VYTL CAIHL draft report

HugoScore CAIHL Draft Report: VYTL

• Status: Draft for human review
• Last reviewed: 2026-08-09
• Review method: Public-source review of the VYTL homepage, signup surface, contact page, privacy policy, and terms of service, plus searches for press coverage, funding records, company registrations, app-store listings, and independent evaluations. No account creation, fax-ingestion test, authenticated workflow test, AI/OCR accuracy inspection, vendor interview, patient interview, security audit, accessibility audit, independent validation, or legal/regulatory determination was performed.
• Service: VYTL
• Vendor: VYTL Health LLC
• URL: https://vytl.io/
• Category: Patient-controlled health records AI

1. Executive Summary

VYTL is a direct-to-patient health records platform whose homepage promise is close to CAIHL's own language: "Your Health Records. Finally Yours." Each user gets a personal VYTL fax number, asks providers to fax records there, and VYTL automatically sorts incoming documents by type, date, and provider. The user can then share their consolidated history with any doctor "with one tap." Signup offers patient and clinic accounts, and the terms describe free and paid tiers with per-page overage charges on clinic plans.

Under CAIHL, VYTL starts strongly patient-directed: the patient chooses the tool, initiates every record request, holds the consolidated record, and controls sharing. The company states that data is "encrypted, private, and never sold," that users own their records, and that VYTL is an administrative platform making no medical claims. The clinical boundary is unusually clean.

The caveats sit underneath. The "auto-organized" step runs on "automated tools and artificial-intelligence systems, including third-party AI services," none of which are named, with no disclosed retention or model-training restrictions. The homepage's unqualified "HIPAA Compliant" badge is broader than the qualified language in the company's own privacy policy. And the company has essentially no public footprint: no named team, no press, no funding records, no independent evaluation, and a liability cap at the greater of twelve months of fees or one hundred dollars for a service holding a person's entire medical history.

• Agency posture: Potentially agency-expanding, mixed
• Agency axis position: 84 of 100
• Confidence: Low-to-medium draft, official sources only

2. CAIHL Question

Who does VYTL serve?

VYTL primarily serves patients and family caregivers who choose the service to collect, hold, and share their own medical records, plus clinics that adopt the clinic account type. It also serves VYTL Health LLC's subscription business and depends on unnamed cloud, communications, and AI processing vendors. Providers are recipients of patient-shared records rather than primary users.

CAIHL classification: Patient-directed, vendor-hosted personal health record AI.

3. What The Service Does

VYTL describes a three-step workflow. The user asks each provider to fax records to the user's personal VYTL fax number, a mechanism that rides the fax infrastructure most U.S. providers still use and operationalizes the patient's right of access. Incoming records are automatically sorted by type, date, and provider, into buckets the homepage lists as labs, imaging, notes, and prescriptions. The user then shares their complete history with any doctor with one tap.

Signup offers a patient account ("Store and organize your own health records") and a clinic account ("Manage records for your patients"). The terms describe free and paid subscription tiers with automatic renewal, non-refundable fees, and clinic per-page overages. No public pricing page was found. The service is limited to adults 18 and older, and data is processed in the United States.

4. Patient-Impact Pathway

1. A patient or family caregiver creates a VYTL account and receives a personal fax number. 2. The user asks each provider to fax records to that number. 3. Incoming documents pass through automated and third-party AI systems that read, classify, and extract information. 4. VYTL organizes the records by type, date, and provider into a consolidated history. 5. The user reviews the organized record; originals remain authoritative, and VYTL disclaims the accuracy of AI-extracted information. 6. The user shares the consolidated history with chosen providers. 7. Agency depends on provider cooperation with fax requests, AI classification accuracy, correction routes, export completeness, and the trustworthiness of the vendor and its unnamed processors.

5. Evidence Table

| Source | Evidence | CAIHL relevance |
| --- | --- | --- |
| VYTL homepage, accessed 2026-08-09: https://vytl.io/ | Personal fax number, auto-organization by type/date/provider, one-tap sharing, "Patient-First / HIPAA Compliant / Always Accessible" badges, and "encrypted, private, and never sold." | Supports product identity, patient-directed purpose, and the HIPAA-badge finding. |
| Signup page, accessed 2026-08-09: https://vytl.io/signup | Patient accounts ("Store and organize your own health records") and clinic accounts ("Manage records for your patients"). | Confirms the two account types and direct patient access. |
| Privacy policy, effective June 2026: https://vytl.io/privacy | Discloses collection of identity, contact, date of birth, credentials, medical records, and device data; "automated tools and artificial-intelligence systems, including third-party AI services, to read, classify, and extract information"; AI output "not guaranteed to be complete or accurate"; encryption in transit and at rest, access controls, audit logging; no sale of personal information; deletion within thirty days; access, correction, export, and deletion rights; U.S. processing; 18+. | Core data-governance, AI-disclosure, and rights evidence. |
| Terms of service, updated August 2026: https://vytl.io/terms | VYTL Health LLC, San Diego; administrative platform to "request, organize, store, and share" records; no medical advice or doctor-patient relationship; users must verify AI-extracted information, with originals authoritative; free and paid tiers, non-refundable auto-renewing fees, clinic per-page overages; user ownership with a limited hosting license; liability capped at the greater of twelve months of fees or $100; AAA arbitration with class-action waiver. | Core legal-boundary, ownership, fee, and liability evidence. |
| Contact page, accessed 2026-08-09: https://vytl.io/contact | Lists [email protected], [email protected], and a form with a "Privacy or Data Request" category. | Supports the existence of a data-request route. |
| Press, funding, registry, and app-store searches, 2026-08-09 | No press, funding, team, LinkedIn, Crunchbase, or app-store footprint for VYTL Health was identified. The "Vytl+" iOS app belongs to Vytl LLC, a separate company for traveling healthcare professionals. | Establishes the thin public footprint and a name-confusion risk. |
| HHS right-of-access guidance: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html | Explains the HIPAA individual right of access that patient-initiated record requests rely on. | Regulatory context only; no legal conclusion about VYTL. |
| FTC Health Breach Notification Rule guidance: https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0 | Explains duties that can apply to non-HIPAA personal-health-record vendors. | Data-governance context only; no legal conclusion about VYTL. |

6. Mixed HugoScore Profile

Who does this AI serve?

Patient-directed, vendor-controlled. Patients choose the service, initiate collection, and control sharing. Vendor subscription interests and unnamed AI and infrastructure processors remain in the control structure.

Can patients tell AI is involved?

Partial. The homepage says records are "automatically sorted" without mentioning AI. The AI role and its accuracy limits are disclosed in the privacy policy and terms rather than in the product marketing.

Can patients meaningfully choose?

Yes, with pricing opacity. Use is voluntary, a free tier exists, and accounts can be deleted at any time with thirty-day erasure. Prices are not public before signup, fees are non-refundable, and subscriptions auto-renew.

Can patients correct or challenge what the AI produces?

Partial. The policy grants access, correction, export, and deletion rights, and originals remain authoritative. No public materials show how a user fixes a misclassified document, a wrong date or provider attribution, or an extraction error.

Does it help patients understand or act?

Yes, for organization and sharing. Consolidating scattered records and arriving at a new specialist with a complete history are direct action supports. VYTL makes no interpretive or clinical claims, so its help is administrative by design.

Who is left out or burdened?

The request burden stays with the patient, who must know their right of access and pursue each provider. The service is 18+ with no documented caregiver or proxy controls despite caregiver-centered testimonials. Accessibility conformance, language support, and assistance programs are not disclosed.

What happens to patient data?

Strong headline commitments with a materially opaque middle. No sale, encryption in transit and at rest, thirty-day deletion, and export rights are stated. The AI subprocessors, fax and hosting vendors, model-training restrictions, and the scope of "improve the Service" are not disclosed, and a business transfer could move records to an acquirer.

Are the clinical boundaries clear?

Yes, unusually clear. VYTL presents itself as an administrative records platform, disclaims medical advice and any doctor-patient relationship, and instructs users to verify AI-extracted information against the originals.

Who defined what good looks like?

The vendor, with no visible external input. The patient-ownership framing aligns with patient-advocacy values, but there is no evidence of patient co-design, advisory input, independent evaluation, or even a named team behind the product.

7. Key Unknowns

• Which third-party AI services process record content, and under what retention and model-training restrictions.
• Whether "improve the Service" permits use of record content for analytics or AI training.
• Whether records can enter by upload, portal, or API rather than fax alone.
• How sharing is delivered, whether shares can be revoked, and whether patients see an access log.
• The correction workflow for misclassified or misextracted documents.
• Export formats and whether a full record can leave VYTL in usable, structured form.
• Actual prices, tier limits, and free-tier scope.
• Security attestations, MFA, penetration testing, and breach history.
• Whether clinic accounts operate under business associate agreements.
• Founders, team, funding, and corporate history of VYTL Health LLC.
• Caregiver and proxy governance, accessibility, language support, and state availability.
• Independent evaluation of classification accuracy, security, or patient outcomes.

8. Patient Agency Interpretation

VYTL's pitch reads like a CAIHL thesis statement: records live in systems "never built for patients," and the fix is patient custody. The mechanism is pragmatic, riding the fax machine, the one channel nearly every U.S. provider still operates, and using the patient's own right of access as the collection engine. A patient who uses VYTL well walks into a new specialist's office with a complete history, which is exactly the strategic action CAIHL hopes literacy enables.

The agency question is what happens between the fax line and the share button. The organizing intelligence is rented from unnamed third-party AI vendors, so the patient's most sensitive documents transit systems nobody can evaluate. The company asking for custody of entire medical histories discloses no team, no certifications, and a liability ceiling that may be one hundred dollars. The stated commitments are better than much of the industry, but patient agency requires the ability to verify, and VYTL currently asks for trust it has not yet documented grounds for.

9. Publication Recommendation

Ready for human review as an AI-assisted, source-backed draft. Publish under Patient-controlled health records AI with CAIHL classification "Patient-directed, vendor-hosted personal health record AI." Do not mark reviewed or verified. Prioritize human review of the AI subprocessor disclosure, the HIPAA-badge framing, hands-on fax-ingestion and correction testing, export formats, real pricing, security attestations, clinic-side BAA status, caregiver/proxy governance, and company identity.

Review Provenance

• Criteria: HugoScore patient agency framework derived from CAIHL, using the same public questions and mixed answer types applied to every tool.
• Reviewer: AI-assisted public-source draft prepared in Claude (Cowork); no named human reviewer is recorded.
• AI / model: Claude Fable 5 (claude-fable-5).
• Human review: No comprehensive human review has been completed or claimed.
• Review date: 2026-08-09.
• Limitations: No account creation, fax-ingestion test, authenticated workflow test, AI/OCR accuracy inspection, vendor or user interview, security audit, accessibility audit, independent validation, or legal/regulatory determination.