Wavo Health

Speech recognition, note generation, the clinical assistant and patient material generation are all model output, with no services layer or legacy platform underneath.

The gate is stated as a three step sequence rather than an implied one: review, edit, then APPROVE the generated note before it is used. Naming approval as a distinct action after review is a small but meaningful precision, since it makes acceptance deliberate. No acceptance rate, edit burden figure or confidence threshold is published, and the clinical assistant answering medication and coding questions carries no described limits of its own.

Both performance claims are unfalsifiable as written: industry leading accuracy, which cites no comparison, and saving up to 50 percent of documentation time, which the up to construction satisfies at any value. No accuracy figure, model card, named models or evaluation methodology is published. The specialty vocabulary work described below is real capability rather than measurement.

Nothing in the chain is named. No model, model family or provider is disclosed, no hosting arrangement is published, and no subprocessor list is posted, though the vendor states that its subprocessor position is documented for a buyer's security review, which implies a list exists to be requested.

The product makes that absence weigh more than it would for a scribe alone. Alongside note generation the vendor runs a clinical assistant answering questions about drug interactions, contraindications and dosing, and an evidence tool returning cited answers from sources described only as trusted. Those are plausibly different workloads on different infrastructure, possibly from different providers, and none of them is identified. A buyer evaluating where an encounter goes is evaluating at least two paths and can see neither.

One boundary property is published: the vendor names the statutory deidentification methods it applies to any content used for improvement, so the treatment of content entering the chain is defined even though the parties receiving it are not.

Testimonials only, and unnamed ones, including a clinician reporting an hour long complex visit documented in two minutes. No study, controlled evaluation, accuracy benchmark, third party rating, named customer or deployment count is published.

The vendor names the deidentification methods it applies, and both are the recognized statutory routes: safe harbor and expert determination. That defines the word its commitment rests on.

Against that sit three statements about training, on three different pages, with nothing reconciling them. The homepage states plainly that patient data never trains the artificial intelligence. A security page describes how, for training and improvement, data is rigorously deidentified by one of those two methods. And the platform page markets a feature under which the system learns from each clinician's edits so generated notes need less cleanup over time.

All three can be technically true at once. Information deidentified by either statutory method is no longer protected health information and arguably no longer patient data, and adaptation to each user is a different thing again from training a shared model. But the reconciliation requires a reader to know the rule well enough to supply it themselves, and most clinicians buying this product very likely will not. A headline commitment that customer content never trains the model, sitting apart from a description of how customer content is prepared for training and a feature built on learning from customer edits, is materially misleading to the audience it is written for. Nothing puts what may be used, and for what, in one place.

Retention is configurable: the vendor describes it as aligning how long audio and text are kept with the customer's own policy. What is absent is a default: no stated window applies if a customer configures nothing, and no deletion commitment is published.

Business associate agreement terms are not published for inspection. Availability is published: the vendor states it readily enters into business associate agreements with covered entities, contractually obligating it to protect protected health information. It separately states that its data handling, subprocessors and agreement position are documented for a buyer's security review. So business associate status is acknowledged and the instrument is offered; what is unpublished is the agreement itself, its scope and whether it is gated by tier.

The supporting material is substantive rather than a badge. The vendor sets out privacy rule adherence, security rule implementation across administrative, physical and technical safeguards, named statutory de-identification methods, role-based access, audit logs and configurable retention, and claims adherence to both the United States health privacy rule and the Canadian federal privacy statute.

One feature of the commercial model creates a real exposure and it is the thing to act on. The product is self-serve on a seven-day free trial with direct sign-up links and no sales conversation. A covered entity can therefore begin putting patient information through it before any agreement exists, and under the United States rule that is the violation rather than a technicality. Nothing in the adoption path prompts the question, and the tier at which an agreement is actually executed is not stated.

No named or dated attestation exists. A dedicated security page describes the posture as enterprise grade, which names no standard and is an adjective rather than an assessment.

What is concrete is better than that heading suggests. The vendor names its encryption position in transit and at rest rather than saying encrypted, states that it readily enters into business associate agreements with covered entities, describes adherence to both the United States and Canadian federal privacy regimes, names the statutory de-identification methods it applies, and publishes single sign-on with the customer's own identity provider, role-based access limiting which staff can open which encounters, configurable retention, and audit-ready activity logs tracing who viewed, exported or edited a chart. It also maintains a data security practices article in its help center and states that its data handling, subprocessors and agreement position are documented for a buyer's security review.

Those are checkable commitments and a documented answer to a security questionnaire.

What is missing is anyone independent having examined any of it. No SOC 2 report of either type, no certification, no penetration testing statement and no trust portal.

The buyer profile is the reason to press rather than excuse. This product is sold self-serve on a free trial to solo practitioners and small practices alongside a quoted enterprise tier. A self-serve buyer has no procurement function, so nothing in the adoption path asks these questions, and published evidence is the only mechanism. The argument that a small vendor can defer certification because sophisticated buyers will ask directly does not hold where the model is designed so that most buyers never ask.

No clearance is claimed and none is required for documentation. No United States device pathway attaches to a note the clinician reviews, edits, approves and exports.

The substance here is the second product sold alongside the scribe. The vendor operates a clinical assistant described as answering questions about drug interactions, contraindications, evidence summaries, dosing and practical guidance, and a separate evidence tool returning cited medical answers. Answering a clinician's medication question is advice rather than record keeping. It sits in the territory occupied by clinical reference products, and the reasoning that keeps such tools outside device oversight depends on the professional being able to see and evaluate the basis of an answer before relying on it.

Citations are stated to be visible in the workflow, and the evidence tool is described as drawing on trusted sources. Showing the basis is the control that matters, and it is published.

What is not published is what those sources are. Trusted sources names nothing: whether the assistant draws on a curated and maintained clinical knowledge base, a licensed drug compendium, or a general model answering from training is undisclosed, and so is how current any of it is. Medication guidance ages: interaction data, contraindications and dosing change, and an answer generated from a static model with an undated source is a different object from a monograph lookup even when both show a citation.

The vendor markets risk adjustment coding explicitly, including surfacing hierarchical condition category opportunities for capitated arrangements.

Markets span the United States and Canada and the vendor names both federal privacy regimes, but no provincial position is stated.

The coding cues carry revenue capture framing, and the vendor's own platform and pricing pages show it. Risk-adjustment coding is marketed as a named capability: hierarchical condition category conditions are described as surfaced for value-based care and risk adjustment so that capitated arrangements reflect documented chronic burden, the tier comparison lists surfacing those opportunities as a feature, and the product interface displays a risk-adjustment factor outlook against documented burden. Surfacing risk-adjustment opportunities is the revenue gradient in its most direct form, because the score drives the payment.

That does not make the feature improper. Risk-adjustment documentation is a legitimate and widely used function, and tying it to what the encounter actually documented is the right way to build it. But it is a revenue capture feature, and it puts the vendor on the revenue gradient rather than outside it.

Beyond coding, no fairness statement, subgroup analysis, accent or dialect performance disclosure or evaluation methodology is published.

Three languages are named: full interface and transcription support in English, Spanish and French, set per document. What remains absent is any performance figure across those three, which is the thing that matters, since a product documenting a Spanish-language encounter and an English one is doing measurably different work.

The stated user base widens it. The vendor supports physicians, mental health clinicians, allied health professionals and clinical teams, and mental health sessions present harder acoustic and linguistic material: emotional speech, long silences, and terminology general models handle poorly.

The vendor states a three step sequence before a note is used: review, edit, then approve. Naming approval as a distinct action after review makes acceptance deliberate rather than passive. Separately it publishes audit ready activity logs that trace who viewed, exported or edited a chart, so a disputed note has a history attached to it.

Nothing stands behind the output. No accuracy or error figure is published, no limitations are stated, and no warranty, indemnity or remediation commitment is published. No route is described for a patient who finds an error.

Both performance claims are unfalsifiable as written, and they fail in different ways that read as equivalent. The claim of industry leading accuracy is a comparative assertion made without publishing a measurement of this product or of the products it is ranked against, so it claims a ranking that rests on nothing checkable. Saving up to 50 percent of documentation time is satisfied by any result at all, including none, so it commits the vendor to nothing while reading as a quantified benefit. Neither says where the system degrades or what to watch for.

The vendor demonstrates real domain understanding elsewhere in its material, and demonstration is not measurement: knowing that a phrase is ambiguous in a specialty shows the problem has been understood, not how often the system resolves it correctly.

Systems are named and the workflow is described; what they are not is integrations, and the vendor is direct about that.

What is published. A Chrome extension opens the product in a side panel beside the record system so an encounter can be documented without switching tabs. Finished notes are copied or exported as formatted text or PDF, and the vendor states plainly that this lets a clinician start closing charts without waiting for a custom integration. Epic, Cerner, athenahealth, OSCAR and TELUS PS Suite are named, but as systems clinicians use Wavo alongside rather than systems it connects to. Custom integrations and application programming interface access exist only in the quoted enterprise tier.

Documentation is produced inside this product and moved out by hand, so a second clinical record accumulates alongside the official one: visit history, patient dashboards, a longitudinal patient view, attachments and exports, with their own retention, access and export questions. Notes not transferred exist only here, and the vendor's environment holds the encounter for whatever interval elapses before the clinician moves it, with no institutional visibility of what was captured.

Exit is the open question rather than integration. Nothing published says which formats a full export uses, whether everything can be extracted at once rather than note by note, whether an export includes the accumulated patient context, or what happens to the store if the subscription lapses.

The vendor addresses data location directly, and the answer contains a hedge.

Its security material states that it is transparent about where data is stored, that data for United States clients is typically stored within the United States, and that specifics can be found in the agreement and terms of service. Pointing to the contract for the definitive answer puts the commitment where it becomes enforceable rather than aspirational.

Typically is the operative word. It signals that United States storage is the normal case rather than a guarantee, and it leaves unstated what the exceptions are, when they apply, and whether a customer is told. A residency commitment with an undefined exception is not one a privacy impact assessment can rely on.

The second gap follows from the vendor's own compliance claims. It states adherence to both the United States rule and the Canadian federal privacy statute and carries a Canadian compliance mark in its footer, so it very likely has Canadian customers. Nothing states where their data sits. A residency promise naming one jurisdiction establishes nothing about the others, and Canadian customers face provincial expectations that differ again by province.

The client side is well described: web, iOS, Android, a Chrome extension running beside the record system, and an installable web application, with configurable retention over how long audio and text are kept.

Also unresolved: no subprocessor list and no model provider. The vendor runs a clinical assistant answering medication questions alongside the scribe, so more than one workload may be involved and they may not sit in the same place.

Rates and tier figures are all published.

Three tiers are published with figures and a stated unit of charge, per user per month: Starter at $39 for up to 40 notes a month, Pro at $75 listed and $59 on a stated promotion, with $50 per user per month billed annually, and Intelligence at $89. A fourth Enterprise tier is quoted rather than priced, which is normal and does not obscure the published range. Every plan starts with a seven-day free trial and each tier has a direct sign-up link, so a buyer can begin without speaking to anyone.

A full feature comparison matrix sets out what each tier includes and, more usefully, what it excludes. Visit preparation, the clinical assistant, patient dashboards, the longitudinal patient view, ICD-10 suggestions, evaluation and management support and risk-adjustment coding all sit at Intelligence, not at Pro. Single sign-on, access controls, custom integrations and API access sit only at Enterprise. A buyer can therefore see before contact that the documentation product and the clinical intelligence product are different purchases.

That gating is a matter of fit rather than a criticism. The tier most clinicians will price is Pro, and several capabilities the marketing foregrounds are one tier above it.

Two questions the published page does not settle. Whether the promotional Pro rate reverts to the list figure and when, and what the currency and rate are outside the United States, since the sign-up links carry a country parameter and the company operates in Canada as well.

Specialty depth is specified at the level of the instruments clinicians actually use, which is the mark of real work rather than a template count. Rheumatology support documents tender and swollen joint counts and assists with DAS28, CDAI and RAPID3, which are validated disease activity instruments rather than note headings. Oncology handles TNM staging, chemotherapy, radiation and immunotherapy regimens, and tumor board summaries. Internal medicine reaches inpatient territory with admission histories and physicals, daily progress notes, discharge summaries and transitions of care. Gastroenterology and physical therapy with functional outcomes are also covered.

The vendor markets template sets built for more than 80 specialties, a count claim with no instrument level detail behind it, and nothing says which of the 80 have the depth described and which are a heading set. The specialty pages the site leads with are weighted toward primary care and mental health: family medicine, internal medicine, psychiatry, mental health, psychiatric nurse practitioners, psychology, physician assistants, nurse practitioners, emergency, urgent care, hospital medicine and allied health. Rheumatology and oncology are not among them. The marketed center of gravity appears to have moved, and nothing published says whether the rheumatology and oncology support described above is still maintained.

Language coverage is published: full interface and transcription support in English, Spanish and French, set per document. No performance figure across the three is given.

Settings span clinic, hospital, home and between rooms, with web, iOS, Android, a browser extension and an installable web app.