Verbal

Models are the whole product and there is no other product underneath. Custom models trained per customer read call transcripts, clinical notes and secure chat and judge each against that organisation's own protocols, which is a harder task than transcription or summarisation because the standard being applied differs by customer, by role and by service line. There is no rules library doing the work, no services team behind it and no workflow tool that would function without the models.

The company draws the distinction itself and correctly: a scribe summarises a conversation, this evaluates one, and evaluation requires a model that understands what should have happened as well as what did.

Nothing is decided for a patient and one oversight feature is genuinely unusual. Findings go to compliance teams and managers, who investigate and act, so the model surfaces rather than concludes. The notable design choice is upstream of that: the customer validates the model's accuracy before it is deployed to users, which places a human acceptance gate on the model itself rather than only on its individual outputs. Very little in this index offers that.

The countervailing consideration is the same one recorded against two other vendors in this segment: this scores the professional performance of staff, and a testimonial on the company's own site describes a user looking at their score and working out what they did wrong, so the scoring is visible to the individual. That is better than scoring people invisibly. What is not published is whether a score can be contested and whether scores inform employment decisions.

The mechanism is described more concretely than most and the evidence is delegated rather than published. Custom models trained per organisation against that organisation's stated compliance requirements, with a validation step before release, is a real account of how the product works.

It also creates an unusual accountability structure worth naming: transparency here is provided to each customer about its own model rather than to the public about the product, so every buyer can in principle see accuracy figures that no outside party can. That is better than nothing published and it is not the same as published performance. No architecture, no aggregate accuracy figures, no description of the validation method, and no account of what the model does when a protocol is ambiguous were located.

A meaningful third party endorsement and no measured results. Being named a qualified solution on Mayo Clinic Platform in October 2025 involves passing that programme's own vetting and makes the product available across a network stated at more than 50 affiliated organisations, which is stronger than a customer logo because an independent institution applied criteria. Selection into a health system backed accelerator programme in 2026 adds a second external filter.

Against that, the headline operational claim of three or more hours saved per day is unattributed and undenominated, user testimonials are qualitative, and two passes located no publication, no independent evaluation and no measurement of the one number that matters most for a compliance product, which is how often its judgement agrees with a qualified human auditor. The company was founded in 2024, so a thin record is expected rather than surprising.

The company states that the platform is HIPAA compliant and fully encrypted, and two passes located nothing beneath that. The exposure is large and unusually broad: this product reads calls, clinical notes and secure chat messages across an entire organisation, which is a wider slice of protected information than a voice product or a documentation product alone touches, and it does so continuously across every interaction rather than on a sample.

The per customer training model raises a question that would be favourable to answer: whether models are siloed so that one organisation's interactions never inform another's model. Nothing published addresses retention, secondary use or that isolation question.

HIPAA compliance is stated plainly, and qualification on a major health system's technology platform implies that a compliance review was passed, since such programmes examine privacy and security posture before listing a solution. That is indirect evidence rather than published terms. Two passes located no business associate agreement terms, privacy page or subprocessor list. The subprocessor question applies here as to any language model product and is unaddressed.

Two passes located no SOC 2, no HITRUST, no ISO 27001, no trust centre and no vulnerability disclosure policy. Qualification on a health system technology platform is a vetting outcome rather than a portable attestation, and a compliance officer evaluating this product independently would still need the report.

The gap is worth closing early for a company whose entire proposition is that organisations should be able to demonstrate their protocols are followed, because the same argument applies to the vendor's own controls.

No clearance, authorisation or submission located and none needed. Auditing documentation and interactions against an organisation's own protocols is administrative. The regulatory frame that matters is the one the product sits inside rather than one applied to it: its outputs feed billing compliance, accreditation readiness and regulatory adherence, so the accuracy of its judgements has consequences under payment and accreditation rules rather than device law.

The failure mode is asymmetric in the same way recorded against adverse event detection elsewhere in this index. A false flag costs a reviewer's time. A missed one tells an organisation it is compliant when it is not, and the organisation carries that liability regardless of what the software concluded.

Lifted above the segment norm by the pre deployment validation gate and held below a higher grade by the absence of everything else. Letting a customer test model accuracy before it is turned on for staff is a governance mechanism, and it is one that almost nothing in this index offers.

What is absent is any bias analysis: no subgroup performance, no testing methodology, no model card and no drift concept, and this is the eleventh record in this index carrying the speech and language variation exposure while operating on recorded conversation. The exposure has a particular shape here because the model judges people.

If transcription is weaker for a clinician or a patient with a given accent, the resulting compliance score is depressed for reasons that have nothing to do with the clinician's conduct, and the person carrying that score has no way to see the cause. This is the third instance in this index of a model scoring employee performance and the second where the compounding with speech accuracy is the specific risk.

The product must reach three separate systems to do its job, since it reads telephony, the clinical record and secure messaging, and the company describes integrating with an organisation's existing communication stack and beginning to log and analyse in the background. Reading and auditing clinical notes implies working record access. Availability through a major health system's technology platform gives it a distribution route into that network's affiliates. Two passes located no named record system, no telephony platform and no interoperability standard, so the depth is asserted rather than demonstrated.

A hosted service with no published architecture, hosting region or residency commitment located in two passes. The retention question is unavoidable for this product rather than incidental to it: retrospective auditing and trend analysis across an interaction history require the interactions to be kept, so the platform is by design an accumulating store of calls, notes and messages across an organisation. How long that store persists and whether it is isolated per customer are the first questions a compliance officer should ask, and neither is answered.

No pricing, pricing mechanism or basis of charge located. Funding visible is accelerator stage, and the company was founded in 2024, so it is early and lightly capitalised relative to the organisations it is selling into. A compliance programme is not a component an organisation can drop easily once auditors and accreditation cycles depend on its output, so supplier continuity deserves direct enquiry on the Behold.ai ground, alongside a question about what happens to the customer's accumulated audit history if the supplier fails.

One function applied across many contexts, and one customer type nothing else in this index serves. The function is compliance and quality assurance over patient interactions, applied across roles and service lines, with the company's own user testimonials pointing at behavioural health, where session documentation and protocol adherence carry particular weight.

The unusual part is the second buyer: the company names developers of artificial intelligence agents for healthcare organisations as customers, and states that it audits clinical notes whether a human or an agent wrote them. A compliance layer that checks the output of other artificial intelligence is a structurally different thing from a tool that checks people, and this index has previously recorded that kind of product as adjacent to its own purpose. Held at C because the company is two years old, the coverage is asserted rather than evidenced, and geography is the United States.