Watching Conformly audit Medra Health
Medra Health is a telehealth app putting AI into production, sure the EU AI Act doesn't apply to them. Scroll down to see what a two-minute audit actually finds — and what each finding means, without the legal jargon.
Medra Health
Care, sooner. · Telemedicine app
“We're a health app with a symptom checker and a booking bot. Medical rules we know — but AI rules too?”
- Symptom TriageSuggests urgency and next stepsdeclared
- Booking botHelps patients book appointmentsdeclared
- npm:@vitals-ai/distressDetects patient distress from voice and faceundeclared
- openai:gpt-4oGenerates patient-education explainer videosundeclared
- No-Show PredictorFlags likely missed appointmentsundeclared
The founder named 2. A read-only scan of the code found 5. Here is what each one means — in plain words.
Symptom Triage & Distress Detection
Suggests how urgent a symptom is and reads patient distress from voice and face to prioritise care.
Software that helps decide how urgent someone's medical care is behaves like part of a medical device — so it's high-risk. And here's the twist: reading distress from a face would be banned in hiring, but it's allowed here because it's for medical reasons. Allowed — but with the full high-risk rulebook.
In plain words: A symptom-checker that steers care is treated like medical equipment: it has to be safe, tested, and supervised.
Annex IAI that is a safety component of a medical device is high-risk under Annex I (the product-safety route), applying from 2 August 2028. Article 5(1)(f)'s emotion-recognition ban carves out medical purposes, so clinical distress detection is permitted — but still high-risk.
Confirm the medical-device classification, then run the high-risk checklist and the conformity-assessment route.
Conformly maps it to the Annex I high-risk track, generates the technical documentation, and shows the 2028 timeline against your plan.
An inspector would open with: "Provide the medical-device conformity assessment and the clinical validation for the triage model."
Booking Bot
Chats with patients to help them book appointments.
Tell patients it's an AI. One clear line does it.
In plain words: A booking bot is fine — as long as it says it's a bot.
Art. 50Article 50(1) requires people interacting with an AI system to be told so. Applies from 2 August 2026.
Add "You're chatting with Medra's AI assistant" to the chat.
Conformly hosts the transparency page and the disclosure chip for you.
AI Explainer Videos
Generates patient-education videos that explain conditions and treatments.
AI-generated health videos must carry a machine-readable 'AI-made' mark.
In plain words: If a computer made the health explainer, it needs an invisible 'AI-generated' tag.
Art. 50(2)Article 50(2) requires machine-readable marking of synthetic media, transition to 2 December 2026 for existing systems.
Add provenance metadata (C2PA) to generated videos.
The obligation lands on your task list; the watermark checker confirms whether the video already carries provenance metadata.
No-Show Predictor
Flags appointments likely to be missed, for internal scheduling.
Nothing to do. It helps you plan rota; it doesn't make a decision about the patient's care. Minimal risk.
In plain words: Guessing who might miss an appointment just helps you plan. It's fine.
—Not high-risk and outside Article 50 — minimal-risk only.
No action required. Keep it listed.
Conformly records it in your inventory so the picture is complete.
Smart Scheduler
Optimises appointment slots across clinicians.
Nothing owed. It's an efficiency tool that doesn't affect anyone's rights. Minimal risk.
In plain words: Auto-arranging the calendar is just admin. It's fine.
—Not high-risk and outside Article 50 — minimal-risk only.
No action required.
Kept in your inventory so nothing is undocumented.
The verdict
Medra assumed AI rules were for big labs. The audit put their triage tool on the medical-device high-risk track (with a 2028 deadline), explained why their distress detection is allowed where a recruiter's wouldn't be, and left two quick disclosure fixes.
That startup was made up. Your AI isn't.
The same deterministic engine can classify your real systems in two minutes — no sign-up, no sales call. Or drop the read-only scanner into your codebase and see what it finds.
npx conformly-scan --dry-run
An example audit — a realistic walkthrough of how Conformly's deterministic engine classifies this kind of AI product. Not legal advice.