Original research · Free with attribution

    The ANZ Health AI Vendor Trust Tracker

    What AI voice and ambient-scribe vendors serving Australian and New Zealand healthcare have published on their own public pages about data residency, model provenance, subprocessors, certifications and regulatory status — with a source URL on every entry and a verbatim quote wherever the vendor published one.

    Read this first: This tracker records only what each vendor has published on its own public pages. It is not an assessment, audit, certification or endorsement. Vendors change their documentation — always verify directly before making a procurement decision.
    Vendors tracked
    39
    Facts recorded
    406
    Sources cited
    169
    Last checked
    25 Sept 2026
    Why this exists

    Storage region and processing region are not the same thing.

    Data storage region and data processing / inference region are frequently different in AI systems. Storage and processing locations can both matter for cross-border obligations under APP 8 and the New Zealand Health Information Privacy Code. This is general information, not legal advice.

    This tracker records both separately wherever a vendor publishes them, and shows a verbatim quote from the vendor's own page so you can read exactly what they said.

    What we track
    • Data storage region
    • Data processing region
    • Model provenance
    • Subprocessors
    • Certifications
    • TGA status
    • PMS integrations
    • ANZ entity
    • Support hours

    A vendor can have multiple entries for the same field with different sources. We do not pick a winner — every source stands on its own.

    Filter39 of 39 vendors · sorted alphabetically
    AbridgeAmbient scribe· HQ US
    Data storage region
    Not found on public pages
    Data processing region
    United States, plus countries where Abridge's service providers are located
    Model provenance
    Vendor presents its Contextual Reasoning Engine as 'leading healthcare AI infrastructure'…
    Subprocessors
    Trust centre's Data Service Vendors table lists 13 vendors, each with a purpose and a US…
    Certifications
    SOC 2 Type 1, SOC 2 Type 2, HIPAA, CCPA and TX-RAMP listed on trust centre
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    AiDialVoice agent· HQ AU
    Data storage region
    Privacy policy states servers are primarily hosted within Australia; the same policy stat…
    Data processing region
    Australia, as stated on the healthcare product page.
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    Not found on public pages
    TGA status
    Not found on public pages
    PMS integrations
    Integrations page names Halaxy, Cliniko and PracSuite under healthcare practice managemen…
    ANZ entity
    DIGITALON Pty Ltd trading as AiDial, ABN 64 630 163 469.
    Support hours
    Not found on public pages
    Open all sources
    Amazon Connect (Amazon Web Services)Contact centre (CCaaS)· HQ US
    Data storage region
    Amazon Connect listed as available in Asia Pacific (Sydney), ap-southeast-2, with endpoin…
    Data processing region
    Amazon Connect AI agents documentation states that cross-region inference automatically s…
    Model provenance
    Generative AI-powered post-contact summaries stated to be built on Amazon Bedrock. No ind…
    Subprocessors
    Public AWS sub-processor page published, organised into AWS infrastructure entities, AWS…
    Certifications
    AWS lists Amazon Connect on its Services in Scope by Compliance Program page for IRAP.
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    AWS Contracting Party for Australia stated as Amazon Web Services Australia Pty Ltd (ABN:…
    Support hours
    Basic Support stated as 24/7 access to customer service, documentation, whitepapers and A…
    Open all sources
    Ambience HealthcareAmbient scribe· HQ US
    Data storage region
    Privacy policy says information collected through its websites may be processed and store…
    Data processing region
    Privacy policy says information collected through its websites may be processed and store…
    Model provenance
    Not found on public pages
    Subprocessors
    Website analytics/advertising service providers named in privacy statement: Google Analyt…
    Certifications
    Not found on public pages
    TGA status
    Not found on public pages
    PMS integrations
    Epic, Athena, Cerner (patient schedule sync stated on products page)
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    AnthropicFoundation model· HQ US
    Data storage region
    Privacy policy says personal data is transferred to servers in the US, or to other countr…
    Data processing region
    Privacy policy says personal data is transferred to servers in the US or other countries…
    Model provenance
    Anthropic's own Claude model family; model reports incl. training-data description publis…
    Subprocessors
    Subprocessor list published at trust.anthropic.com/subprocessors (linked from privacy pol…
    Certifications
    ISO/IEC 42001:2023 accredited certification (AI management system), announced Jan 2025
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    No ANZ entity listed; Commercial Terms name Anthropic Ireland, Limited (EEA/Switzerland/U…
    Support hours
    Not found on public pages
    Open all sources
    AutoMed SystemsPlatform / infrastructure· HQ AU
    Data storage region
    Privacy policy states all SMS message data is stored within Australia
    Data processing region
    Not found on public pages
    Model provenance
    Not found on public pages
    Subprocessors
    Tier 1 Australian-based SMS provider (not named)
    Certifications
    Australian Privacy Principles / Privacy Act 1988 (Cth) adopted
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    AutoMed Systems Pty Ltd (ABN 69 614 929 476)
    Support hours
    Not found on public pages
    Open all sources
    Cisco Webex Contact CenterContact centre (CCaaS)· HQ US
    Data storage region
    Tenant created in the data center closest to the Country of Operation selected in the set…
    Data processing region
    The regional Data Security, Privacy and Residency article retrieved (Singapore region var…
    Model provenance
    Microsoft named as the third-party model provider for Webex generative AI features; Azure…
    Subprocessors
    ElevenLabs and Deepgram named as sub-processors for certain speech and transcription task…
    Certifications
    Webex stated as ISO/IEC 27001:2013 certified. The same page addresses GDPR and states Web…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    Cognigy (NiCE Cognigy)Voice agent· HQ DE
    Data storage region
    Documentation lists SaaS clusters by region: Europe (app.cognigy.ai), US (app-us.cognigy.…
    Data processing region
    Not found on public pages
    Model provenance
    Documentation lists selectable LLM providers: Platform-Provided LLM, Azure OpenAI, OpenAI…
    Subprocessors
    Not found on public pages
    Certifications
    Vendor announced completion of a SOC 2 Type II audit performed by KirkpatrickPrice (annou…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    CortiAmbient scribe· HQ DK
    Data storage region
    EU or US hosting options, stated with no cross-border transfer
    Data processing region
    EU subprocessor list (last updated 7 August 2026) says Scaleway (France, the Netherlands,…
    Model provenance
    Corti states its models are trained only on healthcare data
    Subprocessors
    US subprocessor list (last updated 7 August 2026). Corti API: Microsoft Azure (United Sta…
    Certifications
    Safety page states Corti's security meets or exceeds market and regulatory requirements,…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    CoviuPlatform / infrastructure· HQ AU
    Data storage region
    No Australia-specific storage statement found on the pages checked; privacy policy says i…
    Data processing region
    Third parties may store, transfer or access personal information outside the United State…
    Model provenance
    Third-party AI technologies used for transcription and transcript summarisation; provider…
    Subprocessors
    AWS (hosting); PostHog, AppCues, SparkPost, Twilio, HubSpot, Stripe also named as service…
    Certifications
    Business Associate Agreements available to eligible customers (HIPAA)
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Coviu Global Pty Ltd (ABN 22 608 925 060)
    Support hours
    Not found on public pages
    Open all sources
    Curious ThingVoice agent· HQ AU
    Data storage region
    No single storage region stated. Privacy policy states information may be transferred, pr…
    Data processing region
    No single processing region stated. Same clause states information may be transferred, pr…
    Model provenance
    ChatGPT named as powering the 'Alex' FAQ voice AI agent, combined with the company's own…
    Subprocessors
    Not found on public pages
    Certifications
    Vendor states ISO 27001 and SOC 2 certification and GDPR and HIPAA compliance. No certifi…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Curious Thing Pty Ltd, Level 2, 477 Pitt Street, Sydney NSW 2000.
    Support hours
    Not found on public pages
    Open all sources
    DecagonVoice agent· HQ US
    Data storage region
    Not found on public pages
    Data processing region
    US-headquartered; personal information may be transferred to the United States or other l…
    Model provenance
    Vendor states zero-day retention with all AI providers, such as OpenAI and Anthropic, so…
    Subprocessors
    No public subprocessor list found; Google's DLP service named for PII redaction
    Certifications
    Vendor states SOC 2 Type II compliance and HIPAA options. Security page additionally disp…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    Five9Contact centre (CCaaS)· HQ US
    Data storage region
    Five9 states recordings can be kept in the customer's Core Edge (a home region running th…
    Data processing region
    Five9 states agents connect to the closest Voice Edge point of presence, keeping call pat…
    Model provenance
    Five9 Agent Assist 2.0 with AI Summary stated as powered by OpenAI.
    Subprocessors
    A 'Subprocessor DPA' is published on the legal DPAs page; no public named subprocessor li…
    Certifications
    Trust page states '88 Certifications' as a metric; individual certifications are not item…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Five9 Support stated as available 24 hours per day, 365 days per year.
    Open all sources
    GenesysContact centre (CCaaS)· HQ US
    Data storage region
    Deployed in a customer-assigned AWS core region; Asia Pacific (Sydney) ap-southeast-2 is…
    Data processing region
    Transient recording file processing (encryption/decryption for playback, export) stated t…
    Model provenance
    Genesys Agent Copilot stated to use a combination of Genesys native models and AWS Bedroc…
    Subprocessors
    Privacy policy links to a sub-processor list that Genesys states it keeps up to date
    Certifications
    Listed under Authorizations: IRAP Protected (also FedRAMP, GovRAMP, TX-RAMP, DoD Impact L…
    TGA status
    Not found on public pages
    PMS integrations
    Health CX stated as a native integration between the Genesys Cloud platform and the Epic…
    ANZ entity
    Offices listed for Australia (Sydney: WeWork, Level 1, 1 Sussex Street, Barangaroo, NSW 2…
    Support hours
    My Support Web Portal, Phone Support, Resource Center and eLearning stated as 24x7x365. R…
    Open all sources
    Google (Gemini / Cloud AI)Foundation model· HQ US
    Data storage region
    Customer-selected Google Cloud location for data at rest (Gemini Enterprise Agent Platfor…
    Data processing region
    Customer choice of jurisdictional multi-region endpoints (e.g. United States, European Un…
    Model provenance
    Google's own Gemini model family; Google states Gemini for Google Cloud does not use prom…
    Subprocessors
    Third-party and Google-group subprocessor lists published for Google Cloud Platform servi…
    Certifications
    Google Cloud compliance offerings incl. ISO/IEC 27001, 27017, 27018, 27701, 42001, SOC 1/…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Google Australia Pty Ltd listed as Google Cloud contracting entity for Australia; Google…
    Support hours
    Not found on public pages
    Open all sources
    HealthEngineVoice agent· HQ AU
    Data storage region
    Vendor states secure servers in Australia; its policy says some service providers may sto…
    Data processing region
    Vendor states it may disclose limited personal information to third-party service provide…
    Model provenance
    Privacy policy names OpenAI, LiveKit, Langfuse, ClickSend and Twilio among third-party se…
    Subprocessors
    Braze, Inc. (customer engagement) hosts and processes primarily in the United States; pol…
    Certifications
    Vendor states it earned ISO 27001 certification for Information Security Management Syste…
    TGA status
    Not found on public pages
    PMS integrations
    Best Practice and Pracsoft, stated on the Helen product page as the only compatible syste…
    ANZ entity
    Healthengine Limited (ACN 138 767 021), Australia
    Support hours
    Not found on public pages
    Open all sources
    Heidi HealthAmbient scribe· HQ AU
    Data storage region
    Australia — vendor states all its data is locally hosted within Australia (AU compliance…
    Data processing region
    Not found on public pages
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    ISO 27001, ISO 42001, SOC 2 stated as credentials; regional regulatory requirements state…
    TGA status
    Not found on public pages
    PMS integrations
    Named on vendor integrations page: Athenahealth, Gentu, MedicalDirector, MediRecords, Bes…
    ANZ entity
    Heidi Health Trading Pty Ltd, ABN 84 649 783 871, Level 30, 360 Elizabeth Street, Melbour…
    Support hours
    Not found on public pages
    Open all sources
    HotDocPlatform / infrastructure· HQ AU
    Data storage region
    Australia (hosted on AWS in Australia)
    Data processing region
    Australia (stored and processed within Australia per security page)
    Model provenance
    Not found on public pages
    Subprocessors
    Privacy policy says all personal information is hosted and stored on HotDoc's Australian…
    Certifications
    SOC 2 Type II accreditation; compliance with Australian Privacy Principles and Privacy Ac…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    HotDoc Online Pty Ltd (ABN 84 159 662 558)
    Support hours
    Not found on public pages
    Open all sources
    Data storage region
    Australia — stated as exclusive storage location for patient health information, audio, t…
    Data processing region
    Australia — vendor states processing occurs exclusively within Australia and that all AI…
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    Vendor states ISO/IEC 27001:2022 certification, certificate number 1446-I-1, issued 24 Ap…
    TGA status
    Vendor states the product does not meet the definition of Software as a Medical Device (S…
    PMS integrations
    Named by vendor: Gentu (Magentus) live, Genie Solutions live, S4S / Shexie, BP VIP.net, D…
    ANZ entity
    Akuru Pty Ltd, ACN 673 517 578, ABN 66 673 517 578, incorporated in Australia, headquarte…
    Support hours
    Vendor's llms.txt states all customer support is onshore in Australia and New Zealand; no…
    Open all sources
    iMedXAmbient scribe· HQ US
    Data storage region
    Privacy policy says personal information collected through the Australian site is transfe…
    Data processing region
    Not found on public pages
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    Not found on public pages
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    iMedX Australia Pty. Ltd. (ABN 30 609 113 868)
    Support hours
    Not found on public pages
    Open all sources
    IntelliTek HealthPlatform / infrastructure· HQ AU
    Data storage region
    Not found on public pages
    Data processing region
    Not found on public pages
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    Homepage states it is HIPAA-compliant; no linked privacy policy, security page or trust c…
    TGA status
    Not found on public pages
    PMS integrations
    MedicalDirector Clinical, Medtech, Profile (named Clinical Virtual Assistant integrations…
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    Lyngo AIVoice agent· HQ AU
    Data storage region
    No single storage region stated. The published sub-processor list names Microsoft Corpora…
    Data processing region
    No single processing region stated. The sub-processor list gives Location: United States…
    Model provenance
    Anthropic PBC and OpenAI, LLC listed for AI Language Model Services; Deepgram, Inc. for S…
    Subprocessors
    Published list of 19 named sub-processors (article dated February 9, 2026). Infrastructur…
    Certifications
    Privacy policy says it takes into account the requirements of the Privacy Act 1988 (Cth)…
    TGA status
    Not found on public pages
    PMS integrations
    Vendor states Lyngo integrates directly with Cliniko, Nookal, PracSuite and Splose via AP…
    ANZ entity
    Sydney office address published: 24 Campbell Street, Haymarket, Sydney NSW 2000, Australi…
    Support hours
    Not found on public pages
    Open all sources
    Lyrebird HealthAmbient scribe· HQ AU
    Data storage region
    Australia (all patient data)
    Data processing region
    Vendor states all patient data is processed in Australia
    Model provenance
    Azure OpenAI (Microsoft) stated for language processing; Deepgram and Whisper stated for…
    Subprocessors
    Named in privacy policy: Azure OpenAI (Microsoft), Deepgram, Whisper, AWS, Supabase, Sent…
    Certifications
    Alignment with APP, HIPAA and GDPR stated on compliance page; encryption in transit and a…
    TGA status
    Not found on public pages
    PMS integrations
    Named on vendor integrations page: Bp Premier (Best Practice), BetterConsult, Cubiko, Epi…
    ANZ entity
    Subsidio Pty Ltd, ABN 57 668 121 248 (named as the policy owner entity in the Lyrebird He…
    Support hours
    Not found on public pages
    Open all sources
    Medow Health AIAmbient scribe· HQ AU
    Data storage region
    Australia for Australian and New Zealand healthcare providers; Singapore and UAE hosting…
    Data processing region
    Privacy policy states third-party automated transcription services may be provided from t…
    Model provenance
    Not found on public pages
    Subprocessors
    Microsoft Azure (infrastructure); unnamed third-party transcription suppliers (USA), supp…
    Certifications
    ISO 27001 certified; compliance stated with Privacy Act 1988/APPs (AU), Privacy Act 2020/…
    TGA status
    Not found on public pages
    PMS integrations
    Genie, Gentu, Elixir, Shexie, MediTech (named on trust page)
    ANZ entity
    Medical Minds AI Pty Ltd (ACN 671 845 828)
    Support hours
    Not found on public pages
    Open all sources
    Meta (Llama)Foundation model· HQ US
    Data storage region
    Not found on public pages
    Data processing region
    Not found on public pages
    Model provenance
    Meta's own Llama open-model family (Llama 3, Llama 4); Llama 4 model card publishes a tra…
    Subprocessors
    Not found on public pages
    Certifications
    Not found on public pages
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    Microsoft Azure AIPlatform / infrastructure· HQ US
    Data storage region
    Azure Speech: data is stored only in the region where the Speech resource was created. Au…
    Data processing region
    Azure Speech: processing occurs only in the region of the Speech resource. Australia East…
    Model provenance
    Foundry 'models sold by Azure' includes Azure OpenAI models. Azure Speech region tables a…
    Subprocessors
    Microsoft publishes a Microsoft Online Services Subprocessors List identifying subprocess…
    Certifications
    ISO/IEC 27001 and HITRUST CSF: BAA-covered Microsoft services are audited by accredited i…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    MICROSOFT PTY LTD, ABN 29 002 589 460, Australian Private Company, ABN active from 01 Apr…
    Support hours
    Published response-time targets on paid plans include: Minimal business impact (Sev C) wi…
    Open all sources
    Microsoft Dragon CopilotAmbient scribe· HQ US
    Data storage region
    Data at rest by customer location: US->US; Canada->Canada; UK->UK; France/Ireland/Belgium…
    Data processing region
    EU customer data stored and processed within the EU Data Boundary (Dragon Copilot is an '…
    Model provenance
    Microsoft states Dragon Copilot's AI/ML models are trained solely on anonymized data (cus…
    Subprocessors
    Disclosed in Microsoft's Health and Life Sciences Subprocessor list on the Service Trust…
    Certifications
    Azure-platform compliance cited in Dragon Copilot security white paper: HITRUST CSF, HIPA…
    TGA status
    Not found on public pages
    PMS integrations
    EHR integration offered via 'Dragon Copilot embedded' (EHR partners integrate capabilitie…
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    Mistral AIFoundation model· HQ FR
    Data storage region
    Not found on public pages
    Data processing region
    No region stated; Mistral states it prioritises providers within the European Union adher…
    Model provenance
    Own Mistral model family; EU AI Act (GPAI) model documentation hub published on legal.mis…
    Subprocessors
    Subprocessor list published in the Mistral Trust Center (trust.mistral.ai/subprocessors),…
    Certifications
    Not found on public pages
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    None listed; Mistral AI is a French company with registered offices at 15 rue des Halles,…
    Support hours
    Not found on public pages
    Open all sources
    NablaAmbient scribe· HQ FR
    Data storage region
    US clients: US regions on Google Cloud (GCP); all other clients: EU Google (GCP) data cen…
    Data processing region
    GCP infrastructure hosting: Central Region (USA) and Belgium (all non-USA); Azure speech-…
    Model provenance
    Publishes an AI Model Card (CHAI version 2); external model providers not named on trust…
    Subprocessors
    Core vendors listed on trust centre: Google Cloud (infrastructure hosting), Azure (speech…
    Certifications
    Vendor states it follows HIPAA, GDPR, SOC 2, ISO 27001 and NIST cybersecurity standards f…
    TGA status
    Not found on public pages
    PMS integrations
    Epic — Nabla states it was added to Epic Toolbox for Ambient Voice Recognition and can be…
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    OpenAIFoundation model· HQ US
    Data storage region
    Configurable via data residency controls (eligibility-gated): customer content stored at…
    Data processing region
    Default processing location not stated; with data residency controls, inference runs in t…
    Model provenance
    OpenAI states data sent to its API is not used to train or improve its models unless the…
    Subprocessors
    Not found on public pages
    Certifications
    SOC 2 Type 2 report; ISO 27001, 27017, 27018 and 27701 certified (per OpenAI Trust Portal)
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    PatientNotesAmbient scribe· HQ AU
    Data storage region
    EU and US regions; Australian-region hosting via AWS Sydney available for practices that…
    Data processing region
    Not found on public pages
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    HIPAA compliance stated (BAAs signed with paid customers); compliance with Australian Pri…
    TGA status
    Not found on public pages
    PMS integrations
    Vendor lists Best Practice and MedicalDirector (copy-paste + browser extension), Genie an…
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    PolyAIVoice agent· HQ GB
    Data storage region
    Platform documentation states a workspace lives in exactly one region, with matching Stud…
    Data processing region
    Not found on public pages
    Model provenance
    Vendor states it uses Amazon SageMaker to train and fine-tune speech recognition, LLM and…
    Subprocessors
    Not found on public pages
    Certifications
    Vendor states it is certified for ISO/IEC 27001, the international standard for informati…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    SierraVoice agent· HQ US
    Data storage region
    General privacy policy states personal information may be transferred, processed and stor…
    Data processing region
    General privacy policy states personal information may be transferred, processed and stor…
    Model provenance
    Vendor states agents are built on a combination of frontier, open-weight and proprietary…
    Subprocessors
    Not found on public pages
    Certifications
    Vendor states it is committed to maintaining compliance standards including SOC 2, HIPAA,…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    Sophiie AIVoice agent· HQ AU
    Data storage region
    Not found on public pages
    Data processing region
    Not found on public pages
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    Privacy policy states the company maintains alignment with ISO 27001 compliance standards…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Sophiie AI Pty Ltd, ACN 679 849 453. Office address stated on contact page: Suite 6A, 50…
    Support hours
    Mon-Fri 9am to 5pm, stated on the contact page next to sales and existing-customer suppor…
    Open all sources
    SukiAmbient scribe· HQ US
    Data storage region
    Privacy policy says personal data may be transferred to company and authorised third-part…
    Data processing region
    Not found on public pages
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    SOC 2 Type 2 certified and HIPAA compliant (stated on website)
    TGA status
    Not found on public pages
    PMS integrations
    EHR integrations: Epic, Oracle Health, athenahealth, MEDITECH
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    T-ProAmbient scribe· HQ IE
    Data storage region
    Not found on public pages
    Data processing region
    Not found on public pages
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    Not found on public pages
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    TortusAmbient scribe· HQ GB
    Data storage region
    United Kingdom / EU (London region) - Google Cloud storage of consultation audio and acco…
    Data processing region
    Privacy policy states transcript text is processed by OpenAI via the provider's EU endpoi…
    Model provenance
    OpenAI models generate draft clinical notes, letters and suggested clinical codes from co…
    Subprocessors
    Google Cloud (Google Cloud Platform), OpenAI, Auth0 (by Okta), Datadog
    Certifications
    ISO 13485; UKCA Class IIa Medical Device; NHS DTAC; ISO 27001 ISMS also referenced in pri…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Not found on public pages
    Support hours
    Not found on public pages
    Open all sources
    VoiceStackVoice agent· HQ US
    Data storage region
    Privacy policy says information may be stored and processed in the US, where its servers…
    Data processing region
    May be processed in the US, per policy
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    Website states certification against Australian Privacy Principles, HIPAA standards, SOC…
    TGA status
    Not found on public pages
    PMS integrations
    Vendor states native hooks for PMS, CRM and BI; offers to confirm certified connectors fo…
    ANZ entity
    Good Methods Pty Ltd, ACN 664 796 310, Level 6, 200 Adelaide Street, Brisbane City, Queen…
    Support hours
    Support via chat, email and phone; named Customer Success Manager for multi-site groups a…
    Open all sources
    VoxworksVoice agent· HQ AU
    Data storage region
    Amazon Web Services Sydney (ap-southeast-2) region, stated for platform storage including…
    Data processing region
    Not found on public pages
    Model provenance
    Not found on public pages
    Subprocessors
    Not found on public pages
    Certifications
    Security documentation states the company aligns its security practices with ISO 27001; n…
    TGA status
    Not found on public pages
    PMS integrations
    Not found on public pages
    ANZ entity
    Voxworks Technologies Pty Ltd, stated as incorporated and headquartered in Australia; ABN…
    Support hours
    Not found on public pages
    Open all sources

    Values shown are truncated for the matrix. Click any cell to see the full statement, the verbatim quote from the vendor's page, the source URL, and the date checked.“Not found on public pages” — We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere.

    Change log

    Recent changes

    When a vendor's page or our summary of it changes, we record the old and new values with both check dates.

    • Abridge·Subprocessors26 Sept 2026
      Was — checked 2026-08-13
      Trust centre lists 'Data Service Vendors': Zendesk, Amplitude, Sentry, OpenAI, Google Cloud (names displayed as labels/logos; no per-vendor purpose text)
      Now — checked 2026-09-25
      Trust centre's Data Service Vendors table lists 13 vendors, each with a purpose and a US location: Google Cloud (cloud hosting), OpenAI and Anthropic (interim text summarization), Microsoft Azure (backup OpenAI model hosting), Baseten (running Abridge-created models), LiveKit (verbatim voice stream support), Temporal (encounter processing orchestration), Sentry (application performance monitoring and error tracking), Amplitude (application analytics), Zendesk (user support), Braze (user support and messaging), Sigma Computing (data management and analytics) and dbt Labs (data handling). The table notes PHI and/or PII involvement for every vendor except Temporal.
      Source
    • Abridge·Model provenance26 Sept 2026
      Was — checked 2026-08-13
      Proprietary 'Contextual Reasoning Engine' AI framework described on Abridge's site; specific model providers not stated on that page (OpenAI appears on the trust centre vendor list)
      Now — checked 2026-09-25
      Vendor presents its Contextual Reasoning Engine as 'leading healthcare AI infrastructure'; the page names no model providers. Separately, the trust centre's Data Service Vendors table lists OpenAI and Anthropic for interim text summarization, Microsoft Azure for backup OpenAI model hosting and Baseten for running Abridge-created models.
      Source
    • Corti·Certifications26 Sept 2026
      Was — checked 2026-08-13
      HIPAA, GDPR, SOC 2, ISO 27001 stated; badge logos also displayed for ISO 13485, ISO 42001, ISO 27017, ISO 27018, ISO 14971, ISO 62366, CE, NHS DSPT/DTAC/DCB0129, Cyber Essentials Plus, EU AI Act, NIS2, DORA, ISAE 3000, BSI C5, US FedRAMP
      Now — checked 2026-09-25
      Safety page states Corti's security meets or exceeds market and regulatory requirements, including compliance with several strict frameworks, and displays framework logos (images without text labels) for ISO 27001, ISO 27017, ISO 27018, ISO 42001, ISO 13485, ISO 14971, ISO 62366, SOC 2, HIPAA, GDPR, CE, NHS DSPT, NHS DTAC, NHS DCB0129, Cyber Essentials Plus, EU AI Act, NIS2, DORA, ISAE 3000, BSI C5, US FedRAMP and EU-U.S. Privacy Shield.
      Source
    • HealthEngine·Data processing region26 Sept 2026
      Was — checked 2026-08-12
      Vendor states it may disclose limited personal information to third-party service providers outside Australia for its AI Virtual Receptionist
      Now — checked 2026-09-25
      Vendor states it may disclose limited personal information to third-party service providers outside Australia for its AI Virtual Receptionist and AI-assisted electronic communications products
      Source
    • HealthEngine·Model provenance26 Sept 2026
      Was — checked 2026-08-12
      AI virtual receptionist supported by Open AI, LiveKit, Langfuse and Twilio (cloud hosting and speech recognition)
      Now — checked 2026-09-25
      Privacy policy names OpenAI, LiveKit, Langfuse, ClickSend and Twilio among third-party service providers supporting its AI virtual receptionist and AI-assisted electronic communication functionality, such as cloud hosting and speech recognition
      Source
    • HotDoc·Subprocessors26 Sept 2026
      Was — checked 2026-08-13
      AWS (hosting, Australia); privacy policy also notes software and other service providers in the United States subject to confidentiality restrictions
      Now — checked 2026-09-25
      Privacy policy says all personal information is hosted and stored on HotDoc's Australian servers, but may be sent to overseas recipients, including software and other service providers located in the United States and the United Kingdom, and other service providers and sub-processors described in its Trust Centre. Its security page states hosting in Australia on Amazon Web Services (AWS).
      Source
    • Was — checked 2026-07-28
      Vendor states 24/7 Australian support, delivered onshore.
      Now — checked 2026-09-25
      Vendor's llms.txt states all customer support is onshore in Australia and New Zealand; no support hours are stated on the page checked.
      Source
    • Lyngo AI·PMS integrations26 Sept 2026
      Was — checked 2026-07-28
      Cliniko, Nookal and PracSuite listed as integrations; Splose shown with a 'coming soon' label.
      Now — checked 2026-09-25
      Vendor states Lyngo integrates directly with Cliniko, Nookal, PracSuite and Splose via API.
      Source
    • Lyrebird Health·TGA status26 Sept 2026
      Was — checked 2026-07-28
      Vendor states it is exempt from TGA Software as a Medical Device regulation.
      Now — checked 2026-09-25
      Not found on public pages
      Source
    • Lyrebird Health·Data processing region26 Sept 2026
      Was — checked 2026-07-28
      Help centre article (dated May 2024) states transcription is performed in real time on the vendor's servers in Sydney.
      Now — checked 2026-09-25
      Help centre article (dated 13 August 2026) states all transcription is performed in real time on servers located in the user's region, and that data is processed and stored within the region it originates from.
      Source
    • Lyrebird Health·Data processing region26 Sept 2026
      Was — checked 2026-07-28
      Privacy policy (effective 16 February 2026) states language processing via Azure OpenAI in the European Union, using de-identified health information only, with region-pinning where available.
      Now — checked 2026-09-25
      Privacy policy lists overseas transfers to the United States for payment processing (Stripe), system monitoring (Sentry, Honeycomb) and website analytics (Segment), and says all other personal information, including transcripts and speech processing, remains stored in Australia (AWS Asia-Pacific Sydney region) and is not transferred overseas. It names Azure OpenAI (Microsoft) for language processing; no processing location for it is stated on the page checked.
      Source
    • PatientNotes·PMS integrations26 Sept 2026
      Was — checked 2026-08-13
      Vendor lists Best Practice and MedicalDirector (copy-paste + browser extension), Genie and Helix (copy-paste), Cliniko (allied health)
      Now — checked 2026-09-25
      Vendor lists Best Practice and MedicalDirector (copy-paste + browser extension), Genie and Helix (copy-paste) and Cliniko (allied health), and lists direct API integration as on its roadmap
      Source
    • Decagon·Model provenance12 Aug 2026
      Was — checked 2026-07-28
      Security page names OpenAI and Anthropic as AI providers in the context of zero-day retention. No full list of models or model versions stated.
      Now — checked 2026-08-12
      Vendor states zero-day retention with all AI providers, such as OpenAI and Anthropic, so no conversation data is stored or used for training by them
      Source
    • Genesys·Data storage region12 Aug 2026
      Was — checked 2026-07-28
      Asia Pacific (Sydney), ap-southeast-2, listed as a Genesys Cloud core AWS region.
      Now — checked 2026-08-12
      Deployed in a customer-assigned AWS core region; Asia Pacific (Sydney) ap-southeast-2 is a listed core region (login.mypurecloud.com.au)
      Source
    • HealthEngine·ANZ entity12 Aug 2026
      Was — checked 2026-07-28
      Healthengine Limited, ACN 138 767 021. Postal address given as PO Box 7754, Cloisters Square, WA 6850, Australia.
      Now — checked 2026-08-12
      Healthengine Limited (ACN 138 767 021), Australia
      Source
    • HealthEngine·Data processing region12 Aug 2026
      Was — checked 2026-07-28
      Not found on public pages
      Now — checked 2026-08-12
      AI Virtual Receptionist involves disclosure to third-party service providers located outside Australia
      Source
    • HealthEngine·Model provenance12 Aug 2026
      Was — checked 2026-07-28
      Privacy policy names Open AI among third-party service providers supporting the AI virtual receptionist's functionality, alongside LiveKit, Langfuse and Twilio. Specific models are not named.
      Now — checked 2026-08-12
      AI virtual receptionist supported by Open AI, LiveKit, Langfuse and Twilio (cloud hosting and speech recognition)
      Source
    • HealthEngine·Subprocessors12 Aug 2026
      Was — checked 2026-07-28
      No consolidated subprocessor register published. Third parties named in the privacy policy include Open AI, LiveKit, Langfuse and Twilio (AI virtual receptionist), Braze Inc., Cloudstaff Pty Ltd, Google Analytics, Hotjar, Intercom Inc, Gong.io Inc, Best Practice Software Pty Ltd, Telstra Health Pty Ltd, eRx Script Exchange Pty Ltd, Medication Knowledge Pty Ltd, Oexa Pty Ltd and First Focus IT.
      Now — checked 2026-08-12
      Braze, Inc. (customer engagement) hosts and processes primarily in the United States; policy names further providers incl. Cloudstaff, First Focus IT, Stripe Australia, Tyro, Gong.io
      Source
    • Nabla·Data processing region12 Aug 2026
      Was — checked 2026-07-28
      Trust Center subprocessor table states Azure speech-to-text operations occur in U.S. Regions, and Google Cloud infrastructure hosting in Central Region (USA) for U.S. clients and Belgium for all non-USA clients.
      Now — checked 2026-08-12
      GCP infrastructure hosting: Central Region (USA) and Belgium (all non-USA); Azure speech-to-text operations in U.S. regions
      Source
    • Nabla·Data storage region12 Aug 2026
      Was — checked 2026-07-28
      United States (Google Cloud US regions) for U.S.-based clients; European Union (Google Cloud data centres) for all other clients.
      Now — checked 2026-08-12
      US clients: US regions on Google Cloud (GCP); all other clients: EU Google (GCP) data centres
      Source
    • Nabla·Model provenance12 Aug 2026
      Was — checked 2026-07-28
      Not found on public pages
      Now — checked 2026-08-12
      Publishes an AI Model Card (CHAI version 2); external model providers not named on trust centre
      Source
    • Nabla·Subprocessors12 Aug 2026
      Was — checked 2026-07-28
      3 subprocessors published on the Trust Center: Google Cloud (Infrastructure Hosting), Azure (Speech to Text Operations), Front (Support Ticketing, No PHI).
      Now — checked 2026-08-12
      Core vendors listed on trust centre: Google Cloud (infrastructure hosting), Azure (speech to text), Front (support ticketing, no PHI)
      Source
    • Suki·Certifications12 Aug 2026
      Was — checked 2026-07-28
      SOC2 Type 2 certified; HIPAA compliant (as stated on suki.ai home page). Suki also links a Trust Portal at https://trust.suki.ai/ (Vanta-hosted); its contents render only with JavaScript and could not be retrieved, so no certification detail is recorded from it.
      Now — checked 2026-08-12
      SOC 2 Type 2 certified and HIPAA compliant (stated on website)
      Source
    • Suki·PMS integrations12 Aug 2026
      Was — checked 2026-07-28
      Epic, Oracle Health, athenahealth, MEDITECH
      Now — checked 2026-08-12
      EHR integrations: Epic, Oracle Health, athenahealth, MEDITECH
      Source
    • VoiceStack·Certifications12 Aug 2026
      Was — checked 2026-07-28
      AU site states Australian Privacy Principles, HIPAA standards, SOC 2, PCI and ISO 27001 certified. No certificate numbers, audit scope or report access are stated on the page; the site FAQ states security details are provided during security review under NDA.
      Now — checked 2026-08-12
      Website states certification against Australian Privacy Principles, HIPAA standards, SOC 2, PCI and ISO 27001
      Source
    • VoiceStack·Support hours12 Aug 2026
      Was — checked 2026-07-28
      Not found on public pages
      Now — checked 2026-08-12
      Support via chat, email and phone; named Customer Success Manager for multi-site groups and DSOs; specific hours not stated
      Source
    • HealthEngine·Data storage region12 Aug 2026
      Was — checked 2026-07-28
      Australia, stated for personal information held by Healthengine. The same policy states some third party service providers may store personal information on servers located overseas, including the US and European Union.
      Now — checked 2026-08-12
      Vendor states secure servers in Australia; its policy says some service providers may store data overseas
      Source
    • HealthEngine·Certifications12 Aug 2026
      Was — checked 2026-07-28
      ISO 27001 Certification for Information Security Management Systems, stated as earned in October 2022.
      Now — checked 2026-08-12
      Vendor states it earned ISO 27001 certification for Information Security Management Systems in October 2022
      Source
    • Nabla·Certifications12 Aug 2026
      Was — checked 2026-07-28
      Trust Center Compliance section lists: SOC 2 Type 2, ISO 27001, HIPAA, CCPA, Texas RAMP, GDPR, EU AI Act, PIPEDA, CIS Level 2. Documents listed: SOC 2 Type II Report (Nov 2024–Oct 2025), ISO/IEC 27001 (Sept 2025), TX-RAMP Certificate Level 2 (Jan 2026).
      Now — checked 2026-08-12
      Vendor states it follows HIPAA, GDPR, SOC 2, ISO 27001 and NIST cybersecurity standards for security and privacy
      Source
    • Suki·Data storage region12 Aug 2026
      Was — checked 2026-07-28
      United States — website privacy policy states Personal Data may be transferred to Company offices and servers located in the United States. Policy does not separately state where clinical/PHI data is stored.
      Now — checked 2026-08-12
      Privacy policy says personal data may be transferred to company and authorised third-party offices and servers in the US
      Source
    • VoiceStack·PMS integrations12 Aug 2026
      Was — checked 2026-07-28
      AU page integrations section lists CareStack, Zavy 360, Google Analytics, Google Ads, HubSpot, GoHighLevel and Boxly.
      Now — checked 2026-08-12
      Vendor states native hooks for PMS, CRM and BI; offers to confirm certified connectors for a customer's stack
      Source
    Right of reply

    Submit a correction

    Are we missing something, or has this changed? Vendors and their representatives can submit a correction, and we note each change and credit the source. We review every correction request and update the entry when the source supports it.

    • Corrections address: hello@gocadence.ai
    • We verify against the source URL you provide and credit it in the update.
    • If the change is material we note it in the public change log above.
    Correction form
    Method & limits

    How we do this — and what it isn't

    Sources. Vendor trust centres, security pages, privacy policies, subprocessor lists, DPAs, product documentation, official registers and vendors' own announcements. Not competitor claims.

    Robots & access. We respect robots.txt. Where a vendor's pages disallow automated access, we record that and do not work around it.

    Point-in-time. Every entry carries the date it was checked. Vendors update documentation frequently — an entry is a snapshot of what a specific page said on a specific day.

    Absence. We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere.

    No scoring, no ranking. This is a reference, not a scorecard. We do not compute a “transparency score”, a grade, a star rating or a percentage-complete. Vendors are listed alphabetically. We do not rank them.

    Corrections. Any vendor or their representative can submit a correction using the form above. We review every correction request and update the entry when the source supports it.

    Payment disclosure. No vendor pays to appear in or be omitted from this tracker. How we're paid. You pay the fixed fees in our pricing table. If you select a platform, that vendor may also pay Cadence a success fee, at the same rate whichever platform you choose. Before an engagement starts we tell you which vendors we have fee agreements with. Platform licences are paid to the vendor directly.

    Answers by question

    Reading one question across every vendor

    The matrix above reads vendor by vendor. If you would rather read one question across all of them, each topic has its own page with the same quotes, sources and check dates.

    Choosing between vendors is a different job.

    This tracker records what vendors have said. If you need help deciding which vendor to sign — inside your specific network, integrations and risk posture — that is what our advisory engagements are for.