Vero Scribe

Ambient capture, note generation, evidence search and code lookup are the entire product, with no services or platform business underneath.

Oversight sits with the practitioner. The terms of service state that outputs may be inaccurate or incomplete, and that the practitioner must review and verify every output and correct it before it is used or relied upon. That is the oversight structure; what is missing is any confidence threshold, low confidence behavior, acceptance rate or edit burden figure.

The platform produces more than the note. It generates diagnosis codes, drafts follow up tasks, fills forms and offers decision support insights. Each is a different artifact with different consequences, and a single review of a note does not obviously cover a code, a task or a completed form. The confirmation that applies to each is not described.

One governance layer is present. The vendor supports shared patient context across a team with permissions, organization scoped templates, and administrator and member roles, which lets a practice standardize documentation and see who did what.

A hospital using the product has excluded trainees from using it, which is a considered call: a clinician learning to document is building a skill the product substitutes for.

The suppliers are named: a Vero article published in March 2026 states that Azure Speech to Text converts the conversation to text and Azure OpenAI turns the transcript into a structured note, so the underlying models are a general purpose foundation model service with a healthcare layer on top rather than proprietary. The vendor also says the product learns each clinician's style.

What is missing is the version and update discipline, and any evaluation. No model version or deployment is named, nothing says how model changes are communicated, and no accuracy figure, model card or evaluation methodology is published.

The model layer is named on the vendor's own material. A Vero article published in March 2026 states that Azure Speech to Text converts the conversation to text and Azure OpenAI turns the transcript into a structured note, both operating under business associate agreements with Microsoft Azure and AWS. The trust center lists eight subprocessors, including Microsoft Azure and Google Cloud alongside product analytics, error monitoring and messaging tools.

The training boundary is stated in the privacy policy: patient data and sensitive health information are never used to train, develop or improve the vendor's proprietary models, and sensitive health information is pseudonymized. The terms separately license de identified data, excluding sensitive health information, for service improvement and research.

Completeness and terms are what is missing. Only part of the subprocessor list is visible without opening the portal, the list does not state what each party receives, and no retention or training terms are published for the model providers themselves. The current terms of service no longer name the model provider, though they once did.

There is no published study, controlled evaluation, accuracy benchmark, third party rating or named health system deployment. Evidence is testimonial. There is a sourcing problem specific to this vendor: because it publishes a large volume of comparison content about the whole category, search results about Vero and about its competitors are heavily populated by Vero's own writing, which is not independent assessment in either direction.

The training question is answered, and retention depends on the tier. The privacy policy states that patient data and sensitive health information are never used to train, develop or improve the vendor's proprietary AI models, that sensitive health information is pseudonymized with direct identifiers removed, and that it is retained only for the duration specified by the practitioner. The terms license de identified data, excluding sensitive health information, for service improvement and research.

Retention is where the surfaces disagree. The homepage offers retention windows from one to three hundred and sixty five days with automatic deletion, and the privacy policy leaves the duration to the practitioner, but the pricing page lists custom data retention policies as an Enterprise feature, not included in the free or professional tiers. The retention that applies on the entry tiers is not stated.

Two gaps remain: that retention question at the entry tiers, and the absence of any description of the safety engineering behind generated notes.

File upload sharpens the retention question. Prior notes, consult letters and other uploaded documents are not encounter audio and may carry a different treatment.

HIPAA compliance is claimed and the instrument is not published.

Vero is a Canadian company selling into the United States, and its trust center, homepage and pricing page state HIPAA and PIPEDA compliance. Once a vendor invokes HIPAA, the business associate agreement is what a United States buyer relies on. The current terms of service, updated 31 March 2026, contain no business associate provisions, and neither the privacy policy nor the pricing page states business associate status. The terms once embedded a business associate agreement that took effect at sign up; the current version does not, and whether that arrangement still exists, or where it now sits, is not stated.

The Canadian half is documented. The privacy policy describes processing health information on behalf of practitioners, pseudonymization of that information, storage within Canada for Canadian customers and within the United States for United States customers, and data processing agreements with providers whose servers sit elsewhere. The trust center lists 34 policies and a business associate management control.

The self serve free tier matters here: a clinician can begin recording patients before any agreement conversation takes place.

SOC 2 Type II certification is stated on the vendor's homepage, and its trust center lists a SOC 2 Type 2 report available under a non disclosure agreement, alongside 34 policies, 84 monitored controls and eight subprocessors. The privacy policy describes encryption at rest and in transit, role based access controls, pseudonymization and regular internal and external security assessments.

SOC 2 Type II is the stronger report type, testing whether controls operated across a period. The trust center shows HIPAA and PIPEDA as compliant; those are self assessed positions against laws rather than examinations, and they add nothing to the report's weight.

The weak point is that the report sits behind a non disclosure agreement and no report date, audit period or scope statement is visible. Scope matters because the platform spans documentation, evidence search, coding and form filling.

No clearance is claimed, and the terms of service state that the platform is not a medical device and does not provide medical advice.

The positioning goes further. The product markets evidence based decision support, drawing on more than 27 million articles for real time clinical insights at the point of care, and the pricing page lists Insights, described as clinical decision support, in its feature table. The reasoning that keeps decision support outside device regulation depends on the clinician being able to review the basis of a recommendation independently, and nothing published shows what each insight cites or what the clinician is shown before acting on it.

Canadian deployment adds a privacy dimension rather than a device one. Provincial regulators in Ontario, British Columbia and Alberta have issued guidance on ambient scribes, and a Canadian hospital deploying this product publishes a patient consent page naming it and records a decision that trainees will not use it.

The product claims support for sixty languages, with up to three captured simultaneously within a single recording.

No fairness statement, subgroup analysis, accuracy breakdown by accent or dialect, or evaluation methodology is published.

Sixty languages is a substantial claim and nothing accompanies it: no list, no per language accuracy, no indication of which are well supported and which are nominal. Simultaneous capture of three languages in one encounter is a harder problem again, since it requires separating speakers and languages at once, and it is precisely the capability a bilingual consultation with a family member interpreting would rely on. Nothing published supports it.

The deployment context makes this more pointed rather than less. The product is used in Canadian urban practice, where multilingual consultations are routine rather than exceptional, and one of its marketing illustrations shows a Spanish language exchange rendered into an English note. A translation step inside the documentation pipeline changes what the signature attests to, because a clinician who does not speak the source language cannot verify the rendering.

The terms of service describe review before commit in plain words: outputs may be inaccurate or incomplete, and it is the practitioner's professional responsibility to review all outputs, verifying and correcting them before they are used or relied upon. That is a real mechanism for challenging an output.

Nothing stands behind the output. The platform is provided as is, liability is capped at fees paid in the preceding twelve months, and the practitioner indemnifies the vendor against claims including claims made by a patient. On the free tier, twelve months of fees is nothing. There is no accuracy figure, error rate or published limitation.

Retention is configurable, with a stated range of one to three hundred and sixty five days and automatic deletion, but the pricing page lists custom data retention policies as an Enterprise feature, and nothing published says what setting applies at the free and professional tiers. That governs how long content is held rather than whether it is right.

Integration is claimed in general terms, with no record system named on the vendor's own pages and no architecture or write back mechanism described.

Custom EMR integrations no longer appear as an Enterprise feature: the current pricing page lists no integration feature on any plan, including Enterprise.

What the product does publish is a note workflow built around export: a rich text editor with export, patient management, ICD-10 auto coding and custom templates are listed on every paid plan. Nothing says whether a finished note reaches the chart by copying, by file, or by an interface into a named system. A third party marketplace listing names Epic, Cerner and MEDITECH, but its surrounding text appears identically on other vendors' entries, so it carries little weight on its own.

The claim is made and nothing identifies what it connects to. Until the vendor names a system and a mechanism, notes on any plan are most likely transferred rather than written into structured fields.

Residency is stated for both markets and the processing path is left open. The privacy policy says data is stored within Canada for Canadian customers and within the United States for United States customers. It also says certain functions rely on third party providers whose servers are located in other countries, under data processing agreements. The trust center lists eight subprocessors including Microsoft Azure and Google Cloud, and a vendor article names Azure Speech to Text and Azure OpenAI as the model services.

That commitment settles the question Canadian privacy guidance puts first. Provincial privacy regulators in Ontario, British Columbia and Alberta have each issued guidance on ambient scribes, and where information is held is among the first items a custodian must resolve.

The gap is the path rather than the storage. The policy expressly allows processing by providers outside the customer's country, and it does not say which functions those are or whether the model services run in region. Tenant isolation is not described.

The platform is delivered across web, mobile and desktop, with recording, typing, dictation and file upload as input paths.

A complete, self serve ladder, published rather than quoted. A free tier includes ten encounters a month with no credit card required, the Pro tier is $69 a month billed yearly with unlimited encounters, a monthly billing option is offered with yearly billing saving $240 a year, and an Enterprise tier is custom priced for clinics and hospital networks, adding single sign on, organization management, a team dashboard, centralized billing, custom onboarding, dedicated support and custom data retention policies. A permanent free tier lets a low volume clinician use the product indefinitely without a purchase decision.

Note types are enumerated properly rather than implied, covering SOAP, progress notes, consults, referrals and discharge summaries, and platform coverage is wide across web, mobile and every major desktop operating system, which matters for clinicians on managed or non standard machines. The headline claim of more than 150 specialties is asserted without enumeration or any specialty tuning detail, and language support is limited to around three languages.