A healthtech team in Singapore evaluating AI customer support runs into a question teams in the US and Europe rarely answer first: where will patient data physically sit, and can the vendor prove it. The Personal Data Protection Act is not an abstraction here. Since 1 October 2022 the maximum financial penalty for a data protection breach has been the higher of S$1 million or 10 percent of an organization's annual turnover in Singapore, for organizations whose Singapore turnover exceeds S$10 million, as summarized by Allen & Gledhill. That changes how a support platform gets procured.
Most vendors will tell a Singapore buyer they are secure, certified and enterprise-ready. Far fewer answer the narrower question actually asked: whether a Singapore or APAC region exists at all, and what leaves it.
This comparison covers eight platforms through a Singapore healthtech lens: documented data region options, workflow depth, and channel coverage. Where regional hosting could not be verified publicly, that is stated rather than assumed. Lorikeet is ranked second, because a vendor with genuine hosting flexibility should outrank us for a buyer whose hard requirement is Singapore residency.
Key Takeaways
Data residency and inference location are two separate questions. A vendor can store your records in Sydney and still send each conversation to a model endpoint in the United States. Ask both separately, in writing, and ask which subprocessors touch the payload.
No platform on this list publishes a Singapore region. If literal Singapore storage is a hard requirement, your realistic paths are a customer-managed deployment or a negotiated enterprise arrangement.
PDPA obligations attach to your vendor as a data intermediary, not only to you. A vendor processing on your behalf carries the Protection and Retention Limitation obligations and must notify you on credible grounds that a breach occurred, per the PDPC's breach reporting guidance.
Resolution beats deflection here. Most of this queue is multi-step administrative work across several systems. A platform that answers questions but cannot complete the task moves work rather than removing it.
Identity verification is the gate on everything else. Ask how each vendor verifies a patient before touching a record, on every channel, and what the agent is prevented from doing until the check passes.
"PDPA compliant" is not a certification anyone issues. Treat it as a claim about controls and contract terms, and make the vendor show which products are in scope.
Why Singapore healthtech evaluates AI support differently
Healthtech support volume is dominated by administrative work spanning several systems. A patient moving an appointment, querying an invoice, checking whether a prescription shipped or updating an insurance detail is asking something no single system answers. The agent has to read from one place, write to another, and stay inside rules about what can be said and to whom. That is why knowledge-base chatbots underperform here.
The security stakes are also concentrated. IBM's Cost of a Data Breach report has put healthcare at the top of the per-industry breach cost table for over a decade. A support platform reads customer records and acts on them by design, so it lands in the highest-scrutiny tier of a vendor review.
Singapore adds a third dimension. Buyers here often arrive with an internal policy, an enterprise customer's contractual requirement, or a board expectation that personal data stays in-region. Often that is a risk posture rather than a statutory requirement, since the PDPA permits transfers outside Singapore where the recipient is bound to a comparable standard of protection. Working out which one you face, before you shortlist, is the highest-leverage step in the evaluation.
Comparison at a glance
Regions below come from each vendor's own public documentation as of September 2026. "Not documented" means no public region list, not that no option exists privately.
Platform | Documented data regions | Singapore region |
|---|---|---|
1. Cognigy | EU, US, UK, Australia (Sydney); via NiCE CXone clusters also Japan (Tokyo), India (Mumbai), Canada, South Africa | No |
2. Lorikeet | United States, European Union, Australia | No |
3. Kore.ai | USA, UK (London), EU (Frankfurt), Australia (Sydney), Japan (Tokyo), India, UAE | No |
4. Freshworks | US, EEA, UAE, India, Australia | No |
5. Zendesk AI | United States, EEA, UK, Japan (Tokyo or Osaka), Australia | No |
6. Intercom Fin | United States, European Union, Australia | No |
7. Maven AGI | Not documented publicly | Not documented |
8. Ada | USA, Canada, and Europe as an opt-in storage option | No |
The pattern is the point. Not one of these eight publicly documents a Singapore region. If your requirement is literal in-country storage, this category does not serve it off the shelf, and your realistic paths are a customer-managed deployment, a negotiated enterprise carve-out, or a decision that an APAC region plus PDPA transfer terms is acceptable.
How these eight were selected
The pool started from platforms a Singapore healthtech team would plausibly meet in a 2026 evaluation: vendors with real APAC deal presence, vendors regulated companies already run in production, and the incumbent helpdesk AI layers most teams already own a seat for. Each was assessed on documented region options taken from the vendor's own public pages rather than a sales call, whether it completes multi-step workflows or mainly answers, and channel coverage. Compliance statements are reported as what the vendor states, not as verified fact.
What the PDPA actually asks of a support vendor
The PDPA does not issue certifications. There is no PDPA certificate for a vendor to hold up, so any vendor describing itself as "PDPA certified" is describing something that does not exist. What the Act does is impose obligations, some of which attach directly to a vendor acting as a data intermediary on your behalf.
A data intermediary processing personal data for another organization is subject to the Protection Obligation and the Retention Limitation Obligation, and to the breach notification duties in Part 6A. Practically: secure the data, do not keep it longer than needed, and tell you without undue delay on credible grounds that a breach occurred, so your own three-calendar-day clock to notify the PDPC can start. The PDPC also recommends due diligence on a prospective data intermediary and an explicit scope of processing in the contract.
Cross-border transfer is the part that gets conflated with residency. The Transfer Limitation Obligation does not prohibit sending personal data overseas. It requires appropriate steps to ensure the recipient is bound by legally enforceable obligations providing a comparable standard of protection, usually handled in contract rather than geography. If your enterprise customers have imposed a stricter in-region requirement, that is real, but it comes from the contract, not the PDPA.
Residency is not the same as inference location
Residency describes where records are stored and processed at rest: database, object store, logs. Inference location describes where the model that reads a conversation and generates a reply actually executes. Those are often different places, because frontier models are served from a small number of provider regions and the United States is the default for most. A vendor can accurately say your data is stored in an APAC region while each message still travels to a US model endpoint for the inference call. Neither fact is dishonest alone. Presenting only the first one is.
1) Cognigy
Best for: Healthcare contact centers that want the widest documented choice of hosting regions and deep voice automation.
Data regions: SaaS clusters in Europe, the US, the UK and Australia (Sydney). Through NiCE CXone shared clusters the list extends to Japan (Tokyo), India (Mumbai), Canada and South Africa. No Singapore cluster is published.
Pricing: Not public. Enterprise quote only; Cognigy does not maintain a pricing page.
Cognigy, now part of NiCE, provides enterprise AI agents across voice and digital channels, with healthcare among its named verticals: identity verification, appointment management, billing and insurance updates and digital intake.
Key Features
A published cluster list covering more distinct regions than any other vendor here, including three in APAC
Voice automation across 30-plus voice and digital channels, with contact center integration as the design center
Appointment, billing, insurance and intake workflow templates, with agent assist alongside full self-service
Dedicated and self-managed deployment options for buyers who cannot use a shared cluster
Why It Made the List
It ranks first on the criterion this article is built around. A Singapore buyer with a regional hosting mandate has more room to work with Cognigy than with anyone else here, because there are more documented places to put the data and because self-managed deployment exists where a shared cluster will not clear a security review. Sydney, Tokyo or Mumbai is not Singapore, but it is closer to a defensible position than a US-only footprint.
The limits. No BAA statement could be verified on a Cognigy-owned page, so get it in writing rather than infer it. There is no public pricing, and its strength is channel breadth rather than a healthcare-specific operating model, so expect configuration work.
2) Lorikeet
Best for: Healthtech teams whose priority is completing multi-step patient workflows end to end, and who can accept APAC-adjacent rather than Singapore-resident storage.
Data regions: United States, European Union and Australia. There is no Singapore region. Model inference runs in the United States regardless of which storage region is selected.
Pricing: Public. Start at $2,100 per month with chat, email and SMS at $0.99 per resolution and voice at $1.50. Scale at $5,100 per month at $0.90 and $1.20. Signature is custom.
Lorikeet builds AI customer support agents for complex and regulated companies, with healthtech as a core vertical. It is built around completing workflows rather than answering questions: the agent reads from and writes to the systems a support team already runs, follows configured procedures, and hands to a human when the situation calls for judgment. We rank ourselves second rather than first, deliberately. For a buyer whose hard requirement is Singapore-resident storage, Lorikeet does not meet it, and a vendor with more deployment flexibility should win.
Key Features
Multi-step workflow execution across connected systems: reading records, taking approved actions, writing results back
Identity verification by one-time passcode before any account action, so the agent cannot read or change a patient record until the check passes
SMS and voice on Lorikeet's own telephony, with number provisioning, both channels on one number, and call routing that can replace an IVR
Per-channel business hours and escalation settings, with after-hours routing configured per channel rather than globally
Named ticketing connectors for Zendesk, Intercom, Salesforce, Kustomer, Front and HubSpot, plus a custom API path
Flexible Ticketing System, which connects any webhook-based ticketing system without a bespoke connector. It is configured with Lorikeet's team rather than self-serve, and does not cover voice.
Residency in the US, EU and Australia, SOC 2 Type II, HIPAA Business Associate Agreements available, and zero-data-retention agreements with the model vendors used for inference
Why It Made the List
The case here is workflow depth and channel coverage in one platform. Patient support is rarely one question. It is an appointment change that turns into a billing question that turns into an address update, each touching a different system. Lorikeet finishes that sequence rather than deflecting it.
The published proof in this vertical is Australian, not Singaporean. easykind, an Australian healthtech company, cut email response times by 92 percent, from about 24 hours to roughly 2 hours, and runs 24/7 patient chat in its logged-in patient experience with automatic escalation when a side effect is reported. Its head of patient support states the team would need four more hires immediately without it. Eucalyptus, a digital health provider with clinics in Australia, the UK, Germany and Japan, moved median first response time from over 20 hours to 90 seconds while reporting CSAT at or above its human agents.
Now the limits, plainly. Lorikeet has no Singapore data region, no Singapore entity and no published Singapore customer. We have not carried out a PDPA assessment or certification of any kind, and nothing here should be read as a claim that we have. Model inference runs in the United States even when data at rest is stored in Australia or the EU. That is a fact about how frontier models are served today, not a configuration choice, and it applies to most vendors here whether or not they say so. If in-region Singapore storage is a contractual requirement, Lorikeet is the wrong answer. Otherwise, the demo tests it against your own queue.
3) Kore.ai
Best for: Healthtech organizations that need a deployment they can place and control themselves, or that want pre-built healthcare agent templates.
Data regions: Region-specific platform URLs and fixed outbound IP ranges are published for the USA, the UK (London), the EU (Frankfurt), Australia (Sydney), Japan (Tokyo), India and the UAE. No Singapore region appears.
Pricing: Partially public. Documentation describes a default pay-as-you-go standard plan with enterprise plans by quote. There is no public price list.
Kore.ai offers an enterprise agent platform plus healthcare applications for providers, payers and life sciences, covering self-service, scheduling, billing and claims.
Key Features
Seven documented platform regions including three in APAC
Pre-built healthcare applications and agent templates rather than a blank canvas
Multi-agent orchestration, with published fixed outbound IP ranges per region that simplify firewall review
Deployment flexibility for organizations that cannot use a shared SaaS tenant
Why It Made the List
Kore.ai earns third on the criterion that put Cognigy first: a Singapore buyer has somewhere credible to put the data, and a published region list with fixed IP ranges is what a security reviewer wants to see.
That breadth is also the trade-off, since governance gets harder as configured applications multiply. Kore.ai markets HIPAA-compliant healthcare applications and BAA availability is widely reported, but it was not verifiable on a Kore.ai-owned page, so confirm BAA, product scope and hosting in the contract.
4) Freshworks
Best for: Cost-sensitive healthtech teams that want a documented APAC data region at the lowest entry price on this list.
Data regions: Documentation states data centers are in the US, the EEA, the UAE, India and Australia, with the region chosen at signup. No Singapore data center is listed.
Pricing: Public and the lowest here. Growth at $19 per agent per month, Pro at $55, Enterprise at $89, billed annually. Freddy AI Agent is included for the first 500 sessions, then $49 per 100 sessions. Copilot is $29 per agent per month.
Freshworks bundles ticketing, messaging, voice and the Freddy AI layer into one suite, the least expensive way onto this list by a wide margin.
Key Features
Documented data center selection at signup across five regions, including Mumbai and Sydney
Freddy AI Agent for customer-facing automation and Freddy AI Copilot for agent assistance
Ticketing, messaging and voice inside a single suite and contract
Published HIPAA configuration guidance, with BAA scope limited to a named set of products
Why It Made the List
The region list is documented on a Freshworks-owned support page rather than inferred, which is more than several better-known vendors manage, and Mumbai plus Sydney gives an APAC-first buyer a real choice at a price a seed-stage company can start at.
BAA coverage is scoped to specific products rather than the whole portfolio, so confirm the products you plan to run sit inside it. The trade-off is depth: Freddy is strong at answering questions and less proven at the long multi-system workflows that dominate healthtech queues.
5) Zendesk AI
Best for: Healthtech teams already standardized on Zendesk that want AI inside the same environment.
Data regions: The Regional Data Hosting Policy names the United States, the European Economic Area, the United Kingdom, Japan (Tokyo or Osaka) and Australia. Regional hosting requires the Data Center Location add-on. No Singapore region is offered.
Pricing: Public. Suite Team at US$55 per agent per month, Suite Professional at US$115, Suite Enterprise custom. The Copilot add-on is US$50 per agent per month annually, with AI agent resolutions billed per resolution on top.
Zendesk combines ticketing, AI agents, routing, agent assistance and contact center capability in one platform. For an organization already on Zendesk, the AI layer is the shortest path to production.
Key Features
Regional data hosting in five named regions including Japan and Australia, via a paid add-on
AI agents and agent assistance native to the Zendesk workspace and ticketing data model
Smart routing and unified customer context across channels
BAA available through the Advanced Data Privacy and Protection add-on
Why It Made the List
Incumbency is a real advantage and it would be dishonest to pretend otherwise. If a team's tickets, macros, routing rules and reporting already live in Zendesk, the AI layer inherits that context on day one, and the Tokyo, Osaka and Sydney options put it in the same regional tier as most of this list.
Regional hosting is an add-on, not a default, so the APAC hosting conversation is also a commercial one. The same is true of the BAA, gated behind the Advanced Data Privacy and Protection add-on and, by most accounts, a higher plan tier. Confirm the plan floor with Zendesk directly rather than third-party summaries, including ours.
6) Intercom Fin
Best for: Digital health companies already running Intercom that want an AI agent without changing support environments.
Data regions: Exactly three: the United States, the European Union (Dublin) and Australia (Sydney). No Singapore region. Regional hosting is available only to new workspaces on higher plans and on a contract account.
Pricing: Public and usage-based. Fin is $0.99 per outcome, where an outcome is a resolution, a procedure handoff or a disqualification, with a 50 outcome monthly minimum on a non-Intercom helpdesk. Running Fin inside Intercom adds $29 per helpdesk seat per month.
Fin retrieves knowledge, applies configured support procedures, takes actions through connected systems and escalates when confidence thresholds are not met.
Key Features
Regional data hosting in the US, EU and Australia, with the region visible in the workspace URL
Per-outcome pricing that is unusually legible compared with seat-based models
Knowledge-grounded answers with configured support procedures rather than pure retrieval
Actions through connected systems, with human escalation that carries context
Why It Made the List
For a digital health company already on Intercom, Fin is the lowest-friction option here, and per-outcome pricing makes cost forecasting easier than the seat-plus-add-on structures elsewhere.
Catch the hosting constraint early: regional hosting is restricted to new workspaces on higher plans, so a company that started in the US region and later needs Sydney faces a workspace migration, not a setting. On HIPAA, public sources conflict about whether Intercom signs a BAA, and no Intercom-owned page confirming availability could be located. That is not a claim that they do not, only that we could not verify it either way.
7) Maven AGI
Best for: Large healthcare organizations running a full enterprise procurement where hosting region is a negotiated term rather than a published option.
Data regions: Not documented publicly. No region or data residency list could be found on Maven AGI's website or trust center; both cover certifications and controls such as tenant isolation and encryption without naming a hosting region. Third-party claims of specific Maven regions should be treated as unverified.
Pricing: Not public. Enterprise quote only, with no pricing page.
Maven AGI is an enterprise AI agent platform built around a single reasoning engine applying the same knowledge, policies and decision logic across chat, email, voice and web.
Key Features
One reasoning engine across chat, email, voice, web, SMS and messaging channels
A large connector library spanning support, CRM, data, knowledge and contact center systems
Real-time sensitive-data redaction for voice and text interactions
A published trust center listing HIPAA and HITECH independent assessment reports
Why It Made the List
Maven is a capable platform with genuine workflow depth, real voice capability and one of the more complete published compliance postures in the category. On product substance it would rank higher on a list organized around capability.
It sits at seven for a narrow reason: this article is organized around a buyer whose first question is where the data will live, and Maven publishes no answer. If you evaluate Maven, establish early which hosting regions exist, whether any are in APAC, and whether a BAA is available, since that is not stated on Maven's own pages even though HIPAA and HITECH assessment reports are listed on the trust center.
8) Ada
Best for: High-volume, digital-first support teams where hosting region is not a hard constraint.
Data regions: Ada publishes no region list. Its subprocessor page lists AWS for hosting and AI models with locations given as the USA, Canada and Europe, where European storage applies only to customers enrolled in Ada's Europe data storage option. No APAC region is documented publicly.
Pricing: Not public. Ada's pricing page is a demo booking page with outcome statistics rather than figures.
Ada is an AI customer service platform aimed at high-volume consumer support, with a mature automation product and a long track record.
Key Features
Automated resolution across chat and digital channels at high volume
Europe data storage as an opt-in option on top of North American hosting
A trust center listing HIPAA among its compliance items
Published subprocessor list naming hosting and model providers with locations
Why It Made the List
Ada belongs in an honest comparison because healthtech teams do encounter it, and its automation product is strong for high-volume digital support. Its published subprocessor list with named locations is more transparency than several vendors here offer.
It ranks last because of the criterion this article applies. North America plus an opt-in European storage option, with no APAC region at all, is the least accommodating position of the eight for a buyer who cares where data sits. Ada lists HIPAA on its trust center with an assessment report, though BAA availability is not publicly stated.
How to choose for a Singapore healthtech deployment
1. Establish whether in-region storage is a legal requirement or a preference
Do this before a single demo. If a customer contract or internal policy makes Singapore-resident storage non-negotiable, your shortlist collapses to vendors offering a deployment you can place in Singapore yourself. Otherwise, anything with an APAC region qualifies and workflow depth decides.
2. Separate the residency and inference questions in writing
Send both to every vendor in one email and compare the answers side by side. Vendors that conflate them, or answer the inference question with a sentence about encryption, are telling you something useful.
3. Test workflow completion, not answer quality
Answer quality across serious vendors in 2026 is broadly similar. Workflow completion is not. Build a scenario from your real queue: a patient rescheduling an appointment, with a billing question about the original booking, who also needs an address updated. Watch whether the agent finishes all three.
4. Check identity verification before account actions
In healthtech the security boundary is the identity check. Ask how each platform verifies a patient before reading or changing a record, whether it works on every channel, and what the agent is prevented from doing until verification succeeds.
5. Confirm channel coverage against your real mix
Support here skews toward messaging and voice. Confirm which channels are native, which need a telephony contract you source yourself, and which are roadmap.
Feature and gap matrix
Platform | APAC region documented | Multi-step workflow execution | HIPAA BAA publicly confirmed |
|---|---|---|---|
Cognigy | Yes: Sydney, Tokyo, Mumbai | Yes | Confirm with vendor |
Lorikeet | Yes: Australia only. No Singapore region. | Yes | Yes, BAA available |
Kore.ai | Yes: Sydney, Tokyo, India | Yes | Confirm with vendor |
Freshworks | Yes: Mumbai, Sydney | Limited | Yes, for a named product scope |
Zendesk AI | Yes: Tokyo, Osaka, Sydney | Partial | Yes, via a paid add-on |
Intercom Fin | Yes: Sydney only | Yes | Not verifiable publicly |
Maven AGI | Not documented | Yes | Not stated on vendor pages |
Ada | No | Partial | Not stated on vendor pages |
Three gaps are worth naming, including our own. Nobody here offers Singapore. Lorikeet does not, and neither does anyone else. Our regions are the United States, the European Union and Australia.
Inference is a US story across the category. Lorikeet runs model inference in the United States regardless of the storage region selected, and we hold zero-data-retention agreements with the model vendors used. Most platforms here are similar, but few say so.
Subprocessor coverage is not uniform. A HIPAA BAA with a platform vendor does not automatically mean every subprocessor in the chain is covered by one. Ask for the subprocessor list and the specific coverage position rather than assuming it flows through. That applies to Lorikeet too.
Related: Singapore financial services, APAC fintechs, healthcare, SOC 2 and HIPAA, and telehealth and digital health.
