Behold.ai

The algorithm is the entire product and the business model depends on it entirely. red dot classifies chest X-rays and CT head exams, and the commercial proposition is explicitly positioned as an alternative to outsourced radiology reporting, meaning the AI substitutes for purchased human reporting capacity rather than assisting it. There is no services layer; the company's own framing is that the technology delivers reporting performance at a fraction of the price of outsourcing.

Genuinely autonomous within a deliberately bounded task, and one of only a handful of vendors in this index operating at that end of the axis alongside Oxipit. Exams classified High Confidence Normal are auto-reported and REMOVED from the radiologist worklist entirely, meaning no human reads them.

The oversight mechanism is not human review but the threshold itself: the model reports only the subset it is most confident about, and the published error rate for that subset is the safety argument. Peer reviewed work reports auto-reporting 15 percent of all chest X-rays as normal at a 0.33 percent error rate, against a cited average consultant radiologist error rate of 13.5 percent. Publishing the auto-report rate and its error rate together is exactly the disclosure autonomous operation requires, and it is what separates a defensible autonomy claim from an assertion.

Performance is published in peer reviewed venues with the specific numbers that matter for the autonomy claim, including the proportion of studies auto-reported and the associated error rate, plus a negative predictive value of 93 percent for the CT head product alongside the proportion of scans removed from the reporting workload. Localization is rendered through heatmaps to make outputs interpretable.

Training data composition and architecture are not published, and the 32,000 patient zero-missed-cancer claim on the company site lacks a linked peer reviewed citation, so it should be treated as vendor stated rather than verified.

Nothing identifies any party in the chain: no model or model family, no hosting arrangement and no sub processor list was located, and no retention period, de identification statement, training policy or deletion term was found. The product's function makes the retention question sharper than it would be for an assistive tool.

Studies classified as high confidence normal are auto reported and removed from the radiologist worklist, so for that fraction the vendor's processing record is the only assessment the examination received, and what is retained about it determines whether a later review is even possible.

If a patient presents months afterwards with a finding that should have been visible, the department will want to establish what the system saw, at what confidence, under which model version, and nothing published says any of that is kept or for how long. The quality module that re checks studies called negative is a real safeguard and its outputs are part of the same question, since a re check that finds something generates a record whose handling nobody has described.

The training question is unaddressed too, and it is pointed for a company whose product improves by seeing more normal studies: a corpus of confidently normal images is exactly what such a system needs and nothing states whether customer studies contribute or whether a site can decline. Ask what is retained per auto reported study, for how long, and whether studies inform model development.

Real published evidence plus named NHS deployments, tempered by what the market ultimately decided. Two Clinical Radiology papers underpin the product, one on autonomous diagnosis of normal chest radiographs and one reporting a 60 percent reduction in missed lung cancer when triage ran alongside consultant radiologists in a tumour-enriched dataset.

Named trust deployments include Somerset, where a 3,794 image real world trial found performance closely matching published results and more than halved time from X-ray to CT, Calderdale and Huddersfield reporting a 71 percent reduction in lung cancer waiting times, and Basildon processing 4,415 chest X-rays in 3.5 days against 4 to 8 weeks by outsourcing. A prospective HRA registered mixed methods evaluation of red dot v2 was also underway. The counterweight is significant: NICE withdrew red dot from its recommendations in February 2025, and the original company failed commercially.

Converted from Not Rated, and the prior note identifies a question that goes beyond data handling and deserves to sit at the front of this record.

No retention period, de identification statement, model training policy or deletion term was located.

The distinct issue is clinical responsibility rather than confidentiality. This product auto reports studies it classifies as high confidence normal, which removes them from the radiologist worklist. Peer reviewed work reported auto reporting of about fifteen percent of chest radiographs at a 0.33 percent error rate. That error rate is low and it is not zero, and the patients in it are by construction people whose abnormal film was never opened by a clinician.

Where responsibility sits for such a study is not addressed in vendor materials. The radiologist did not read it. The referring clinician received a normal report. The vendor supplied the classification. In an ordinary miss there is a human whose judgement can be examined; here there is a threshold setting and a service configuration, and it is not clear who chose them or who answers for them.

That is not an argument against the product. Departments that adopt it are trading a small quantified error rate against radiologist scarcity and unreported backlogs, which are themselves harms. It is an argument for the arrangement being explicit rather than implicit.

Ask where clinical responsibility sits contractually, who sets the confidence threshold, and what audit exists over auto reported studies.

Converted from Not Rated. No published position was located, and the corporate history makes the identity of the counterparty a live question rather than a formality.

No business associate agreement, addendum, role statement, subcontractor flow down, breach notification timetable or review cadence was retrieved.

The deployment record is overwhelmingly within the United Kingdom health service, where the operative regime is the European derived data protection framework rather than the United States health privacy rule. That is a coherent position and it means the absence of health privacy rule material is partly explained by where the customers are. The company does hold United States clearance for triage and has validation history there, so the question is live rather than theoretical.

What needs settling first is which entity a buyer would contract with. The original company entered administration in January 2025 after failing to secure contracts under a national artificial intelligence diagnostic fund, and the national assessment body withdrew the product from its recommendations the following month. A successor entity acquired the intellectual property and assets and relaunched under new leadership. Agreements, assurances and any prior compliance work signed by the predecessor do not automatically bind the successor, and a buyer should establish what carried across and what did not.

That continuity question is a procurement criterion in its own right for a product this consequential.

Ask which entity contracts, what obligations transferred on the asset purchase, and what United States terms exist.

Converted from Not Rated, and the prior note catches a substitution error worth naming as a general rule.

No SOC 2 of either type, no ISO 27001, no HITRUST, no trust centre and no penetration testing statement was located.

The successor entity's material cites registration with the United Kingdom care quality regulator. That is a health and social care provider registration, concerned with whether care is safe, effective and well led. It is a substantive regulatory status and it is not an information security attestation, and it does not substitute for one. This index has now recorded the same substitution in five distinct forms: laboratory accreditation, device quality management, notified body conformity assessment, a cloud provider's certifications, and now a care regulator registration. Each is real, each governs something, and none of them evidences how patient data is protected.

The holding deserves stating because of what this product does. It classifies chest radiographs as high confidence normal and auto reports them, removing those studies from the radiologist worklist entirely. The images it processes are therefore, in a meaningful share of cases, the only images no human will ever open, and the system's record of them is the only record the examination was assessed.

Corporate history compounds the question: the original entity entered administration and a successor acquired the assets, so any prior assurance work does not automatically carry across.

Ask what independent assessment the current entity holds.

Multi jurisdiction authorization exists but the regulatory standing is unsettled, and the distinction between clearance and endorsement matters here more than usual. The product holds FDA clearance for radiology triage, validated against more than 800 UK and US cases reviewed by three independent board certified radiologists, plus CE and UKCA marking.

However NICE withdrew red dot from its recommendations in February 2025, following the original company entering administration in January 2025, and sector commentary cites the withdrawal as a case study in why evidence of lifecycle performance and supplier continuity now matter alongside accuracy. Graded C: the clearances are real, the market endorsement was withdrawn, and a buyer must verify what authorizations transferred to the successor entity.

The autonomy threshold design is itself a governance mechanism, since the model only auto-reports where confidence is highest and the published error rate quantifies the residual risk being accepted. Validation spanned UK and US cases reviewed by independent radiologists.

What is absent is demographic subgroup analysis, which is a pointed gap for a product that removes studies from human review entirely: if performance varies across any patient group, those patients disproportionately receive an unread scan. No formal governance framework or post market monitoring commitment was located.

Performance is published in peer reviewed venues with the specific pair an autonomy claim requires: the proportion of studies auto reported and the associated error rate, reported together. Very few vendors publish both, and the pair is what makes the claim assessable, because a high auto report rate is only meaningful against the errors it produced and an error rate is only meaningful against the volume it was drawn from.

A negative predictive value for the head product is published alongside the proportion of scans removed from the reporting workload, and localisation is rendered through heatmaps. Held below the top grade on two things, one of which is the deeper issue on this record. The lesser point is a zero missed cancer claim across a large patient count on the company site with no linked peer reviewed citation, which should be treated as vendor stated rather than verified.

The deeper point is responsibility. Auto reported studies are by construction ones no clinician opened, so in the small error fraction the radiologist did not read it, the referring clinician received a normal report, and the vendor supplied the classification. In an ordinary miss there is a human whose judgement can be examined; here there is a threshold setting and a service configuration, and nothing states who chose them or who answers for them.

That is not an argument against the product, since departments adopting it trade a small quantified error rate against radiologist scarcity and unreported backlogs, which are themselves harms. It is an argument for the arrangement being explicit. Ask where responsibility sits contractually.

The platform integrates with PACS to analyse images within existing workflows, and the auto-reporting function requires write access back into the reporting worklist, which is a deeper integration than read-only detection overlay. Deployment across multiple named NHS trusts demonstrates the integration works across different trust environments rather than a single reference site. No published connector list or API documentation was located.

Converted from Not Rated. No hosting, region, tenancy or residency terms were located.

Nothing published states the cloud provider, whether an on premise option exists, how tenancy is separated, what the subprocessor chain is, or what persists after a study is processed. Several peers in chest radiography publish at least one of these and are credited for it, so the disclosure is achievable in the category.

Two factors make the gap more consequential here than for a detection aid.

The first is what the deployment decides. Because the product auto reports studies it classifies as normal, the environment where inference runs is also the environment where the only assessment of those examinations occurred. The processing location is not merely where data sat; it is where the clinical determination was made.

The second is continuity. The predecessor entity entered administration and a successor acquired the assets. Where a service is hosted by the vendor rather than the customer, an insolvency event puts continuity of access, and access to historical records of auto reported studies, at the mercy of whatever happens to that infrastructure. A department that auto reported studies through a service that then disappears has a records problem as well as a service problem. That is precisely the scenario this vendor's own history illustrates.

Ask where inference runs, whether local deployment is offered, what records of auto reported studies the customer retains independently, and what happens to them on vendor failure.

No pricing is published, though the commercial framing is unusually explicit about what it displaces: the company positions red dot as a cost effective alternative to outsourced radiology reporting, which gives a buyer a concrete benchmark, the per study outsourcing rate, to price against. Reported impact includes reporting time returned equivalent to 19 consultant radiologists.

The overriding commercial consideration is not price but continuity: the original entity entered administration in January 2025 after failing to win NHS AI Diagnostic Fund contracts, and any buyer should establish what the successor entity's contractual, support, and indemnity position actually is.

Two narrow but high volume targets: chest X-ray for normal rule-out and suspected lung cancer triage, and CT head for acute finding triage and normal rule-out, with a reported ability to remove more than 60 percent of CT head scans from the reporting workload at 93 percent negative predictive value. The strategy is deliberately depth over breadth, automating the highest volume normal-heavy workloads rather than detecting many pathologies. Coverage does not extend beyond chest and head.