Verily

Graded on the indexed B2B products. Lightpath uses agents to triage and escalate members and predictive modeling to identify risk; Workbench is a research data environment; Sightline applies analytics to wastewater signals. Held back from A because Lightpath is a care delivery program wrapping a clinical team of physicians, pharmacists, and dietitians, so the AI is the routing and personalization layer rather than the service being purchased.

Escalation is the explicit design of the product rather than a fallback: agents triage and escalate a member to a licensed clinical team when clinically indicated, and the company states plainly that expert clinicians and coaches remain at the center with AI as a feature. The boundary between what the model does and what a licensed human does is stated more clearly than by most vendors in this index.

Products and agents are named. The technology beneath them is not.

What is public: a named conversational agent that reads a member's assembled record and answers questions about it, a triage and escalation capability inside the care programme, predictive modelling described as identifying risk, a research data environment, and analytics applied to wastewater signals. A reader can tell what each does.

What is absent is every technical particular. No model is named, no architecture described, no statement of whether models are the company's own or licensed from a third party, no training data characterisation, no versioning or update practice, and no evaluation results for any component. The strongest technical statement located concerns security certifications rather than the models.

That absence is more visible here than it would be elsewhere, for two reasons. The company's heritage is a large technology organisation, so a buyer will reasonably assume technical depth and should be told what it consists of. And the company distinguishes its assistant from other AI tools on privacy grounds in its own materials, which invites the comparison and then declines to support it with any description of what the assistant actually is.

Ask which models underlie the assistant and the triage layer, whether any are third party or externally hosted, how versions are managed and communicated, and what evaluation exists for the assistant's accuracy when answering questions about a member's own record.

Nothing identifies the model layer: no model is named, no architecture is described, no statement exists of whether models are the company's own or licensed from a third party, no training data characterisation is given, and no hosting arrangement or sub processor list was located.

The products themselves are named clearly enough that a reader can tell what each does, covering a conversational agent that reads a member's assembled record, a triage and escalation capability, predictive modelling, a research data environment and analytics applied to environmental signals, so the gap is specifically at the technical layer rather than in the product description. Two things make that gap more visible here than it would be elsewhere.

The company's heritage is a large technology organisation, so a buyer will reasonably assume technical depth and should be told what it consists of rather than left to infer it, and the parent group question this index applies to any subsidiary of a larger technology company is live: nothing establishes whether group infrastructure or personnel sit anywhere in the path.

And the same materials that decline to describe the assistant use privacy as a point of distinction against other tools, which invites the question of what the assistant actually is. Ask which models underlie the assistant and the triage layer, whether any are third party or externally hosted, and where the group boundary sits.

Substantial research credibility by association, including Workbench powering the NIH All of Us Research Program with a reported 21,500 researchers. However, outcome evidence for Lightpath itself, the commercial care product, was not retrieved in published form, and the product only reached open enrollment in January 2026. Evidence for the platform is not evidence for the program.

Several concrete commitments, published in language a member can actually read, with two questions the AI layer raises.

The commitments. Consent to care is obtained explicitly before the care team retrieves records, so the member acts before the data moves rather than discovering afterwards. The company states a zero tolerance policy for misuse or improper sharing of health information, and states that access is limited to the uses a member has consented to. Collection is described as limited by design to what is necessary, with encryption in transit and at rest. Retrieval is performed by an affiliated licensed provider group rather than by a technology company, which keeps the material inside the clinical framework rather than moving it outside.

The first question concerns the assistant. An AI agent can read a member's assembled health record to answer questions about it, and members can log meals by photograph. Nothing located states what is retained from those interactions, whether prompts and responses are logged and who can read those logs, or how photographs are handled and for how long. An agent with read access to a complete medical record is a different data surface from a record store, and it should be described separately.

The second is training. Nothing located states whether member records or agent interactions contribute to developing or tuning models. The company distinguishes itself from other AI tools on privacy grounds in its own materials, which makes an explicit training position both natural and conspicuous by its absence.

Ask for the retention and logging position on agent interactions and photographs, and for a written statement on model training.

The structure here is materially better designed than the patient directed model this index has recorded elsewhere, and one open matter belongs on the record.

The design first. Records are retrieved by the company's affiliated provider group, a licensed clinical entity, rather than by a technology company acting on a patient's instruction. That distinction carries real weight. A provider group obtaining records for treatment is a covered entity making a permitted disclosure, so the data stays inside the privacy rule rather than leaving it, and the company's own systems sit in a business associate relationship to that group. The company also states that it explicitly asks for consent to care before the care team retrieves records. Where the commercial product is sold to health plans and employers, business associate relationships arise there too. Compared with vendors whose model moves records outside the rule entirely, this keeps federal privacy and security obligations attached throughout.

One consequence follows that members should understand and that is not clearly explained. Records held by a provider group are medical records, subject to retention requirements measured in years. A member asking for deletion will find that request constrained by rules that exist to protect them, which is correct and is not what a consumer application user expects.

The open matter. In September 2025 a former executive filed suit alleging that patient data was used without authorisation and that breaches were not properly handled. Those are allegations in a complaint, not findings. The company's response and the current status were not retrieved in this pass, and no grade here rests on them. A buyer conducting diligence should check the federal breach reporting portal, ask the company directly, and form their own view.

A credible certification set with a dedicated trust page, and a timing question specific to this company.

What is held and stated: certification to the information security management standard together with the cloud controls and cloud personal information standards, which is the right trio for a company operating a health platform on cloud infrastructure. The company publishes a data security and trust page, and describes a privacy by design framework limiting collection to what is necessary, encryption in transit and at rest, enforced access controls and continuous security monitoring. For a consumer facing health application handling assembled medical records, that is a coherent posture.

What keeps this at B rather than higher is what is not published. No penetration test summary, no vulnerability reporting, no service organisation control report, and no statement of audited scope. Another vendor assessed in the same pass publishes test results and vulnerability summaries openly, which is what separates the grades on this axis.

The timing question is particular and worth raising directly. This company separated from its former corporate parent in March 2026 and now operates independently. Certifications are held by legal entities, and infrastructure, security engineering and monitoring capability that were previously shared with or inherited from a large technology parent do not automatically transfer with a corporate separation. Confirm that the certifications named are current and held in the operating entity's own name after separation, that the audited scope covers the products being bought, and what changed operationally in security and infrastructure when the company became independent.

A scoping determination that closes, with one boundary worth watching as the product develops.

None of the indexed products is a regulated device and none is claimed to be. The care programme is a service delivered by licensed clinicians supported by software, and the practice of medicine within it is governed by professional licensure and state medical board rules rather than device regulation. The research data environment is infrastructure. The wastewater surveillance programme analyses environmental samples rather than making claims about identified individuals.

What governs the care programme instead is worth naming so this grade is not misread. Clinicians in the affiliated provider group are licensed state by state, which constrains where the programme can operate and who may treat whom. Prescribing, including for the medication classes central to metabolic care, sits under ordinary prescribing law and the clinician's own responsibility. And where the programme is sold through health plans, benefit design and utilisation management rules apply to what members can access.

The boundary to watch is the triage layer. Software that routes a member to automated support rather than a clinician is operational. Software that assesses a clinical situation and recommends what should happen next moves toward decision support, and the exemption that keeps such software outside device regulation depends on a clinician being able to review the basis independently rather than relying on the output. Ask what the escalation logic presents to the clinician who receives it, and whether that reviewability is preserved as the agents take on more.

No governance framework, model documentation or evaluation was located, and the domain question here is about who gets clinical attention.

The indexed care product uses agents to triage members and escalate them to a licensed clinical team when clinically indicated. That escalation decision is the substantive output. It determines which members reach a physician, pharmacist or dietitian, and which continue with automated support and coaching. Clinician time is finite, so triage is allocation, and allocation is where inequity appears if it appears at all.

The conditions make it more pointed. The programme covers diabetes, prediabetes and obesity, and cardiometabolic care carries well documented differences in access, diagnosis and treatment across populations. A triage model learning from historical engagement or utilisation patterns can reproduce those differences while appearing to work, because the members it deprioritises generate no signal that anything was missed.

Nothing published states what the triage model considers, whether escalation rates have been examined across member groups, what the false negative position is, or what a member can do if they believe they should have been escalated and were not. Nor is anything published on the assistant's behaviour: what it declines to answer, how it handles a question that should prompt escalation, or how it performs across health literacy levels and languages.

Ask for escalation rates broken down by member characteristics, the false negative analysis on triage, and the safety evaluation for the conversational agent.

Two mechanisms here address the member rather than the buyer, which is what this axis rewards. Consent to care is obtained explicitly before the care team retrieves records, so the member acts before the data moves rather than discovering afterwards, which is the consent as a gate pattern this index has credited once before and which almost nobody else in this lane implements.

And retrieval is performed by an affiliated licensed provider group rather than by the technology company, which keeps the material inside a clinical framework carrying professional duties rather than moving it into a software relationship that carries none. A published zero tolerance position on misuse and a stated limitation of access to consented uses sit alongside. Held at C because nothing measures the system and nothing stands behind its output.

No accuracy figure or evaluation exists for the assistant, which reads a member's assembled record and answers questions about it, and that is the component where a wrong answer reaches the member directly with no clinician between. No warranty, indemnity or remediation commitment was located.

One asymmetry is worth noting because this index has recorded it elsewhere: the company distinguishes its assistant from other artificial intelligence tools on privacy grounds in its own materials, which invites a comparison and then declines to support it with any description of what the assistant is or how often it is right. Ask for the assistant's accuracy on record questions, and what a member is told about its limits.

Real retrieval breadth, and unusually honest about its limits.

With the member's consent, the affiliated provider group retrieves records from multiple health systems and health information exchanges, consolidating medications, conditions, procedures, immunisations and test results into a longitudinal profile. The application also accepts data from both major consumer health data frameworks on mobile platforms, which brings device and wearable data alongside clinical records. Using health information exchanges rather than negotiating system by system is the broader path, and it is the same mechanism that makes patient mediated aggregation viable at scale.

What lifts this above a claim is the caveat the company publishes with it. Members are told they may see around nine years of history on average, and that completeness varies by provider participation and data type. Naming an expected depth and then stating plainly that it varies is the opposite of the usual practice, which is to describe coverage in terms of how many providers are connected and leave the member to discover the gaps.

Held at B rather than A because the flow described is inbound. Nothing was located on whether anything travels the other way: whether care team notes, escalations or programme outcomes are returned to the member's own clinicians, or whether the programme's record sits parallel to the record their physician actually uses. For a chronic care programme running alongside existing primary care, that return path is the question a health plan should ask.

Cloud delivered with a mobile application, and nothing published about the underlying arrangement.

No hosting location, region, tenancy model, retention schedule or subprocessor list was located. The certifications the company holds include the cloud controls and cloud personal information standards, which tells a reader it operates as a cloud service and has been examined as one, and tells them nothing about where anything sits.

One question is specific to this company's situation and should be asked plainly. It separated from its former corporate parent in March 2026. Where a business has grown inside a large technology group, its infrastructure, identity systems, monitoring and data platforms are frequently the parent's, and a corporate separation does not by itself move any of that. A buyer should establish what infrastructure the company now runs on, whether any dependency on the former parent persists and under what agreement, what the transition plan is if one is underway, and how continuity and access controls are maintained through it. This index has recorded the difficulty of drawing a boundary between what a company operates and what it inherits from a corporate sibling; separation makes that boundary a live operational question rather than a documentary one.

The research data environment deserves separate treatment. It hosts a major national research programme with its own governance and access model, and the residency, isolation and access arrangements there are almost certainly distinct from those of the commercial care product. Ask about each separately rather than accepting one answer for both.

Converted from Not Rated, resolving one of the index's deliberately held rows. The question held open was whether the commercial statement is vendor published. On the member side it plainly is, and that is what moves this above the category norm.

The company states directly, in its own member facing materials, that the application is free to download with no insurance copay, that the standard features are free to all users, that the enhanced programme is accessed through an insurer or employer as a benefit, and that the company will not bill the member's insurance. It also states that using the application will not affect the member's coverage. A person deciding whether to enrol can therefore determine their own financial exposure without contacting anyone, which is the question that matters most to them and which very few health products answer publicly.

Held at B rather than A because the axis also concerns the purchasing organisation, and on that side nothing is published. Health plans, employers and pharmacy benefit managers buy the programme, and no rate structure, per member pricing, minimum, contract term or risk sharing arrangement was located. A benefits leader evaluating this cannot form any estimate without entering a negotiation.

For calibration within this index, another vendor whose commercial structure is described only in trade press quoting executives sits a grade lower on that basis. The distinction is not how much is disclosed but who published it: a structure reported by journalists is not terms published by the vendor, and here the member facing terms are unmistakably the vendor's own.

Lightpath Metabolic is clearly scoped to cardiometabolic conditions including type 1 and type 2 diabetes, prediabetes, and obesity, across tiers of clinical acuity. Held back from A because the company spans care delivery, research infrastructure, and public health surveillance, and the boundaries between those lines are not always clearly drawn in its own materials.