A box, not a subscription.
The AI runs locally.
Every cloud AI scribe in this category — Upheal, Mentalyc, Blueprint — sends your patient's audio through their cloud. Their BAA is paper. Their SOC 2 audits their promises. Neither is an audit of your therapy session.
ClinicBox runs the model on a small box that sits on your desk. The audio doesn't leave the room because it physically can't — there is no second network port and no outbound destination configured. The vendor risk you're managing today doesn't apply, because there is no vendor in the loop.