Vera Health

The product is the model and the retrieval stack around it. Remove them and nothing saleable remains: there is no authored corpus of the company's own, no institutional workflow tooling and no device. What a user gets is the ability to ask 60 million documents a question in natural language and receive a synthesised answer, which is an act only a model performs.

The company also states its architecture as a positive design claim rather than as a label, describing a purpose built medical search engine that retrieves first, ranks, applies evidence grading logic and only then generates. That ordering is falsifiable in ordinary use, because a clinician can check whether the cited sources actually support the answer given. Most centrality claims in this index are not checkable that cheaply.

Adjunctive by design and by disclaimer. Every key statement is linked to its source so a clinician can read the underlying evidence and, in the company's own framing, document their reasoning. The application listing states plainly that the product supports clinical decision making and that the clinician should always apply their own judgement. The retrieval first ordering is itself an oversight mechanism, since it is meant to make the evidence checkable rather than to justify an answer after the fact.

Held at B on the question this index now puts to every generative clinical product, which UpToDate answered and this vendor has not. Nothing published states what the system does when the evidence is thin, absent or in conflict. There is no assumptions block naming what was taken for granted about the patient, no prompt asking the clinician to supply missing context, and no described abstention behaviour. Evidence grading logic is asserted but the rubric is not published, so a clinician cannot tell whether a weakly supported answer is visibly marked as one.

Ask directly what the product returns when the literature disagrees with itself, and whether the grade attached to a piece of evidence is surfaced to the reader or used only internally to rank.

Mechanism is described in real terms rather than as marketing. The company publishes the sequence its product follows, states the corpus size and composition as peer reviewed papers, guidelines and care pathways, and positions the retrieval first ordering explicitly against generation first assistants while naming the failure that ordering is meant to prevent, which is that citations gathered after the fact can conceal an error.

Below that level it goes dark. No model class or model provider is named anywhere on the company's own material. The evidence grading logic is compared to the work of a guideline methodologist but no rubric, scale or worked example is published. The retrieval infrastructure is identified only through the supplier's own blog, not by the vendor.

The homepage carries a bar chart placing the product at 62.2 percent against three named foundation model vendors at 19.7, 21.3 and 37.3 percent, with no benchmark named on the chart, no methodology, no date and no link to a protocol. A vendor run comparison against named competitors, published without a method, is the weakest form of transparency, because it invites a comparison no reader can reproduce. Note also that this index has already recorded that the underlying dataset produced a wide spread of results across many models in the work that introduced it, so a single figure quoted out of that context tells a buyer very little.

One explicit commitment sits on this record and two counterweights come from the same policy. The commitment: personal data is stated not to be used to train the company's artificial intelligence systems, which is an explicit position rather than a silence, and a dedicated data minimisation section commits to processing only what is needed while naming encryption, access controls and anonymisation or pseudonymisation for data used in training. The counterweights are the vendor's own words.

Aggregated and de identified data covering physician access patterns, usage frequency and, stated explicitly, the inputs and outputs of the service may be used and shared with business partners and research organisations, so the questions a clinician asks and the answers they receive form a shareable derived asset even though their personal data does not train models.

And advertising partners are a named recipient category for device, network address, geolocation and analytics data, with the state specific section confirming those categories are shared with advertising networks for interest based advertising. Be precise about what that second point is: this is website and marketing analytics, not pharmaceutical advertising placed inside a clinical answer, which is a different and more consequential arrangement graded elsewhere in this segment.

It remains a clinician's professional interest data flowing to advertising networks, and a user of a product that costs nothing has a reasonable interest in knowing it. No model class or provider is named anywhere.

Every performance figure located is vendor generated and none is peer reviewed. The claims include a United States Medical Licensing Examination score of 97.5 percent, 84.9 percent on a New England Journal of Medicine question set and 62.2 percent on MedXpertQA, published through the company's own materials and through a blog written by one of its infrastructure suppliers, which is a source with a direct commercial interest in the result.

Two real third party relationships exist and neither is evidence of performance. The American College of Emergency Physicians partnership, confirmed on ACEP's own newsroom in March 2026 and quoted by its president, is a content licensing and distribution arrangement. The clinical council of sixteen named physicians is editorial and governance input. Both raise confidence in the process. Neither measures the output.

The grade records what a counterparty can verify today rather than a finding that the product performs poorly, and the company is young enough that an absence here is unsurprising. The comparison that matters is within the segment: OpenEvidence carries eleven independent evaluations including a systematic review, and Glass Health placed in an external physician validated safety benchmark it did not control. Submitting to an evaluation the vendor does not run is the single move that would change this grade.

Two strong statements sit on the record. The privacy policy states that personal data is not used to train the company's artificial intelligence systems, which is an explicit commitment rather than a silence. A dedicated data minimisation section commits to processing only what is needed for the purpose and names encryption, access controls and anonymisation or pseudonymisation for data used in training.

Two counterweights hold it at B and both come from the vendor's own policy. Aggregated and de identified data covering physician access patterns, usage frequency and, stated explicitly, the inputs and outputs of the service, may be used and shared with business partners and research organisations. And advertising partners are a named recipient category for device, internet protocol, geolocation and web analytics data, with the California section confirming those categories are shared with advertising networks for interest based advertising.

Be precise about what that second point is and is not. This is website and marketing analytics, not pharmaceutical advertising placed inside a clinical answer, which is a different and more consequential arrangement graded elsewhere in this segment. It remains a clinician's professional interest data flowing to advertising networks, and someone using a product that costs nothing has a reasonable interest in knowing that.

The strongest position in this segment, and it rests on an artefact rather than an assertion. The full text of the business associate agreement is published at a public address, dated October 2025, and readable without contacting anyone. Nothing else graded in this category does that. The privacy policy carries a dedicated HIPAA section stating the company will enter a business associate agreement with a covered entity or its business associate on request, and a data protection officer is named with both an email address and a telephone number.

The instrument contains commitments a buyer would otherwise have to negotiate blind. Written notice of an impermissible use or disclosure, or of a security incident, within five business days. Breach notification no later than thirty calendar days. Reimbursement of the client's costs of complying with the breach notification rule where the breach was the vendor's. Subcontractor flow down of the same restrictions. Availability on request of the most recent independent HIPAA compliance report or HITRUST certification. And return or destruction of all protected health information on termination, extending to agents and subcontractors, with no copies retained.

One clause deserves a buyer's attention and is recorded here rather than left buried. All de identified information the vendor creates under the agreement is stated to belong exclusively to the vendor, with the client free to create its own separately. That is an ordinary commercial term and it is disclosed rather than hidden, but a covered entity signing it grants exclusive ownership of de identified derivatives of its own patient data, and it should be read before signature.

For scale within the segment: OpenEvidence offers a standard agreement that at least one health system could not reach acceptable terms on, Glass Health exposes acceptance inside its developer settings, Avo mentions HIPAA nowhere in its public legal documents, and UpToDate publishes nothing that could be retrieved.

A public trust centre exists at a dedicated subdomain, run on a recognised trust centre platform, and the homepage carries four compliance marks: HIPAA, GDPR, SOC 2 and the National Institute of Standards and Technology artificial intelligence risk management framework. The SOC 2 mark specifies Type II. That is the single question this index puts to every SOC 2 claim and the one most vendors leave unanswered, so it is credited.

Held at B rather than A on what was not found. No penetration testing cadence, no vulnerability disclosure programme, no bug bounty and no security incident history were located, and independent review sites report that SOC 2 detail is gated behind an enterprise conversation rather than published. The peer that earned an A in this segment did so on an annual external penetration test plus a public vulnerability disclosure programme with a bounty, which is operational evidence rather than a badge.

Scope stated plainly, per the standing rule about grading unopened pages: the trust centre was confirmed to exist but its gated contents were not accessed, so what sits behind the request wall is unknown rather than absent.

No clearance, no submission and no published regulatory positioning statement were located across the homepage, about page, privacy policy, terms and business associate agreement, all read in full.

The product has a reasonable argument for sitting outside device regulation and it is worth stating, because a buyer will ask. The clinical decision support exclusion turns on whether a clinician can independently review the basis of a recommendation, and a retrieval first product whose key statements each link to the source they came from sits closer to the centre of that exclusion than to its edge. Against that, the company describes itself in its own frequently asked questions as a clinical decision support search engine, and it ships differential diagnosis and treatment planning views alongside search. Generating a differential is a different act from reporting what the literature says, and it is the act that moves a product towards the line.

Graded C because the vendor has published no analysis of where it sits. Ask for the regulatory position on the differential and treatment planning features specifically rather than on the product as a whole.

More governance apparatus than most of this segment, and none of the measurement. On the apparatus side: alignment to the National Institute of Standards and Technology artificial intelligence risk management framework is claimed as a compliance mark, which is its first appearance in this category; a clinical council of sixteen named physicians with named institutions provides editorial direction; a data protection officer and a European Union representative are both named with contact details; and a data processing addendum is published alongside the privacy policy and terms.

On the measurement side there is nothing. No bias evaluation, no subgroup analysis by specialty, population or question type, no error taxonomy, no published accuracy floor and no external audit. The one comparative figure the company publishes is one it ran itself, against competitors, with no methodology attached.

The structural exposure that applies to every vendor in this category applies here with a particular twist. Grounding to a corpus inherits that corpus's blind spots as faithfully as its rigour, and this corpus is the published literature, whose known coverage gaps fall along the population lines a bias evaluation would test. A company claiming alignment to a risk management framework is better placed than most to publish what its own risk assessment found. Ask for that document by name.

One disclosure here is genuinely good and one headline undercuts it. The good one: the company publishes the sequence its product follows, states the corpus size and composition, and positions its retrieval first ordering explicitly against generation first assistants while naming the failure that ordering is meant to prevent, which is that citations gathered after the fact can conceal an error.

Naming the specific failure your architecture exists to avoid is a form of limitation disclosure, because it tells a reader what to look for in competitors and, by implication, what would still go wrong here. The headline is the problem. A bar chart places the product at a stated percentage against three named foundation model vendors at lower ones, with no benchmark named on the chart, no methodology, no date and no link to a protocol.

A vendor run comparison against named competitors published without a method is the weakest form of transparency, because it invites a comparison no reader can reproduce and no competitor can answer, which is the opposite of the independent head to head evaluations this index credits elsewhere.

This index has also recorded that the underlying dataset produced a wide spread of results across many models in the work that introduced it, so a single figure quoted out of that context tells a buyer very little. No evidence grading rubric, scale or worked example is published either. Ask which benchmark, run when, under what protocol, and for the rubric.

No integration claim of any kind appears on the vendor's own material. The homepage, about page, privacy policy, terms and business associate agreement were read in full and none names an electronic health record, a marketplace listing, a Fast Healthcare Interoperability Resources conformance statement or a public application programming interface. Delivery is web and native mobile applications, and the product is used alongside the record rather than inside it.

The only integration claims located come from third party review directories, which report enterprise integrations with Epic, Cerner and MEDITECH under custom pricing, requiring technical coordination to deploy. Those sites are commercially motivated aggregators rather than the vendor, and this index does not grade on them.

The asymmetry is itself the finding and it is unusual. The failure this axis normally catches is a vendor overstating an integration it cannot deliver, and the index has graded exactly that elsewhere in this segment. Here the vendor states nothing while others state a great deal on its behalf. Establish directly what exists, in what form, and whether any customer is live on it.

A real residency statement, which is rarer in this segment than it ought to be. The privacy policy states that the services are hosted and operated in the United States and that personal data will be hosted on servers located there. Cross border handling is addressed rather than ignored: transfers outside the European Economic Area are stated to rely on adequacy decisions or standard contractual clauses, a European Union representative is named with a full address, and a data processing addendum is published.

Held at B on three gaps. No hosting provider or cloud region is named, where a peer in this segment names both of its providers. No alternative deployment model exists, so an institution that requires data to remain inside its own environment has no option here, and there is no residency choice for customers outside the United States. And the list of processors is available only on request rather than published, so the chain of subprocessors handling clinician queries cannot be inspected before contracting.

For context on the residency point, within this segment only Avo publishes a comparable statement, while C8 Health, AgileMD and UpToDate publish none.

The clinician facing price is published, unambiguous and zero. The company states that the product is free for licensed clinicians and trainees, with unlimited searches, on signing up with professional credentials, and repeats it in the frequently asked questions rather than burying it in terms. A clinician can establish the full cost of the product they will actually use without speaking to anyone, which this index has found to be true of very little.

Enterprise is entirely gated. No tier structure, no pricing mechanism, no rate card and no implementation fee schedule were located, and third party reviews describe institutional deployment as custom priced. The tier a health system actually buys is therefore opaque, which is the same pattern recorded against UpToDate, where the transparent tier is the one that matters least to the institutional buyer.

One honest counterweight belongs on the record and it cuts against the usual reading of a free product. Nothing published explains how the product is funded. The privacy policy shows advertising partners receiving analytics data and permits sharing aggregated inputs and outputs with business partners and research organisations, but no revenue model is stated anywhere. A buyer assessing durability, and a clinician deciding what to type into a tool that costs nothing, both have a legitimate interest in knowing who pays for it.

Breadth is claimed across the board and the supporting features are consistent with it: a corpus given as more than 60 million papers and guidelines, drug and interaction checking, a calculator library the company numbers in the hundreds, stated availability in every language with region aware results, and stated use from outpatient clinic through to hospital. ACEP states the product is available to clinicians across all specialties in the United States and internationally.

Depth is concentrated somewhere much narrower and the vendor's own pages show it. The flagship partnership is with an emergency medicine college, the clinical council chair is a former chair of emergency medicine, and the majority of named clinical advisors hold emergency medicine appointments, with anaesthesia, paediatrics and oncology thinly represented. An independent review of the product raised the same point and asked for broader specialty representation over time.

Held at B because availability across settings is established while demonstrated usefulness outside emergency medicine is not, and because the evidence grading logic that carries the whole product is directed by a council weighted towards one specialty. Ask which specialties the council actually covers and how content outside those specialties is reviewed before publication.