.

The setting spread runs from pre hospital care to general practice. TORTUS is documented in ambulance clinical hubs, emergency departments and outpatients as three deployments on one platform, in pediatrics at Great Ormond Street and in primary care through the X-on partnership, and the company cites more than 50 clinical settings from emergency care to mental health. Its enterprise offer is pitched at acute, community, mental health and ambulance trusts.

Ambulance and dispatch documentation is a harder acoustic and clinical environment than an outpatient room. The coverage is deep in the NHS and unevidenced elsewhere.