bioAffinity Technologies

Per the company's SEC filings, automated analysis developed by machine learning standardizes sample data analysis and patient test results, and the platform is described as flow cytometry plus AI. Held back from A because the diagnostic signal originates in the wet lab chemistry (a fluorescent porphyrin preferentially taken up by cancer cells) with ML performing the classification layer over it.

Bounded, adjunctive, and the company states the limits itself.

The test is ordered by a physician to assess patients with small indeterminate pulmonary nodules. It does not diagnose. It risk stratifies a patient already under investigation, and the company describes it explicitly as not intended as a sole diagnostic tool. A published case study frames the outcome correctly for this class of product: the result supported the physician's assessment, prompted follow up imaging, and deferred a biopsy that would otherwise have been performed. The decision stayed with the clinician throughout.

What lifts this to an A is candour in a place most companies avoid it. In its own securities filings the company cautions that statements about the test's capabilities are forward looking, and specifically names uncertainty about its ability to indicate cancer probability or to confirm that a patient is cancer free. A negative predictive value of 99 percent is the number a marketing department would lead with, and the company publishes the caveat alongside it.

The oversight model that matters here is therefore the ordering pathway rather than an interface control. Establish locally what a positive result triggers and what a negative result is permitted to rule out, because the second is where an adjunctive test is most likely to be over read.

Clinical performance is reported with its cohort. The model behind it is not described at all.

What is published is better than the category average on the clinical side. Sensitivity of 92 percent, specificity of 87 percent, accuracy of 88 percent and negative predictive value of 99 percent are reported against a stated population, being high risk patients with nodules under 20 millimetres. Naming the cohort matters, because a performance figure without its denominator is uninterpretable and this index has repeatedly found vendors publishing exactly that.

The method is described only at concept level: flow cytometry of a sputum sample, a fluorescent porphyrin preferentially taken up by cancer and cancer related cells, and automated analysis developed by machine learning. Securities filings describe the artificial intelligence as standardising sample data analysis and patient test results.

Nothing further is disclosed. No description of the training data or its size and composition, no model architecture, no validation methodology beyond the trial itself, no statement of how the model is updated or versioned, and no account of how performance is monitored once the assay is running at commercial volume.

Ask what the model was trained on, and whether the reported figures describe the version currently in production.

No clinical privacy position was located, and the one privacy document that surfaces is the wrong one. The published policy governs the investor relations website and states plainly that the section does not collect, store or process protected health information and is not subject to the health privacy rule.

That statement is accurate and appropriately scoped for what it covers, and it is not a patient facing document, so a search for this company's privacy practices returns a page about investors rather than anything describing what happens to a patient's sample. A correct document in the wrong place is worse than none, because it satisfies a reader who was looking for something else.

Nothing was retrieved describing specimen retention, how long derived data is held, whether samples or results inform further research or model development, or whether a patient can withdraw. One handling detail is disclosed and belongs here because it is a real custody question rather than a theoretical one: securities filings state that the laboratory relies on commercial courier services to transport sputum samples and treat disruption to those services as a business risk.

The samples physically travel, and chain of custody in transit is part of stewardship even though it sits outside every information security control, which is the second instance in this backfill of patient material existing as a physical object. Ask for specimen and data retention terms and any secondary research use before ordering.

Specific performance figures are published from a clinical trial in high risk patients with indeterminate nodules under 20 millimeters: 92 percent sensitivity, 87 percent specificity, 88 percent accuracy, and 99 percent negative predictive value. Held back from A because the trial cohort size is not stated in the retrieved materials and the supporting evidence is largely company published case studies and conference posters rather than large prospective trials.

No clinical privacy position was located, and the one privacy document that surfaces is the wrong one.

The published privacy policy governs the investor relations website and states plainly that the section does not collect, store or process protected health information and is not subject to the health privacy rule. That statement is accurate and appropriately scoped for what it covers. It is also not a patient facing document, and a search for this company's privacy practices returns it rather than anything describing what happens to a patient sample or the data derived from it.

Nothing was retrieved describing specimen retention, how long derived data is held, whether samples or results are used for further research or model development, or whether a patient can withdraw.

One handling detail is disclosed and it belongs here because it is a real custody question rather than a theoretical one. Securities filings state that the laboratory relies on commercial courier services to transport sputum samples, and disclose that disruption to those services is a business risk. The samples physically travel, and chain of custody during transit is part of stewardship even though it sits outside any information security control.

The filings also carry a risk factor acknowledging that security breaches and data loss could compromise sensitive information.

Ask for specimen and data retention terms and any secondary research use before ordering.

The status is unambiguous and the required document was not found.

The test is performed by a wholly owned laboratory subsidiary that is CLIA certified and CAP accredited, and that bills for testing performed on physician referral. A clinical laboratory operating that way is a covered entity in its own right, not merely a business associate, and a covered entity with a direct treatment relationship is required to produce and distribute a notice of privacy practices. This is the same reading applied elsewhere in the diagnostics lane of this index and it holds here.

No notice of privacy practices, no patient facing privacy statement and no business associate terms for the ordering practice were retrieved.

The finding is sharper than a simple absence because of what does exist. The company publishes a privacy policy that expressly disclaims application of the health privacy rule. That disclaimer is correct as written, since it governs an investor relations website. But the entity that is subject to the rule publishes nothing findable, while the entity that is not publishes a policy saying so. A patient searching for how their sample is governed finds a document about investor mailing lists.

Absence of a retrieved document is not proof none exists, and the laboratory may distribute a notice at the point of collection. Ask the ordering practice to produce it.

Two real accreditations are held and neither is an information security attestation.

The laboratory subsidiary is CLIA certified and CAP accredited. Both are substantive and both are the right credentials for what they cover: whether the laboratory is competent to produce an accurate result, whether staff are qualified, whether equipment and recordkeeping meet standard, and whether it passes routine inspection. Neither says anything about how the data generated is protected once it exists.

That distinction is settled precedent in this index and it applies in the same form to laboratory accreditation as it does to device quality management standards. A credential governing whether a result is produced correctly is not a credential governing how the resulting information is secured. Do not count CLIA or CAP on this axis.

No SOC 2 of either type, no HITRUST, no ISO 27001, no trust centre and no penetration testing statement were retrieved.

One partial offset comes from being listed. Securities filings carry a risk factor acknowledging that breaches, data loss and disruption could compromise sensitive information, and a listed company is required to describe its cybersecurity risk management in its annual report. That is more visibility into the risk than a private laboratory of comparable size provides, and it is disclosure of exposure rather than evidence of control.

Ask whether any independent security assessment has been performed.

Stated clearly: CyPath Lung is marketed as a laboratory developed test through the company's own CLIA laboratory, and the company explicitly states it is not intended for use as a sole diagnostic tool and should be considered alongside other clinical findings. No FDA clearance is claimed. Held back from A because no active regulatory pathway or timeline is disclosed.

No subgroup performance, no bias testing statement, no governance framework and no third party model review was retrieved.

The concern here is specific to the sample type rather than generic. The test reads a sputum specimen, and the ability to produce an adequate sputum sample is not evenly distributed. It varies with smoking history, with the presence and severity of chronic obstructive pulmonary disease, with age, and with the patient's physical capacity to perform the collection. The intended population is high risk patients, which is precisely the group in which these factors cluster.

That creates two distinct questions the published material does not address. Whether assay performance varies across demographic groups is the usual one. Whether sample adequacy failure rates vary across those groups is the one particular to this product, because a patient who cannot produce a usable sample is not a false negative, they are absent from the denominator entirely, and a test that quietly excludes part of its intended population would not show up as reduced accuracy.

Ask for the sample adequacy and rejection rate, broken out by patient characteristics, alongside performance.

Clinical performance is reported with its cohort, which is what lifts this above the floor. Sensitivity, specificity, accuracy and a high negative predictive value are published against a stated population of high risk patients with nodules below a named size threshold. Naming the cohort matters because a performance figure without its denominator is uninterpretable, and this index has repeatedly found vendors publishing exactly that.

The nodule size band is the part that makes the figures usable, since performance on small nodules and on large ones are different problems and a pooled figure would describe neither. The method is described only at concept level, covering flow cytometry of a sputum sample, a fluorescent marker preferentially taken up by cancer and cancer related cells, and automated analysis developed by machine learning.

Nothing further is disclosed: no training data description, size or composition, no architecture, no validation methodology beyond the trial itself, no statement of how the model is updated or versioned, and no account of how performance is monitored once the assay runs at commercial volume.

That last is the one to press, because a laboratory assay's performance in a trial and its performance across routine collection, variable sample quality and different sites are not the same thing, and a high negative predictive value is exactly the figure that decays first when case mix shifts. No warranty, indemnity or remediation commitment attaches. Ask what the model was trained on, whether the reported figures describe the production version, and how drift is detected.

Order in, report out, with nothing published about how either travels.

No electronic health record integration, laboratory interface, structured result delivery or discrete result coding was described. No ordering interface for the referring practice was retrieved either, so the front of the workflow is as undocumented as the back.

The consequence is specific to what this test is for. It is used to risk stratify indeterminate pulmonary nodules, and nodule management is a surveillance activity that runs on intervals, often over years. A result that lands as a document rather than as discrete data is a result a practice has to track manually alongside imaging intervals and other follow up. The published case study describes exactly the workflow that depends on this: a result that prompted follow up imaging and deferred a biopsy. Both of those are downstream actions that need to be scheduled and confirmed.

Distribution reach and integration depth should not be confused. Growing test volume, reported at more than 200 percent year over year in a recent quarter, describes adoption rather than how the result reaches the chart.

Ask how results are delivered, whether discrete values or only a report, and whether an ordering or resulting interface exists for your record system.

A laboratory service, so transfer is total by design, and here it is physical as well as digital.

The sputum specimen leaves the ordering practice and travels by commercial courier to the laboratory. Everything downstream, the flow cytometry, the automated analysis and the report, happens there. There is no configuration in which the work stays with the buyer, and that is inherent to the model rather than a shortcoming.

Two facts from the securities filings sharpen the picture in ways a website never would. The company operates a sole laboratory facility, and discloses as a risk factor that if that facility becomes damaged or inoperable, loses its accreditation or has to be vacated, its ability to sell tests may be jeopardised. And it discloses dependence on commercial courier services, whose disruption would harm the business. For a buyer, that is a concentration and continuity question with no second site behind it.

Nothing is published on the data side: no hosting provider, no region, no tenancy model, no subprocessor list and no retention terms for the analytical data or the report.

Ask what the continuity plan is if the single facility is unavailable, what the specimen turnaround commitment is, and where the derived data resides.

Structure is inferable rather than published: the test is sold to physicians through the company's own pathology laboratory and is reimbursed by Medicare and private insurance carriers, per SEC filings. No list price is published.

Tightly and honestly scoped: physicians ordering for high risk patients with small indeterminate pulmonary nodules, as an aid to decision making rather than a screening test for the general population. Narrow coverage clearly stated is exactly what this axis rewards.