Suki Assistant
Suki · Ambient AI medical scribe
Public sources reviewed . Risk classification and recommended policy are Ayliea's subjective assessments — not vendor certifications.
Scope of this recommendation
Contracted Suki Assistant clinical workflow; partner API capabilities may differ.
Public documentation review only. Current audit reports, certificate scope, executed contracts and customer settings were not independently examined. An omitted assurance claim is not evidence that the vendor lacks it.
- Storage and processing locations
- Confirm current hosting, speech/model subprocessors and all PHI processing locations contractually.
- Retention and ZDR scope
- Developer FAQ states audio and transcripts are deleted after 30 days and final clinical notes persist for the service contract. Confirm product-specific settings and backups.
- Vendor-reported audits / certifications
- Not established in this public-source review
Why this rating
Suki publishes healthcare security guidance and BAA terms. Data-use permissions must be reconciled across the FAQ, service agreement and BAA; a public claim about anonymized training is not an unconditional no-training commitment.
Considerations before deploying
- Execute the applicable BAA and document recording notice/consent before patient use.
- Obtain current product-scoped assurance, subprocessor/data-flow details and contractual training/secondary-use terms.
- Validate audio, transcript, note and backup retention, deletion and EHR access; require clinician review before finalizing documentation.
- Resolve training/system-tuning permissions in the signed agreement and define the de-identification standard where secondary use is permitted.
Sources
- Suki Security and Compliance FAQ (developer.suki.ai)
- Suki service agreement (www.suki.ai)
- Suki BAA (app.suki.ai)
Need a vendor review for your use case?
A scoping call defines the systems, data flows and vendor evidence to review for your use case.