Ubie

Inference is the product. The system generates its next question from the user's prior answers rather than walking a fixed decision tree, drawing on a stated set of roughly 3,500 question data types, and returns a ranked set of possible causes across more than 1,000 diseases. Remove the model and there is no product left.

The tool outputs possible causes and a recommendation on whether and where to seek care, and it explicitly does not diagnose, which is the correct posture for a direct to consumer symptom checker. Oversight is editorial rather than in the loop: a stated panel of more than 50 physicians supervises the prediction pathway for each disease and a published medical content editorial policy governs review. That is supervision of the model's content ahead of use rather than review of an individual user's result, which is a meaningful distinction for a buyer.

Unusually specific about inputs and process, silent on architecture. The company publishes a clinical data sources page, names its supervising physicians individually with their institutions, and describes the algorithm as continuously refined since 2017 against real world data from a stated 1,700 provider organizations.

What is not disclosed is the model architecture itself or whether any third party foundation model sits underneath, so a technical reviewer can audit the knowledge base and the human review process but not the system.

Published policies exist and stop at the level of policy, and one feature of the consumer flow deserves naming because it cuts both ways. The company maintains published privacy, security and information security policies plus a page describing its compliance posture in a second jurisdiction, which is more than most consumer facing symptom tools offer.

What is absent is technical substance: no encryption detail, no retention period, no de identification practice, no model or provider named and no sub processor list was located. The content collected is sensitive by any standard, covering biological sex, age, past illnesses and family history, and it is collected without requiring registration. That last point is genuinely protective in one direction, since no account means no persistent profile tied to a name.

It also removes every mechanism a person would use afterwards: with no account there is no identity to attach a deletion request to, no way to return and see what was retained, and no route to withdraw. Family history adds a second party, because it is information about relatives who never used the product and cannot know it was entered. Ask whether unregistered sessions are retained and for how long, what identifiers accompany them, whether interactions inform model development, and for a sub processor list.

Among the strongest evidence postures in the consumer facing tier of this index, because the company publishes a number that can be checked and lost. It reports a Top-10 hit accuracy of 71.6 percent against a comparator average near 60 percent, links directly to the underlying medRxiv study, and the study design is disclosed as vignette based across 328 vignettes. Buyers should weigh two caveats: the study is a preprint rather than peer reviewed at the linked location, and vignette accuracy is not the same as accuracy on live undifferentiated patients.

The consumer product collects biological sex, age, and history including past illnesses and family history without requiring registration, and the company maintains published privacy, security, and information security policies plus a page describing its United States compliance posture.

The reason this does not grade higher is that the disclosure is policy level rather than technical: no encryption, retention, or de identification specifics were located, and the data collected is sensitive by any standard.

The structure here matters more than any individual disclosure, and a buyer should understand it before asking anything else.

The symptom checker is a direct to consumer product. The patient is the user, entering their own symptoms, age, biological sex, past illnesses, surgeries, family history and lifestyle into a questionnaire and receiving a report. In that configuration the company is collecting health information directly from an individual rather than processing it on behalf of a healthcare provider, which means it is generally neither a covered entity nor a business associate, and the information is health data but not protected health information. HIPAA does not attach to it.

That is a lawful and common arrangement, but the consequence deserves stating plainly because patients rarely appreciate it: sensitive health information typed into a consumer symptom checker carries none of the protections the same information would carry inside a medical record. The governing United States regime is consumer protection and breach notification law, not HIPAA, and those regimes impose different and in some respects weaker obligations.

The company states that it has outlined how it complies with United States regulations, but the substance sits behind a policies hub that could not be enumerated in this pass, and no HIPAA position, business associate agreement or terms addressing the relationship were located.

The company also serves healthcare providers and pharmaceutical companies alongside patients, and nothing published distinguishes whether those arrangements place it in a business associate role. Buyers on the provider side should ask that question directly rather than assuming the consumer analysis applies.

The company publishes a named Information Security Policy as a standing corporate document, linked from the site footer alongside its privacy policy and terms, and maintains a dedicated policies hub covering privacy and security. Publishing a security policy at all puts it ahead of most consumer health applications, which typically offer nothing beyond a privacy notice.

A scope limitation belongs on this record and is the reason the grade is not higher. The policy page renders as an application rather than as readable text, so its contents could not be enumerated in this pass. What the policy actually commits to, and whether it names controls, is therefore unknown rather than absent. This is the first item to re open on a refresh, and the grade could move.

What was located elsewhere does not fill the gap. No certification, attestation, trust centre, controls table, encryption statement, penetration testing statement or subprocessor list was found. Third party descriptions refer to industry standard encryption, which is neither a vendor statement nor a checkable one.

Buyers should ask which certifications the company holds, in which of its operating jurisdictions they were assessed, and whether any assessment covers the consumer applications specifically as opposed to corporate systems.

No clearance, authorisation or formal regulatory statement was located. But unlike most records graded here, the company does take a discernible regulatory position, and the position is doing real work.

The product is scoped explicitly as guidance rather than medical advice, presented as a tool that helps a patient understand possibilities and decide whether to seek care, and it states that it does not replace seeing a doctor. Independent commentary reaches the same conclusion, describing it as a patient information tool rather than a diagnostic device for clinicians. Scoping a symptom checker as patient information rather than diagnosis is the conventional route to remaining outside device regulation, and the disclaimer is not decorative.

Two tensions are worth putting to the company. The output is not purely informational: it ranks possible conditions, characterises severity and recommends next steps, which is closer to triage than to reference, and triage advice given directly to a patient carries its own risk profile even where device regulation does not apply. And the product is offered internationally, where the same scoping may be assessed differently. Commentators have advised checking the relevant national register before treating it as a regulated device in a given market, and health systems have been advised to run their own technology assessment before recommending it.

Buyers and health systems should ask the company to state its regulatory position per jurisdiction in writing, and should ask what evidence exists that patients act safely on the triage recommendations specifically.

There is a real governance mechanism here, which is the documented medical content editorial policy and the named supervising physician panel spanning emergency medicine, internal medicine, neurology, psychiatry, and surgical specialties across multiple countries.

What is absent is bias evaluation: no disclosure was located on accuracy variation across demographic groups, which matters because the questionnaire conditions on biological sex and age, and because a symptom checker's failure modes are rarely uniform across populations.

The clinical layer is made auditable by naming people, which is a form of accountability distinct from publishing a number and worth crediting on its own terms. The company publishes a clinical data sources page and names its supervising physicians individually together with their institutions, so a reader can identify who stands behind the medical content and can weigh their credentials and affiliations rather than being told that clinicians were involved.

Named individuals attach their professional reputation to the product in a way an anonymous clinical team does not, and it also means a specific person can be asked about a specific piece of content. The algorithm is described as continuously refined since 2017 against real world data from a stated number of provider organisations, which gives the scale and the duration. Held at C because the system itself is undescribed.

No model architecture is disclosed and nothing states whether a third party foundation model sits underneath, so a technical reviewer can audit the knowledge base and the human review process but not the thing that turns a user's answers into a suggested condition. No accuracy figure, undertriage rate, evaluation methodology or warranty, indemnity or remediation commitment was located either.

For a symptom assessment product the undertriage rate is the number that matters, because the person sent away reassured is the one who comes to harm. Ask for it, and for whose model performs the inference.

No electronic health record integration was located, and none appears to be intended for the consumer product. That is an architectural choice rather than an omission, and the record should be read that way.

The handoff to the clinical system is human mediated by design. The patient completes the questionnaire, receives a report, and carries it to their clinician, and the company has productised that step rather than leaving it implicit: a doctor's note feature exists specifically to produce something a patient can hand over. In practice the interoperability mechanism is a patient with a document, which requires no integration, no contract with the health system and no data exchange agreement.

That has real advantages, including that no patient data flows into a provider system without the patient choosing it. It also has a real limitation a clinician should understand: the information arrives outside the record, unverified and unstructured, and the receiving clinician has no way to inspect how it was generated beyond what the report itself shows.

Graded C because the axis measures integration depth and there is none to measure. Provider or health system buyers considering the company's professional facing services should ask separately what integration exists on that side, since the consumer analysis will not apply to it.

Delivery is a consumer web and mobile application, so there is no deployment for a customer to configure and no hosting arrangement, cloud provider, infrastructure description or availability commitment was located.

Data residency is where this record has something specific to say, and what it says runs against the buyer. The company operates from four jurisdictions, with bases in Japan, Singapore, India and the United States, and its privacy policy asks the user to consent to transfer of their personal data to any location outside their own country, with recipients that may be situated in the user's country or elsewhere. It also contemplates disclosure to a broad set of third parties including professional advisers, auditors, regulators and parties involved in any acquisition or disposal of the company or its assets.

That is a consent based cross border model rather than a residency commitment, and it is the opposite of a guarantee. A user in any given country cannot determine from what is published where their symptom and history data will be processed or stored.

The practical consequence is that this is not a suitable arrangement for an institution with residency obligations, and individuals in jurisdictions with strict transfer rules should read the consent clause before use. Buyers should ask which jurisdictions process data for which markets, and whether any regional processing option exists.

The consumer product's price is published and unambiguous: free, no registration, no credit card. That is full transparency on the surface most users touch. The enterprise surfaces, meaning pharmaceutical partnerships, provider distribution, and the embedded deployments, carry no published pricing, so an institutional buyer starts from zero.

Breadth is the design goal and it is substantiated: coverage spans more than 1,000 diseases with entry points organized by symptom, disease, body part, and specialty, including psychiatry, dermatology, neurology, ENT, and gastroenterology, and explicitly including mental health and women's health.

The product operates in Japan, the United States, and additional markets with algorithms stated to be regionally customized for disease prevalence, which is a real localization commitment rather than translation.