N

Novo

The artificial intelligence is the product and nothing survives its removal. Novo sells two outputs, a medical chronology and a demand letter, both generated from uploaded records, and the whole estate is organized around exactly those two things: the navigation has two product pages and no others. There is no case management system, no document repository, no intake pipeline and no workflow layer underneath that a firm would still pay for; a buyer uploads records and receives drafts.

The terms confirm the architecture rather than leaving it to marketing, defining an AI Feature as any component of the services incorporating AI Technology and defining that as machine learning, deep learning, large language models and neural networks generating content from user prompts, and then defining the demand letters and chronologies created under the agreement as Outputs of an AI Feature.

Completeness is asserted on the product pages and disclaimed in the agreement, and nothing is measured. The marketing claim is specific: the chronology captures every injury, treatment and medical event so a firm never misses a critical detail. No accuracy figure, test set, evaluation, error rate or statement of failure modes accompanies it, and no accuracy or benchmark page exists on the estate. Nothing describes grounding either.

No statement says whether an entry in a chronology cites the page of the record it came from, which is the control that would let a paralegal verify the output quickly. The agreement runs against the marketing and governs where they conflict. It provides the services as is with all faults, disclaims any warranty that they will achieve intended results or be free of errors, and makes it entirely the user's obligation to review, revise, edit and proofread all outputs for accuracy and completeness. A vendor cannot both promise that nothing is missed and require the buyer to check everything.

The review point is written into the agreement rather than implied by marketing, and the rest of the control structure is missing. Section 16 states that it is entirely the user's obligation to review, revise, edit and proofread all outputs for accuracy and completeness. The user shall not act on an output, or decide not to act based on one, without first doing so and seeking counsel from an attorney licensed in the applicable jurisdiction.

It adds that outputs are for convenience and information and cannot be relied on to guarantee any outcome. That is a written commitment placing a supervising lawyer between the model and the client, and the review surface is real, since the deliverable is an editable draft the firm finishes. Nothing is published on the system's own side. Nothing describes what runs unattended, no confidence signal or uncertainty indicator is mentioned, nothing states how a firm should verify a chronology against the underlying records, and nothing addresses what happens when an output is wrong. The obligation is allocated, and the means of meeting it is not described.

There are named customers without figures and figures without a named customer. Three testimonials carry full attribution: Tanya Hardin, a paralegal at Johnson Law, who reports the program cut her time by half; Chris Carsten, a partner at Armada Law; and Daniel Swenson, an attorney at Robert Wilson, who says settlement offers came back higher after adoption. None carries a measured figure beyond the halving claim, and none is dated.

Separately, the home page publishes five and a half hours saved per case. The company's February 2025 announcement states that early adopters cut total time on demand packages by more than 50 percent, with no firm named against either. One display element does not hold up. A logo wall says the product is trusted by lawyers and recognized by six organizations. They resolve to Best Lawyers in America, the Million Dollar Advocates Forum, Lawyers of Distinction, Premier Lawyers of America, the Top 100 National Trial Lawyers and Best Law Firms 2024.

Those are attorney award and directory marks, not recognition of this product. A row of Fox, CBS and BBC logos under a featured on heading links to no coverage.

The privilege question is expressly addressed, and two other parts are missing. Section 14 defines confidential information to include, by name, any information protected by attorney client privilege and any sensitive or protected health information. It commits Novo to protect that information with at least a reasonable degree of care, to use it only to perform its obligations, and to restrict disclosure to those who need it.

The privacy policy repeats the commitment, stating that Novo will use industry standard security measures for privileged information and protected health information. Section 16 also has the customer warrant that it holds the rights and consents needed for privileged client data it uploads, so the agreement engages the question head on. The other side of the same document cuts against it. Section 7 reserves an unlimited license to use anonymized outputs to improve the services and to create training data, so privileged material is protected in one clause and used in anonymized form in another. Nothing describes separation between firms or walls at matter level, or what the named model providers retain.

A real published position, with no engagement with the professional rules themselves. Section 16 states that the services and outputs are for convenience and information only, do not constitute legal advice, are not an offer to represent the user or their clients, and do not create an attorney client relationship. It goes further than a disclaimer by imposing conduct. The user must review, revise, edit and proofread every output, and must not act on an output or decline to act on one without first seeking counsel from an attorney licensed in the applicable jurisdiction.

It closes by stating that outputs cannot be relied on to guarantee any outcome in a matter. That is a coherent account of where the product stops, published where a buyer reads it before signing. What is absent is the professional layer. No bar association, rule of professional conduct or ethics opinion is named, nothing addresses the supervision and competence duties that attach when a machine drafts a demand, and nothing addresses what a client is told.

No governance position of any kind is published. There is no responsible AI page, no principles statement, no accountable owner or function named, no testing regime before release, no management system and no certification. Nothing addresses uneven output, and the gap has a concrete shape on this product rather than a formal one: a demand letter is an argument about how much an injury is worth, and nothing published states whether the drafting has been examined for systematic variation across injury types, treatment histories, or the demographic characteristics that appear throughout a medical file.

The estate is small and was inventoried in full on 4 September 2026, comprising two product pages, a blog, a service providers page, terms of service and a privacy policy; none of them addresses governance.

Most of the ground is covered, and the retention period is the notable gap. Storage location is stated: the privacy policy confirms that data is held on Novo's servers in the United States and names what is stored, including account information, resultant data and training data. Rights of access, rectification, erasure, restriction, portability and objection are published with a process and a clock, exercised by email, with a best efforts response in forty five days that can be extended to ninety.

Incident practice is committed rather than implied, the policy stating that in the event of a breach Novo will notify by email or by a notice on the services. The supplier picture is disclosed by name, with a published service providers list naming eight companies and components. Two limits remain. No retention period is stated at all, the policy saying only that data is kept as long as necessary and that the length may vary.

And the commitment to anonymize data before it reaches the AI providers is qualified as best efforts rather than absolute.

The allocation of loss is published, readable before signing, and runs one way throughout. Section 16 provides the services as is and with all faults, disclaiming all warranties including merchantability, fitness for purpose and noninfringement, and expressly warranting nothing about meeting requirements, achieving intended results or being free of errors. Section 17 caps direct damages at the total amount paid in the six months before the event giving rise to the claim, and excludes lost profits, data loss and consequential damages entirely.

Section 18 runs the indemnity from the user to Novo, covering use or misuse of the services and breach of the terms; there is no indemnity from the vendor anywhere, not even for intellectual property. No warranty on output, no service credit, no insurance position and nothing addressing a chronology that omits a treatment or a demand that misstates damages is published. The exposure the product creates is addressed through a standard limitation clause that disclaims it rather than left unstated.

Four case management systems are named on the vendor's own estate, and nothing published describes what moves between them. The home page carries CASEpeer, Smokeball, SmartAdvocate and MyCase under a heading identifying them as case management integration partners, presented as logos with no description, and a blog post announces integrations with MyCase and CASEpeer by title. That is a relevant set of systems for a plaintiff product.

What is missing is everything an implementer would use. There is no statement of what syncs, in which direction or on what trigger, no field mapping, no configuration guide, no API or developer documentation, and nothing about what a firm must do to connect the two systems. No document management, electronic signature or billing integration is named. The integrations announcement post was not opened and may say more.

The residency question is answered plainly and the tenancy question is not. The privacy policy states that personal data about end users and visitors is stored in the United States, that the services are intended for use only inside the United States, and that a user in the European Economic Area or elsewhere consents to transfer of their data there. The terms reinforce it with a geographic restriction section stating that the services are based in the United States and provided only to persons located there.

That is a stated storage location, published where a buyer can read it. Against it, nothing states whether the platform is single tenant or multi tenant, no dedicated or isolated option appears at any tier, and no region choice is offered. The named infrastructure providers, Railway and Supabase, are listed on the service providers page, but no statement ties them to a region or describes the hosting arrangement.

One badge, no scope, no date, no report. The home page displays a HIPAA compliance mark as an image, with no statement of what was assessed, by whom, over what period or against which controls, and the underlying asset filename misspells the statute. HIPAA is in any case a statutory regime under which a business associate attests to its own compliance, not an independent attestation. No business associate agreement is offered or mentioned anywhere, despite the product being built to ingest medical records.

No SOC 2 of either type, no ISO certification, no penetration test summary and no named auditor appears on the estate, and there is no trust center or security page, so there is nothing gated to request and this is an absence rather than a retrieval limit. What the vendor does publish in this territory is described in general terms only, the privacy policy referring to physical, electronic and managerial control procedures and to vetting of outsourced providers, without naming a single control. The estate was inventoried in full on 4 September 2026.

The supply chain is disclosed by name on a dedicated published page, and stops short of the models themselves. The service providers page, incorporated into the terms by reference and reachable without an account, lists eight suppliers with links to each one's terms. GPT by OpenAI and Claude by Anthropic are the AI services used in the platform, Google OCR and the open source Tesseract engine handle optical character recognition, Railway provides infrastructure and deployment, Supabase is the backend platform, Gotenberg handles PDF conversion and Redis handles caching.

Both AI providers and the hosting layer are named. Three limits remain. The models are identified only by product family, as GPT and Claude, with no version stated, so a buyer cannot tell which model reads a medical file. The page states that the list is not exhaustive and may be updated as the platform evolves, with no notice commitment. And section 13 of the terms authorizes Novo to let third party providers process user data whether or not those providers are disclosed to the user or white labeled.

No pricing information is published at any level, including the unit of charge. The site navigation carries only the two product pages and a blog, with no pricing page, and the two calls to action are a free draft and a booked demo. The only commercial statement on the marketing estate invites a buyer to start on a free plan and upgrade when ready. It names no paid tier, rate, unit or included volume, and says nothing about what the free plan contains or where it stops.

The terms describe payment mechanics without figures. Portions of the service may be offered free and certain features are charged, fees are payable in US dollars within thirty days of invoice, and late payment accrues interest at one and a half percent per month. Payments are final and not refundable, and Novo reserves the right to set, remove and revise prices at any time. The amounts themselves live in an order form the buyer sees only through a sales process. A buyer cannot establish whether the product is charged per user, per case, per document or per page.

The segment is stated without ambiguity and one real boundary is drawn. Every surface addresses personal injury plaintiff practice, with the home page headlining the AI built for PI. The scope is narrower still: the stage before litigation, built around the demand package rather than the whole matter. The company's own announcement frames the market as the roughly eighteen million demand packages US personal injury firms send each year.

The terms name the users as law firms, attorneys and legal staff. A limit is published: the services are based in the United States and offered only to persons located there, so a buyer outside the country is told plainly that the product is not for them. The rest of the boundary is absent. No firm size is addressed, and nothing states whether the product suits mass tort, medical malpractice or workers compensation work as against motor vehicle claims.

No variation in demand practice by state or jurisdiction is discussed, and nothing says which record types or matter types it handles poorly.