Nabla: our review

Nabla listens to the consultation between a doctor and their patient, then produces a structured clinical note, a letter to a fellow practitioner and coding suggestions. The publisher claims more than 130 healthcare facility clients and offices in both Paris and New York — two markets with very different regulatory requirements, which matters for what follows.

What it actually does

The doctor turns on listening at the start of the consultation and keeps talking normally with the patient. Nabla transcribes the exchange, then extracts a note organised by reason for visit, history, examination and plan — the practitioner reviews and corrects it before validation. The same flow suggests billing or coding codes, and can generate a letter for a fellow practitioner. The intended gain is simple: less time spent typing after the patient leaves.

Why this point deserves a closer look

Nabla's site displays four certifications: HIPAA, SOC 2 Type II, ISO/IEC 27001 and GDPR compliance. The trust centre adds further badges for CCPA, Texas RAMP, the EU AI Act and PIPEDA. On none of these pages, however, does the HDS certification (French health data hosting) appear — yet it is mandatory in France for any host of personal health data, under the French public health code. HIPAA protects health data in the United States; it doesn't replace HDS in France. Data is also hosted on Google Cloud Platform, "in the region you choose" according to the security page, with no written confirmation of French data residency or an HDS-certified host for that region. For a French facility, this is the question to settle before any deployment on real health data: see our page AI for healthcare professionals. We recommend asking for written confirmation before signing, rather than inferring compliance from certifications that first answer to a US framework.

Where it falls short

Three reservations, in the order they arise. First, the absence of any mention of HDS, already detailed above. Second, the vagueness about exact data residency: "the region you choose" guarantees nothing as long as no page lists the available regions or a certified host in France. Third, pricing, absent from any public page: costing goes through a sales demo, which prevents comparing cost before handing over your contact details.

Our recommendation

Nabla keeps serious security documentation for US use. For a deployment in France on real health data, demand written confirmation of HDS certification and server location before any commitment. Without that confirmation, a French facility takes on a compliance risk that none of the certifications displayed covers.