Security and contract terms of 25 summary products

By Ahmed Jemaa, Co-Founder and CEO of Medrecords AI. Updated 2026-11-14.

Limits: We read vendor websites, not contracts or invoices, and we didn't run the products on a shared test file: a "Not stated" cell means the vendor's pages didn't say, and quoted prices can differ.

The terms matrix

Yes: the vendor's site states it. Partly: stated with a condition, see below. Not stated: absent from the pages we read. We haven't read the contracts themselves.

The conditions behind "Partly"

• CaseMark, BAA: the pricing page says a BAA is available on monthly plans. Pay-as-you-go medical summaries, the cheapest route in our cost tables, don't mention 1.
• Casefleet, BAA: the pricing FAQ says Casefleet signs a BAA for annual accounts, and an additional fee applies.
• Legalyze, BAA: the site states business associate agreements with its AI providers, which covers the model vendors behind the product. A BAA between Legalyze and you isn't described on the pages we read.
• Eve, SOC 2: the security page says its program follows the SOC 2 criteria. It doesn't name an audit report.
• IME Coach: states a Business Associate Addendum with AWS, its host. That is IME Coach's own agreement with its cloud provider, so we coded the customer BAA as Not stated.

Why a BAA is the term to settle first

If you are a covered entity under HIPAA (a practice, hospital or health plan) or a business associate of 1, a vendor that stores or processes your patients' records on your behalf is generally your business associate, and HIPAA requires a written BAA with it. Physicians doing medical-legal work should ask their own counsel how their role is classified. Whatever the answer, 3 practical questions decide whether a vendor's BAA is usable:

1. Which plan includes it? If the BAA comes only with a monthly or annual plan, the cheapest pay-as-you-go price in the matrix isn't your real price.
2. Does it cost extra? Casefleet states a fee. Ask every vendor.
3. When is it signed? Before the first upload is the safe answer. Superinsight states it countersigns before the first upload; Medrecords AI and BastionGPT state the BAA comes at signup or with the trial.

Training, retention and where records live

8 products state that customer files don't train their models: Medrecords AI, InPractice, InjuryMgmt, CaseMark, Legalyze, NexLaw, BastionGPT and TrialBase. CaseMark limits that statement, on its Para product, to Pro and Enterprise plans. The other 17 don't say either way on the pages we read.

Retention is rarely stated. MediScan says uploaded records and summaries stay for the life of an active account and are disposed of securely when no longer needed. NexLaw says client data sits on US-only servers. InjuryMgmt names Google Cloud, Chronos names Aptible's HIPAA-eligible infrastructure, and IME Coach names AWS in the United States. Ask every vendor on your shortlist 3 questions in writing: how long records are kept after a case closes, whether you can delete them yourself, and which country the records and model calls run in.

SOC 2 and audits: what the matrix records

We code SOC 2 as Yes when a vendor's page states a SOC 2 audit, certification or attestation: Medrecords AI, MediScan, NexLaw (Type II), Abstractive Health (Type 2), Wisedocs (Type II), DigitalOwl, EvenUp, Supio (Type II) and ProPlaintiff. A SOC 2 report is something a vendor shares under NDA; ask for the latest report and its date. A statement on a website is where the conversation starts, not where it ends.

5 questions to send every vendor before a trial

1. Will you sign a BAA for the plan I'll buy, at what extra cost, and before my first upload?
2. Do you hold a current SOC 2 report, and can I see it under NDA?
3. Are my files, or outputs from them, used to train or tune any model, yours or a provider's?
4. How long do you keep records after a case is closed, and can I delete them myself?
5. In which country are records stored, and in which country do model calls run?