Tripletime

Every input path runs through models: snipped text and uploaded referral packages are parsed and placed into the correct note sections, ambient speech fills the history of present illness and plan, dictation is sorted rather than transcribed verbatim, phone photographs are read by OCR, and the assistant layer generates referral letters, after visit summaries and billing suggestions. No human scribe tier and no services layer underneath.

The oversight behavior here is demonstrated rather than claimed, and it is the most encouraging part of the disclosure.

In the vendor's published precharting example the system populates what it can source from prior documents and leaves what it cannot know as explicit placeholders: history of presenting illness to be documented during visit, examination pending, results pending, social history pending. Marking absent information as absent, instead of producing plausible text to fill the space, is the behavior that makes a draft safe to review. Fabricated filler is dangerous precisely because it reads like the rest of the note; a placeholder cannot be signed by accident. The note is prepared for the clinician to complete and sign, and the signature is the control point.

Three things are missing. No confidence threshold is published, so nothing states when the system declines rather than attempts. No abstention policy covers the ambient or dictation paths, where the placeholder behavior has not been demonstrated. And content pulled from snipped prior reports enters the note without any described verification that the snip was captured correctly, which matters most on the photographed document path where a misread is silent.

The parties in the clinical chain are named, including the language model provider and the transcription provider, and that supply chain disclosure is good.

The model itself is a different question, and it is not answered. Which model, at what version, is not stated. No model card exists. The training or adaptation position for the medical behavior the product sells is not described: whether models are fine-tuned, prompted, or used as supplied is left open. No update or versioning practice is published, so a buyer cannot know when the system changed or what changed with it.

No accuracy figure, error rate or evaluation methodology is given for any of the four input paths. That gap is most conspicuous on the two hardest ones, both of which are sold as capabilities rather than as incidental features: optical character recognition of a photographed medication package, and language switching part way through a consultation. Accuracy on both is asserted through the phrase medical grade, which names an intention rather than a measurement and is not a standard anything is assessed against. The single quantified claim, up to three hours saved per clinician per day, carries no denominator, baseline or method.

The vendor's security page enumerates the chain by name and by function: Amazon Web Services for infrastructure, Deepgram for audio transcription, and Anthropic for the language model. Each is listed with its attestation position, and the vendor states that all providers have signed business associate agreements with net zero data retention policies.

The model layer is named, the transcription layer is named separately from it, and the hosting layer is named alongside both. So known provider behavior and published provider commitments can be weighed, rather than the system being treated as undifferentiated proprietary technology.

The retention terms that govern content once it arrives are given rather than left open. Audio is streamed to transcription with zero retention interfaces and no recording is stored on the vendor's servers or the user's device. Clinical notes and source materials are purged after 30 days. The privacy policy separately states patient data is never used to train or enhance the vendor's models.

Two things remain open. No model version or update policy is published for the language model, so which release is running and when it changes is not stated. And the enumeration covers the clinical data path; other suppliers referenced generally in the privacy policy, including payment and analytics providers, are not named.

No study, controlled evaluation, third party rating, institutional customer or deployment count is published.

The testimonials come close to evidence without crossing into it. Individual physicians are named with their cities, in Toronto, Montreal and Calgary, rather than reduced to initials and a specialty, which at least makes them checkable people. They remain vendor-selected quotes from individual clinicians rather than an organization attesting to a deployment, and none carries a figure, a period or a description of what was measured.

The quantified claim on the site, that clinicians save up to three hours a day, is unsupported by any published measurement. The up-to construction is satisfied by any result at all, and no denominator, baseline or method accompanies it.

Where the customers appear to be matters too. The named clinicians are Canadian while the company is registered in England and Wales, so the deployment evidence and the corporate domicile point at different jurisdictions. That is not a problem in itself, but it means a buyer cannot assume the published experience was gathered under the regime that will govern their own contract.

Two of three commitments, retention and training use, are stated with precision; the third, deidentification, is not stated at all.

What is specific enough to be contradicted. Retention: audio is streamed to transcription through zero retention interfaces and no recording is stored on the vendor's servers or the user's device, and clinical notes and source materials are automatically purged after 30 days. A named window a customer can hold the vendor to is worth considerably more than a policy of keeping data as long as necessary. Training use: patient data is stated never to be used to train or enhance the vendor's models, with no third party carve out, and the named providers are stated to operate under zero retention terms.

What is missing is deidentification. No step is described in which identifiers are removed or reduced before content reaches a model, and the only related statement is that anonymization techniques may be deployed when treating more sensitive information. May is not a commitment, and a technique named only in the abstract cannot be assessed.

What the vendor does instead is a coherent alternative rather than an omission: it contracts the exposure rather than reducing the content, naming each provider, stating business associate agreements are signed with all of them, and stating net zero retention at each. That is a real control and in some respects a stronger one, since it binds the parties rather than relying on a redaction step working. It is not deidentification.

One tension is unresolved. The security page states a fixed 30 day purge; the privacy policy states patient data is retained only as specified by practitioners and that the vendor keeps information as long as you want it. Those are different retention regimes and only one of them can govern.

The vendor states on its security page that it will sign custom business associate agreements and will provide additional security documentation on request. Availability is therefore published; the instrument itself is not.

The supporting material is substantial. A full privacy policy covers the website, the desktop and mobile applications and the services, so it reaches the product that handles patients rather than only the marketing site, and it sets out categories collected, lawful bases, disclosure recipients, retention and data subject rights. The security page adds the operational position: zero audio retention, AES-256 encryption at rest and in transit, a 30-day purge of notes and source materials, and named providers each stated to have signed a business associate agreement.

One distinction matters and is easy to misread. The business associate agreements described as signed are the vendor's own agreements with its suppliers. They establish the chain behind the service, not the terms a customer would sign. The customer agreement is the one offered on request and not published.

A jurisdictional tension runs through the published material. The vendor displays compliance badges for the United States health privacy rule, European data protection and Canadian federal privacy law. Its governing privacy policy names only United Kingdom and European law, identifies the data controller as a company registered in England and Wales, and gives the United Kingdom supervisory authority as the complaint route. Canadian federal privacy law appears nowhere in the policy. That leaves a badge asserting a regime the governing document does not mention.

The certifications named belong to the vendor's suppliers, not to the vendor.

What is published. The infrastructure provider is described as holding a long list of security standards and compliance certifications; the transcription provider and the language model provider are each described as SOC 2 compliant and configured for the United States health privacy rule. Those are real attestations and the vendor is being reasonably precise about whose they are rather than blurring them into its own.

What is not published is any attestation held by Tripletime. No SOC 2 report of either type, no certification against an information security management standard, no independent penetration testing on a stated cadence, no trust portal and no third party assessment of the vendor's own controls, processes or software is published. A security review asks what the vendor does, and running on certified infrastructure does not answer it: a poorly controlled application on well certified hosting is exactly the failure that assurance exists to detect.

The page headline also uses enterprise grade security, which describes an aspiration rather than an examination and is marketing rather than a position.

What the vendor does describe about its own controls is specific, and it counts in its favor: encryption at rest and in transit by named cipher, zero audio retention, a 30 day automatic purge of notes and source materials, and stated access controls.

The vendor offers to provide additional security documentation on request.

No clearance is claimed and none is required for documentation itself. No United States device pathway attaches to drafting a note a licensed clinician reviews and signs, and the signature is the control point.

Three features sit around that documentation core and each raises a different question.

The assistant suggests billing codes from documented procedures and diagnoses. A system proposing the codes a note will be billed under shapes reimbursement in a way note drafting does not, and it creates an incentive gradient documentation alone does not have. The framing here stays neutral, with no revenue lift, capture or optimization language anywhere, and that counts in its favor.

The assistant also generates after-visit summaries in plain language for patients. Patient-facing output carries a different posture from clinician-facing output, because the reasoning that keeps clinical decision support outside device regulation rests on a professional reviewing the basis of what is produced, and a patient is not a professional. That the summary derives from a note the clinician has already signed mitigates this; the artifact still reaches the patient.

The question-answering feature is described as answering any clinical question using the full context of the patient's notes. Grounding answers in the clinician's own record makes them more traceable than open ended inference, but any clinical question is a wide scope.

The jurisdiction question is sharper than it first appears. The company is registered in England and Wales and its governing privacy policy operates under United Kingdom and European law, while its published customer evidence is Canadian and its compliance badges include the United States rule. Ambient documentation is treated as software as a medical device in the United Kingdom and the European Union, and the vendor's own published questions raise health service requirements alongside the United States rule. No classification, registration or conformity assessment under that regime is published for a company domiciled inside it.

How model behavior is governed or tested is not published. No evaluation, no monitoring program, no error rate, no subgroup breakdown, no responsible artificial intelligence statement and no independent assessment of model behavior appears anywhere in its published material.

Why that gap matters here is specific to what this vendor markets. Recognition quality is the product's headline property. It states that a clinician can switch between English and French part way through a consultation, that the system auto-syncs and produces the note in the target language regardless of input language, and that medical terminology is held accurate across both, offering a worked example. It separately markets optical character recognition of photographed medication packaging and paperwork as medical grade.

Those are recognition claims, and recognition failures are the kind that leave no trace. A term misheard across a language boundary, or a drug name misread from a blister pack, produces a note that looks complete and reads fluently. Where a vendor sells recognition quality as the differentiator and publishes no performance breakdown by language, accent or speaker, a buyer has no way to know where the system is weak and no signal when it fails.

The bilingual capability may well be real, and it is a harder engineering problem than supporting two languages separately. That is a reason to want the measurement, not a substitute for it. Nothing published here is falsifiable.

Mechanisms for challenging an output exist, and they are a product property rather than a policy statement.

The note is assembled from source material the clinician selects: text snipped from prior reports, catheterization results, echocardiograms, imaging and stress tests, or whole uploaded referral packages, with the note building in view as it goes. Source materials are retained alongside the note for 30 days, so a disputed entry can be checked against the document it came from within that window. The pre-charting behavior reinforces it: sections that depend on the visit are left as explicit placeholders rather than filled with plausible text, so what the system has not established is visible rather than hidden.

Nothing stands behind the output. No warranty, indemnity or remediation commitment is published, and the vendor's own contribution on accuracy is thin. Two of the harder capabilities are sold without any measurement at all: optical character recognition of photographed medication packaging, and language switching mid consultation. Neither carries an accuracy figure, error rate or evaluation method.

The medication capture path is where an error stops being a documentation problem. A misread strength or drug name transfers directly into a record a prescriber relies on, and the failure is silent because the photograph is not read again. Accuracy is asserted through the phrase medical grade, which describes an intention rather than a measurement, and the single quantified claim uses an up-to construction that any result satisfies.

One structural fact cuts both ways. The vendor's privacy policy names Tripletime Limited as the data controller for the health information it processes, rather than positioning itself as a processor acting for the practice. Data subject rights, including correction and erasure, are set out as exercisable by contacting the vendor directly, with a supervisory authority behind them. That is unusual and it places primary accountability with the vendor. What is absent is any route by which a patient, who holds no account and receives no notice that this company exists, would use it.

The weakest part of this vendor's disclosure, and a claim shape that reads as a warning rather than a feature.

The site states the product works across any record system and displays a logo wall covering Accuro, Arya, athenahealth, Epic, Greenway, NextGen, Oracle, Telus and Meditech. Accuro and Telus Health usefully signal the Canadian market, which is consistent with where the named customer testimonials come from.

No integration mechanism is described anywhere. No interface standard, no application programming interface, no write back, no named connector, no supported systems page and no marketplace listing appears on the site. Templates are described as imported from the record system, which is a read rather than a write.

Universal compatibility claimed without a mechanism very likely describes the absence of integration rather than the breadth of it, and the architecture here fits that reading: a desktop application that assembles a note which the clinician then moves into the chart is compatible with everything precisely because it connects to nothing. That is a legitimate product design and a materially different purchase from an integrated one, and the difference shows up in daily use as copying, pasting and reconciling.

Nothing published settles it, and it determines whether the time the product saves in drafting is spent again in transfer.

The location of the data is the missing piece. The hosting provider is named and the architecture is clearly described.

The vendor's security page states that clinical notes are encrypted and stored in Amazon Web Services infrastructure, and names the two further parties in the clinical path, a transcription provider and a language model provider. So a buyer knows whose infrastructure holds the content.

The client side is coherent and well described: a desktop application with a companion mobile app on recent iOS and Android, with recordings and photographs syncing automatically from phone to workstation, which suits a clinician moving between consulting room and desk. Retention is stated as a 30-day automatic purge of notes and source materials, with no audio retained at any point.

What is absent is every question about place. No region, no availability zone, no storage location, no residency option and no statement of which processing crosses a border appears anywhere. Naming a global cloud provider narrows nothing on its own, because that provider operates in most jurisdictions.

That gap is concrete rather than theoretical here, and the reason is the mismatch between where the company sits and where its customers do. The controlling entity is registered in England and Wales and operates under United Kingdom and European data protection law; the published customer evidence is Canadian; the compliance badges add the United States rule. Each of those points at a different answer about where content may rest, and the product answers none of them.

A pricing page is published and the trial terms are stated plainly on the landing page rather than buried: free for 14 days with no credit card required, with the mobile app free to download on both platforms.

Removing the card capture step is worth more than it sounds. It lets a clinician evaluate output on their own consultations, in their own specialty, before any commitment or sales conversation, and it is the clearest signal a vendor can give that it expects the product to survive contact with real work.

Two gaps remain. The tier structure and what each tier gates are not set out on the landing page, though the pricing page may hold them, so the cost after the trial cannot be sized before engaging. And no enterprise or group terms are described at all, which matters for a product sold into specialist practices where multi clinician licensing is the likely purchase rather than the exception.

One further question follows from the corporate position. The company is registered in England and Wales while its published customer evidence is Canadian, and nothing published says which currency applies, which entity invoices, or what the tax and contracting position is.

Deliberately narrow and deep. Coverage is cardiology, internal medicine and oncology, aimed at specialist consultation work rather than at primary care volume.

The cardiology depth goes past a specialty label to the instruments. Templates are described as built by cardiologists working with guideline directed medical therapy, coronary anatomy and high sensitivity troponin, and the published sample note handles catheterization findings, ejection fraction across serial studies, stress imaging and perfusion defects as structured longitudinal history rather than as narrative. That is the difference between a product configured for a specialty and one that understands what the specialty records.

Telephone and video consultations are supported alongside in person, and the desktop and mobile design suits a clinician moving between settings.

The footprint is three specialties, and nothing addresses inpatient, procedural or emergency settings, where both the documentation shape and the consent position differ. Outside the named three, this is a general product from a vendor that has chosen not to be general.

Bilingual operation in English and French is claimed across the product, with no performance breakdown by language published.