Weave

A decade old communications and payments business that has moved artificial intelligence to the centre of its product direction, and the movement is recent enough to be visible. The underlying asset is distribution: a practice telephone system, texting, forms, payments and review management running across roughly 40,000 customer locations, with authorised connections into the practice management systems those locations run.

The models arrived on top of that, through a 2024 platform rebuild and then a 2026 receptionist that handles patient conversations across voice and text. Two things hold this at B rather than A. The reasoning engine belongs to Google, since the receptionist is built on that company's enterprise agent platform, which makes this the seventh instance in this index of an established vendor placing somebody else's model inside a distribution position it already owned.

And the payments and telephony business would continue to function without any of it. Two things keep it above C: the agent is doing substantive work rather than decorating a workflow, and the company's own self description has genuinely shifted rather than merely relabelling.

The receptionist answers patients on its own and hands over deliberately. The design point the company emphasises is continuity rather than automation volume: context is preserved across channels and sessions so a patient who begins on the phone and continues by message is not asked to repeat themselves, and the transition from agent to staff happens inside one workflow rather than as a restart.

That is the correct thing to engineer, because the handoff is where these products usually fail the patient. The company also states that enterprise customers are asking for more visibility into how the artificial intelligence is performing, and has responded with control and visibility features, which is an oversight responsive product direction rather than a published oversight model.

Held at B because no escalation criteria, no handling of a clinical concern raised during a scheduling call, and no disclosure practice about whether patients know they are speaking to an agent were located.

One disclosure here is worth more than it first appears: the company names the model platform underneath its agent. Across two source lists covering more than fifty conversation and voice vendors in this index, almost none says whose models it is using, and the subprocessor question that follows has had to be raised as an unanswered ask on record after record. Weave answers it in its own announcement. That is real transparency and it is credited.

Everything else is absent: no accuracy figures, no validation methodology, no description of what the healthcare specific layer above the general model actually contains, and no published evaluation of the receptionist against the staff it replaces. Naming your supplier tells a buyer where the data goes; it does not tell them how well the thing works.

One disclosure here is worth more than it first appears: the company names the model platform underneath its agent, in its own announcement. Across two source lists covering more than fifty conversation and voice vendors in this index, almost none says whose models it is using, and the sub processor question has had to be raised as an unanswered ask on record after record.

Naming the platform changes the buyer's position materially, because it makes the next question askable rather than speculative: a health system can now go and read the model provider's own enterprise terms, establish what that provider says about retention and training by default, and ask this vendor which of those terms its configuration actually uses. That is a different situation from not knowing who to ask about. The answer is not published.

Nothing states which terms govern the flow, whether content is excluded from the provider's own training, where it is retained, or what else sits in the path, and no retention schedule, minimisation statement or position on whether patient conversations improve models was located. The naming makes the question askable; it does not answer it, and this index has recorded that a model provider's default posture is not a commitment from the party a customer contracts with. Ask which terms govern, for the training exclusion in writing, and for the rest of the sub processor chain.

Deployment scale is large and unusually verifiable, and performance evidence is absent. Roughly 40,000 customer locations is a figure stated by a company subject to securities disclosure obligations, which makes it materially more reliable than the same claim from a private vendor, and third party recognition exists in the form of a 2026 software award for healthcare products.

The company also publishes its own survey research on practice staffing pressure, which is industry insight rather than product evidence. What was not located in two passes is any measurement of the artificial intelligence itself: no call resolution rate, no containment figure, no accuracy measure, no comparison against the front desk staff whose work it absorbs, and no independent evaluation. Scale of use does not substitute for evidence of benefit, and that gap is the same for the largest vendor in this segment as for the smallest.

The company states that the platform is designed for secure and reliable operation that protects patient data and supports HIPAA compliance, and two passes located no detail beneath that: no retention schedule, no minimisation statement and no position on whether patient conversations are used to improve models. The specific question created by the architecture is more answerable here than usual precisely because the supplier is named.

Patient voice and message content is being processed through a third party model platform, and what a buyer needs to know is which terms govern that flow, whether content is excluded from the provider's own training, and where it is retained. The naming makes the question askable; the answer is not published.

The company states that the platform supports HIPAA compliance, and business associate agreements certainly exist across a customer base of this size. Two passes located no agreement terms, privacy page or subprocessor list. The subprocessor point is not theoretical for this vendor: an agent built on an external model platform means a second organisation is processing patient communication, and a practice signing with Weave should establish in writing that the obligations flow through to that provider. Practices of the size Weave serves are the least equipped to run that check themselves, which is an argument for publishing rather than for leaving it to procurement.

Two passes located no SOC 2 report, no HITRUST, no ISO 27001 and no trust centre. What exists instead is product security investment described in company announcements, including single sign on desktop authentication and stronger controls introduced for enterprise customers in 2026, which is security engineering rather than third party attestation.

One structural point separates this record from the private companies graded alongside it: as a company listed on a public exchange, Weave is subject to securities disclosure obligations covering cybersecurity risk management and material incidents, so a buyer has a route to information that no private vendor in this segment offers, even though it is not the attestation a procurement team would normally ask for. Graded C on that basis rather than lower.

No clearance, authorisation or submission located and none needed. Scheduling, reminders, insurance capture and payment collection are administrative. Three other regulatory frames apply and none is device law: automated outbound patient contact falls under telephone consumer protection rules; payment processing brings card industry security requirements; and insurance eligibility verification operates inside payer contracting. A buyer assessing this product against a device framework would be examining the wrong law, which is now the consistent finding across every record in this segment.

Nothing published. No subgroup performance, no bias testing methodology, no model card and no drift monitoring concept was located, and this is the tenth record in this index to carry the speech and language variation exposure unexamined while operating on patient conversations.

The scale makes it the most consequential instance so far in simple arithmetic terms: an agent answering the telephone across roughly 40,000 practice locations encounters every accent, dialect and first language in the country, and a caller the system understands less well waits longer, is routed less accurately or gives up.

The company's own statement that enterprise customers want more visibility into artificial intelligence performance shows the demand exists; publishing that performance broken down by caller population is the version of it that would matter most and is not offered.

Two passes located no accuracy figures, no validation methodology, no description of what the healthcare specific layer above the general model actually contains, no containment or transfer rate and no warranty, indemnity or remediation commitment. The missing comparator is the one that matters and it is unusually well defined here.

The product is presented as a receptionist, so the honest evaluation is against the staff member it replaces: how often does it take the message correctly, how often does it route to the right place, how often does a caller give up. Those are all measurable, a practice already knows its own baseline, and no published evaluation against that baseline exists.

Naming your supplier tells a buyer where the data goes; it does not tell them how well the thing works, and that distinction decides this grade. The healthcare specific layer is the part that would justify choosing this over a general assistant, and with no description of what it contains a buyer cannot tell whether it is a prompt, a rules layer, a fine tune or a set of integrations, which are four very different things with four different failure modes. Ask what the healthcare layer consists of, for containment and transfer rates, for accuracy on message taking and routing, and for a comparison against the practice's own current performance.

Deep in the systems that matter for this buyer, which are practice management systems rather than hospital record systems. The company describes authorised integrations that drive scheduling, insurance eligibility verification and payment collection, which is bidirectional operational integration rather than data display, and it is running across roughly 40,000 locations spanning dental, optometry, veterinary and medical practice software, a fragmented market where each connection is separately negotiated and separately maintained.

That breadth is genuinely hard to assemble and is the company's most defensible asset. Held at B rather than A because no current list of named systems, no interoperability standard and no implementation detail was located in this assessment.

A hosted service with a named cloud provider underneath the agent layer, which is more than most vendors in this segment disclose, and no hosting region, architecture description or residency commitment located. The relevant question for this product is where voice recordings and message content sit and for how long, since the platform is both a telephone system and a messaging system, so it holds the content of patient conversations rather than merely metadata about them. Nothing published distinguishes what is retained from what is processed and discarded.

The only company assessed across two contact centre source lists that is listed on a public exchange, and the listing does real work for a buyer. Audited financial statements, quarterly reporting, customer location counts stated under securities liability rather than as marketing, and executive commentary on the record at investor conferences give a purchasing practice a view of supplier durability that no private vendor in this segment can match, and durability matters here because a practice adopting this replaces its telephone system.

Third party coverage places entry pricing in the region of several hundred dollars per month, though a published price schedule was not confirmed firsthand in this assessment. Held at B rather than A because Artrya remains the benchmark for publishing the pricing mechanism, the rate and its own concentration risk together, and because financial transparency about the company is not the same as price transparency about the product.

Wide within a deliberately chosen band. The customer is the small and medium practice rather than the health system, concentrated in dental and optometry with medical and veterinary practices alongside and a growing multi location enterprise segment, across roughly 40,000 locations.

Functionally it spans the whole front office: inbound and outbound calling, texting, scheduling, digital forms, insurance capture, payment collection and review management, which is more of the operational surface than most vendors attempt and makes the platform hard to remove once installed.

One scoping note for readers of this index: veterinary practices are part of the customer base and are not human healthcare, so a share of the deployment figure sits outside the scope this index otherwise covers. Geography is the United States.