Videra Health

The models are the product. The company's own framing is one model deployed across intake, assessment, documentation and research, and every product in the line runs model inference as its core operation: assessment scoring from video and voice, ambient session documentation, a provider workflow copilot, documentation quality assurance, and conversational intake. Strip the models out and what is left is a video capture form and a scheduling page.

The intelligence is proprietary and purpose built rather than assembled. The company trained its own instruments, PHQ-V, GAD-V, PCL-V and EPDS-V, as video native versions of the standard written scales, on a stated corpus of roughly 400,000 training samples and 50,000 hours of clinical data, alongside a video model for tardive dyskinesia detection. Those are instruments built for one clinical domain and published as such, not general purpose models pointed at a health problem.

A workflow layer exists and is substantial. Intake paperwork, scheduling capture and inbound inquiry routing would retain some value without the models. It does not qualify the grade, because that workflow exists to deliver model inference to a patient and return a result to a clinician rather than standing as something a buyer would purchase on its own.

The boundary is stated clearly and repeatedly, and the escalation behind it is undefined.

What is stated is unambiguous and consistent across pages. Models provide decision support and never replace clinical judgment, critical decisions remain with qualified clinicians, and results and alerts surface in a provider dashboard and the record system rather than triggering autonomous action. Patient facing material draws the scope boundary plainly, telling patients not to use the platform during a medical or mental health emergency and to call emergency services instead. Stating what a product must not be used for is a real scope boundary.

The gap is what happens between the model firing and a human seeing it. Assessments are asynchronous by design, completed by patients on their own devices at whatever hour they choose, and the instrument set includes the Columbia Suicide Severity Rating Scale. That combination produces a foreseeable scenario: a patient completes a check in overnight, the model registers severe risk, and nothing published states who is notified, through what channel, within what time, or whether any coverage exists outside business hours. No staffed crisis capability is published, so escalation rests entirely on the customer's own staffing, and nothing describes what the customer is advised to have in place.

No alerting threshold is published either, so the operating point deciding which patients reach a human is unknown.

Three modalities and five models described at feature level, with no version discipline behind them.

What is published is specific. Linguistic analysis names absolutist language patterns, word complexity and sentiment. Acoustic analysis names speech rate, pause duration, pitch variation and articulation. Computer vision names facial movement, microexpressions and affective state. Five instruments sit in a published table with clinical application, discrimination and modality against each: PHQ-V at 0.88 to 0.90, GAD-V at 0.90, PCL-V at 0.85 to 0.90, EPDS-V at 0.89, and tardive dyskinesia detection at 0.87 to 0.92. Training scale is quantified at roughly 400,000 samples, 50,000 hours of clinical data and 150,000 research participants, and five peer reviewed papers document the methods.

What is absent is update discipline. No model version is published, no release or retraining cadence is stated, and nothing says when an instrument last changed or how a customer would find out. Model cards are stated to exist and are available on request, so the artifact that would normally carry both version and operating point is gated.

The operating point is the second gap and it matters clinically more than its size suggests. Area under the curve is threshold independent and describes ranking, not decisions. A deployed screening tool applies a cut off, and sensitivity, specificity and positive predictive value at that cut off are published for none of the five instruments. A model reported at 0.90 can be tuned to miss most true positives or to flood a clinic with false ones, and the published figure does not separate those two deployments.

Architecture is not described, and any dependence on a third party base model is unaddressed.

The software supply chain is documented well and the model supply chain is not documented at all.

On the software side there is real substance. Amazon Web Services is named as the infrastructure provider. Dependency and third party library analysis is described with scoring criteria that block vulnerable components from release. Container images are assessed with a passing score required before deployment. Those are concrete supply chain controls, described in specific terms.

On the model side nothing is disclosed. No base or foundation model is named, and no statement addresses whether any third party model is used at all. That absence is conspicuous rather than neutral, because two products in the line are the kind rarely built from scratch: ambient session documentation and a conversational agent handling inbound patient inquiries around the clock. If a general purpose language model sits behind either, patient session audio or inquiry content passes to a party the customer has not been told about.

No sub processor register is published. No transcription provider is named, despite transcribed speech being an explicit input to the language models. No position is published on whether customer data contributes to model development.

The proprietary instruments are a separate matter and are documented well. The gap is in what sits underneath and around them.

Strong published research, answering a different question from the one the marketing poses.

The headline claim is a clinical outcome claim: a 64 percent reduction in crisis driven interventions, stated on the home page across more than 300 facilities and over a million patient interactions. It carries no site, no period, no denominator and no method, and nothing on the research page reaches it. What the research page establishes is something else entirely: whether a model agrees with a clinical reference. Every one of the five published papers tests that question. None tests whether using the platform changes what happens to a patient. Where the claim is about outcomes and the evidence is about accuracy, the evidence does not answer the claim.

The accuracy evidence is itself real and checkable. Five papers are listed with full citations across journals that carry substantive review: npj Digital Medicine in the Nature portfolio in 2025, JMIR Mental Health in 2026, the Journal of Clinical Psychiatry in 2025, Women's Health Reports in 2026, and Applied Sciences in 2022. The JMIR paper is a cross dataset evaluation of the tardive dyskinesia model, testing it against data it was not developed on, which is a stronger design than internal validation alone. Discrimination is published per instrument rather than described, from 0.85 to 0.92 area under the curve on stated independent test sets, with research scale given as roughly 150,000 participants.

Two pieces of context belong beside that. All five papers are authored by company staff, and the scientific advisor named on the company's own site is a co author on both tardive dyskinesia papers, so the flagship result has not been independently replicated. The peer review stands, and vendor authored research is normal in this field, so this is context for reading the evidence rather than a mark against it. Commercial evidence is separately real: a named deployment built with Discovery Behavioral Health and Brigham and Women's Hospital, and federal consortium work on service member suicide prevention.

Handling controls are described in unusual operational detail, and the single question that matters most for this vendor goes unanswered.

The detail is specific rather than gestural. AES-256 and TLS encryption in transit and at rest, applied across disk, application and database layers, with key access restricted, key sharing prohibited and key management reviewed annually. Access runs on least privilege with SAML 2.0 single sign on and customer configurable two factor authentication, while multi factor authentication is mandatory for employees through a centralized directory. Networks sit in isolated virtual private clouds behind security groups and firewalls. Customer data is segregated by unique identifier. Retention follows a data classification, secure disposal is described for physical media, and deletion is available on written request. Security event and audit logs are collected and continuously monitored with integrity protection. Patients are told when artificial intelligence is used, stated as an explicit principle rather than buried in terms.

The unanswered question is provenance. The company states a training corpus of roughly 400,000 samples, 50,000 hours of clinical data and 150,000 research participants, and nowhere states whether customer patient recordings contribute to model development, under what consent, or whether a customer can decline. The material at issue is video and audio of a patient's face and voice discussing their mental health. A recording cannot be de identified the way a claim line can, so the usual reassurance about aggregated or anonymized training data does not transfer here.

Further security controls do not answer this. A published position on whether customer recordings train models, and how consent is obtained, would.

A posture with one notable strength and one wording error.

The strength is specific. The company publishes a redisclosure consent notice as a standing page alongside its privacy policy. Redisclosure consent is the mechanism governing substance use disorder treatment records under the separate federal confidentiality regime that applies to them, and a behavioral health platform reaching into addiction treatment settings sits squarely inside that regime. Publishing the notice suggests the regime has been engaged rather than overlooked. Patient facing terms also state that health history is shared only with the participating care team and not with an employer, and that removal can be requested with a stated processing window of five to seven business days.

The security page carries the wording error: it says the company holds industry standard certifications and then lists SOC 2 Type II and HIPAA compliance together. There is no HIPAA certification. It is a regulatory obligation with no certifying body, and placing it beside an audited attestation suggests two externally verified things where only one exists.

Business associate agreement handling is not addressed anywhere. No template, no execution requirement, no statement of which entity contracts and no subcontractor flow down position is published.

A documented program and a public trust portal, with the report itself behind an agreement and the audit period unstated.

The program is described rather than asserted, in operational detail. SOC 2 Type II is held, annual penetration testing is performed by independent third party agencies, and the secure development lifecycle is set out specifically: automated security testing before release, dependency and third party library scanning with scoring criteria that block vulnerable components, dynamic application security testing, container image assessment requiring a passing score before deployment, and enforced source control standards covering role based access, least privilege, segregation of duties, branch protection and secrets management. Incident response procedures, personnel background checks and continuing security training are all described.

The gaps are the artifact and the clock. A public trust center is published and stated to hold the SOC 2 report, but the company's own security page says an executive summary, with sensitive information redacted, is provided to customers under a non disclosure agreement. So the type is named and the report is not reachable without asking. The audit period and the assessor appear nowhere, so neither the window the attestation covers nor its renewal date is known.

No health specific certification is held, which would map a control set onto health privacy requirements directly. No vulnerability disclosure policy or coordinated reporting channel is published, the one common component absent from an otherwise complete program.

The current site makes no device claim, and it is an open question whether the decision support route actually covers these models.

No clearance, De Novo grant or approval exists for any product, and no FDA claim appears on the homepage, the research page or the security page. The footer carries HIPAA and SOC 2 marks only. Earlier company material described the platform as an FDA registered digital health platform and showed a registered mark beside those audited trust marks. Establishment registration is an annual filing obligation: it records that a firm exists and what it lists, involves no review of safety or effectiveness, and confers neither clearance nor approval, and the agency itself states that registration does not denote approval and that using it to suggest endorsement is improper. That framing is absent from the company's pages today. Press releases and partner listings may still carry it.

The published position is decision support that never replaces clinical judgment, with results surfacing in a provider dashboard rather than triggering action. Screening tools returning a score to a clinician who independently decides can fall within clinical decision support treatment, and that framing is the right one for the path.

Three things keep it uncertain. The decision support route generally turns on whether a clinician can independently review the basis of a recommendation, and a score derived from facial microexpression and vocal acoustic analysis is not reviewable the way a rules based flag is: a clinician cannot inspect why a pitch variation pattern produced a depression score. Assessments are completed by patients asynchronously on their own devices, so the source is material the clinician did not witness. And detecting tardive dyskinesia from video is closer to identifying a physical sign than to summarizing patient reported answers.

A published ethical framework with no measurement behind it, set against a bias risk profile close to the worst case for this modality.

The framework exists and is more than boilerplate in places. Seven principles cover patient centered care, transparency, equity and accessibility, accuracy, ethical data use and human oversight, and the equity principle explicitly claims diverse datasets used to minimize bias and ensure equitable treatment across patient demographics. Telling patients when artificial intelligence is used is a real commitment.

Nothing measures any of it. No fairness or bias testing, no performance broken down by any subgroup, no calibration data, no drift monitoring and no external audit is published. Model cards are stated to exist but only on request, so the one artifact that would normally carry subgroup performance is gated.

The risk here is not generic. Facial analysis carries well documented differential error rates by skin tone, and acoustic analysis by accent, dialect, sex and age. Beyond demographics the signal itself is confounded in this population: affective expression norms vary by culture, and several conditions the platform is used around alter the exact signals being measured. Antipsychotic medication and tardive dyskinesia itself change facial movement, which is simultaneously the input to the movement disorder model and a confound for the affect models running on the same video. Flat affect is both a clinical feature and a measurement artifact.

An aggregate area under the curve of 0.89 is entirely compatible with materially worse performance inside a subgroup. The published figures do not answer that question and cannot.

Nothing allocates responsibility, in the clinical domain where the consequence of a miss is gravest.

No service level agreement, accuracy warranty, performance guarantee, indemnity, remediation commitment or stated recourse is published for the case where a model output contributes to harm. Published terms of use are patient and employer facing rather than a customer contract, and nothing describes what a health system's agreement contains.

The published accuracy figures do not substitute for this. An area under the curve is a research statistic, not a commitment, and because no operating threshold is published there is no stated false negative rate for any instrument. For a platform screening with the Columbia Suicide Severity Rating Scale, the false negative rate is the number that matters, and it is unavailable in both senses: neither disclosed nor warranted.

The allocation question is concrete rather than theoretical. A patient completes an overnight check in, the model does not flag deteriorating risk, no clinician is alerted, and harm follows. Responsibility then sits somewhere between an undisclosed model threshold, the customer's own escalation staffing, and a vendor carrying no published commitment, and nothing in public material indicates where.

Neither further publications nor higher reported discrimination answers that. A contractual term would, as would a published operating point carrying a stated false negative rate.

Seven systems named, with no standard and no direction of flow.

The naming is real capability evidence rather than a general claim of openness. Kipu, Alleva, BestNotes and BlueStep are behavioral health, addiction treatment and senior living record systems, which is exactly where this vendor's customers sit, and all four are linked directly from the company's own home page. Epic and Cerner cover the acute market. Zoom appears alongside them as a session capture path. A vendor naming the niche systems as well as the two large ones has usually built to them, and the company states that connecting once to the record system unlocks the full product set.

What is absent is the specification. No interface standard is named, so whether this runs on FHIR, HL7 version 2, a proprietary interface or file exchange is unknown. No marketplace or partner listing is published for either major system. Nothing states which direction data moves.

That last point is the entire question for one of these products. Sidekick Notes generates clinical documentation, and whether a generated note writes into the legal medical record automatically, lands in a draft queue awaiting clinician signature, or must be moved across by hand is the difference between a workflow product and a transcription tool. The same applies to assessment output: an outcome score entering the chart as a discrete field is materially different from a score displayed in a separate dashboard.

More than a bare cloud statement, and short of a residency commitment.

What is published names the provider, the region scope and the availability model: Amazon Web Services, United States regions, multiple availability zone architecture. Networks are isolated in virtual private clouds. Customer data is segregated by unique identifier so that access to customer specific information remains with that customer, which describes logical isolation. Backups replicate across multiple availability zones, and business continuity and disaster recovery plans are stated with annual restore testing against recovery point and recovery time objectives.

What is missing is choice and commitment. Logical isolation is described but no dedicated or single tenant option is offered, and for an organization whose competitors may sit in the same environment that is a procurement question rather than only a security one. No contractual residency commitment is stated, only a description of present practice. No customer managed encryption key option is mentioned, and no customer hosted or private deployment path exists.

One gap attaches to a named relationship. The company works with a federal medical technology consortium on service member suicide prevention, and federal health deployments typically require FedRAMP authorization or a Department of Defense impact level. Neither is claimed anywhere, and nothing describes which environment serves that work.

Cost is absent from every published surface. No pricing page, unit of charge, range, implementation fee position, minimum commitment or pilot terms is published, site navigation carries no pricing entry at all, and every path terminates at a demo booking form.

Two fragments are the whole of what exists. A professional association partnership offers members 20 percent off annual software subscription fees, which establishes an annual subscription basis and nothing further. TDScreen is free to any provider or patient, which prices one narrow tool and says nothing about the platform. A billing period without a unit of charge is not enough to size a purchase.

The product structure makes the silence more costly. Nine separately named products span inquiry handling, intake, assessment, ambient documentation, documentation quality assurance, clinician workflow support, trial observation, video screeners and co developed algorithms. Those carry entirely different cost drivers: documentation scales with clinician count, assessment scales with patient volume, inquiry handling scales with inbound demand. Nothing indicates whether they are licensed separately, bundled or metered, so not even a rough budget can be built from what is published.

Nor is a return proxy supplied. The company argues two clinician hours saved per day and fewer crisis escalations, which is a financial argument with none of its financial inputs attached.

Depth by clinical population is well evidenced; depth by care setting is not evidenced at all.

Population coverage is specific and backed by instruments rather than assertions. Depression, anxiety, post traumatic stress, postpartum depression and tardive dyskinesia each carry a named validated model, which makes the coverage claim checkable in a way a list of served conditions is not. Postpartum screening and movement disorder detection are unusual additions to a behavioral health assessment line and set the product apart. The named integration partners map to distinct settings, spanning addiction treatment, behavioral health and senior living record systems alongside the two major acute systems, and a separate life sciences line adds clinical trials and post market research as its own buyer context.

What is missing is which products run where. More than 300 facilities are claimed and not one is characterized by level of care. Nothing separates residential from outpatient from intensive outpatient, which differ both clinically and commercially. Nothing states whether any model is validated for adolescent or pediatric populations, which represent a large share of behavioral health demand and use different instruments. Nothing addresses markets outside the United States, and acoustic and language models raise an obvious question about performance outside English that goes unanswered despite Spanish patient material being published on the site.