How HugoScore reviews AI

HugoScore asks one question of every patient-facing health AI tool in the directory. Who does this AI serve? Put plainly: is it for you, or on you?

Patient-facing means health AI you interact with in some form: you prompt it, you speak to it, or it captures your voice or information and produces something about you, such as a note, a summary, a score or a decision. An ambient scribe that records your visit counts, even if you never touch it. A reference tool that answers a clinician's general questions does not. (Section 2)

Every review answers that in three separate parts, always in this order. What the tool does to your agency. Who directs it. How much evidence stands behind the review. We never fold the three into one grade. (Rubric, section 1)

1. The agency checklist

The headline zone counts twelve yes-or-no questions about the patient's control in the named function. Each answer needs public evidence. The questions cover AI notice, who operates it, choosing and stopping use, setting its purpose, seeing and challenging output, copying and deleting data, training choices, running or transferring the function, and advertising or a business in patient data. Read every question and answer rule.

Q11 asks whether the patient can run the tool or take the same function elsewhere with their data, without the operator's permission. Export alone is not enough. A self-started optional tool can satisfy the stop/decline question. Host terms count for questions 8 to 12, and a geographically restricted right does not establish a universal yes. The advertising rule includes documented promotional advertising, even with consent.

These are document-based drafts, not product tests or clinical safety grades. A no can mean not documented, institution-dependent, or a documented limitation; the answer table states which. Unverified answers remain marked and contribute only provisional arithmetic. Missing quotations and incomplete cross-vendor confirmation remain visible. Hugo has not personally verified any service.

Not assessed is a separate state for no-AI, undeployed or unavailable research-only scopes. It is never scored zero and is different from Not enough evidence. ChatGPT Health Free and Plus are shown separately on one profile; Plus inherits ten answers whose plan-specific applicability has not been independently confirmed.

The corrected October 30 set has 6 Constrains, 3 Leans constrains, 19 Mixed, 21 Leans expands, 7 Expands and 3 Not assessed. See all classifications, the independent review, later evidence follow-up and decisions. Evidence strength is separate from the zone. Dashed outlines mean documents only.

Earlier v1.3 narrative findings and control assessments remain clearly labeled as history. They do not override the current checklist classification. These editorial rules have not been validated as a measurement instrument.

2. The separate control assessment

The preserved v1.3 assessment says who sets the tool's purpose, on a line from institution-directed (0) to patient-directed (100). These are eight fixed reference points, not a percentage and not a quality grade. (Section 5A)

Institutional AI and patient-directed AI are the two ends of this line. At the patient-directed end, you run and control the whole thing, including the model. Almost nothing is there today. At the institutional end is a tool whose rails steer you toward a goal someone else set, even when you are the one typing. Talking to you directly does not make a tool patient-directed. Who deploys it tells us where to look. Its rails tell us where it sits: whether you can choose the kind of help you get, change direction, question its agenda and use what it gives you. Ordinary safety limits are not counted as rails. (Section 3)

There is nothing between these points. We do not average, and an unknown never lowers a position. When the evidence cannot settle a condition, the profile shows the possible positions, such as "80 or 90, pending one condition," or says "unresolved." (Section 5A) Possible positions are shown as separate points, never as a range, and no midpoint is drawn. (Section 5)

Owning the servers is not required for a high position. A hosted assistant that answers to you can reach 90. A local model can still carry someone else's agenda. (Section 1)

Four rules decide whether a tool gets a position at all

You take part in the AI interaction. You use it yourself, or someone you authorize uses it at your direction, such as a care partner typing for you or a proxy with your permission. Receiving a note written by a clinician's AI is not taking part. Tools like ambient scribes keep a full profile, an agency finding and a description of who controls them, with the label "control axis not applicable: clinician-operated." Your power to refuse, correct or appeal their output is reported prominently. (Section 2)

You can set the purpose. The tool has to be one where you can state what you want from it and redirect and question it. Assistants, record question-answering and drafting tools qualify. Live interpreters and intake or symptom-checking interviews whose kind of answer the company fixes do not, because their job is accuracy or a set output, not a purpose you set. They keep a full profile and an agency finding, with the label "control axis not applicable: no patient-set purpose." A record connector that only moves data has no AI of its own and is outside the directory. When it is used with an AI assistant, we review that combination as one named tool. If no assistant has been chosen, there is nothing yet to review. (Section 2)

The tool says who runs it. The company that operates the service and the model provider have to be named on the product's own site, terms or privacy policy. The model provider is the company that built the AI model, including the original model when another company adapted it. When several companies run a service together, each must be named, each on its own pages. And the tool has to name a company that actually operates it when you ask it directly. Naming a supplier that does not operate the service is not enough. When a patient runs their own AI privately, their setup records who runs it, and we never require a patient to make their identity public. A tool that fails gets no position and no set of possible positions, and the profile says exactly why: "operator not disclosed," "model provider not disclosed," "operator disclosure inaccurate" or "disclosure unresolved." A wrong answer is reported as worse than no answer. We still describe who controls the tool in words, including an unfavorable description. We check disclosure for every tool, including ones off the line, and show the result on the profile. "Publicly" means readable without an account. This is our publication standard. If you cannot learn from the tool who runs it, you cannot weigh whose interests it serves. (Section 3A)

A single position needs testing. We publish one position, such as "80," only after two fresh test sessions with a fixed set of prompts, including asking the tool who runs it, with the transcripts frozen. A review based on documents shows possible positions or "unresolved." When documents alone would point to one position, the profile says "position withheld pending required testing." (Section 8)

When one company's AI is switched on by many hospitals or clinics, the finding names the one deployment we reviewed. Other deployments are listed as not reviewed. (Section 2)

3. How much to trust the review

Every profile states two things separately. (Section 8)

What was examined.

• Documentary. Official sources, policies, documentation and any independent evidence. No hands-on testing by HugoScore.
• Partial interaction. Some testing, short of two complete test sessions.
• Protocol-complete interaction. Two complete test sessions with frozen transcripts, plus the documents.
• Independent evidence. A qualifying outside study or audit, noted alongside one of the above.

Who reviewed it.

• AI draft. Coded by AI models. No person has settled the findings.
• Human adjudication. A named person settled specific questions on a stated date.
• Substantive human review. A named person reviewed all the evidence and findings, with the date and scope recorded.

Authorizing publication is not the same as reviewing. A profile Hugo authorized for publication is still an AI draft unless a review is recorded. (Section 8)

Most profiles today are documentary AI drafts. They describe what a company documents and says. They do not show that the tool behaves that way. They are not a rating of product quality, clinical safety or legal compliance.

Who codes the reviews

The initial checklist was coded by Claude Sonnet helpers and compiled by Claude Opus 5.5 (Anthropic). GPT-6 Astra (OpenAI) reviewed selected answers, rules and placements. Hugo accepted ten corrections. This does not mean every answer has two independent confirmations.

For the checklist, a model may code a tool built on its own company's model when the conflict is disclosed. The other company's model is required for cross-vendor confirmation. Where that confirmation is incomplete or itself conflicted, the limitation stays visible and the classification remains a draft. Unknown provider configurations remain unresolved. Hugo has not personally verified any service.

The earlier v1.3 control-coding protocol is preserved in the rubric for its historical assessments; it must not be mistaken for the checklist's conflict rule. Checklist decisions and independent review.

Older numbers

Before this method, profile numbers were editorial placements made by comparing one tool with its neighbors. They were not derived from a rule. They now carry the label "legacy editorial placement, pre-method" until each profile is reviewed again. They are never compared with new positions as if they were measured on the same scale. Nothing is silently renumbered. Every re-review records what changed and why. (Section 8, Section 9)

Corrections from companies

Companies can send corrections through the submission form. A company's statement about its own product is recorded as vendor-provided until we can check it against a public source or a test. We date the update and keep the earlier finding in the profile's history. Submissions are listed in the public submission log, without names, email addresses or message text.

Who wrote the criteria

Versions 1.0 to 1.2 were drafted by OpenAI's GPT-6 in Codex. Version 1.3 was drafted on October 18, 2026 by Anthropic's Claude Fable 5.1 from Hugo Campos's decisions, reviewed independently by OpenAI's GPT-6 Astra, and completed on October 30, 2026 by Anthropic's Claude Opus 5.5. Hugo Campos is the editor and made every methodological decision. These are HugoScore's editorial rules. They have not been validated as a measurement instrument.

The full rubric, review worksheet and decision record are published here.

HugoScore's starting lens is Critical AI Health Literacy, from Hugo Campos and Liz Salmi's NAM Perspectives commentary.