bioAffinity Technologies

The model is the engine of the test's result, and the diagnostic signal starts in the wet lab. The company's 2025 annual report (filed March 2026) describes a patented algorithm developed using machine learning that automatically analyzes a patient's flow cytometry data and generates a physician's report within minutes, stratifying the patient as Likely or Unlikely to have lung cancer; the Medicare PLA code for the test (0406U) itself ends "algorithm reported as likelihood of lung cancer". The signal the algorithm reads comes from the chemistry: induced sputum collected over three days, labeled with antibodies and a porphyrin preferentially taken up by cancer and cancer related cells, run on a flow cytometer. Remove the model and the flow cytometry remains, but not the reported result.

The parent also runs Precision Pathology Laboratory Services, a CAP accredited, CLIA certified pathology laboratory selling other services to outpatient physicians, which is value that stands without the AI.

The oversight structure is described and one part is missing. The test is ordered by a physician for a high risk patient with an indeterminate pulmonary nodule; the algorithm reports Likely or Unlikely with a probability score to the physician, who decides what follows, and the company's published case studies show exactly that (a Likely result leading to diagnosis at stage 1A; an Unlikely result deferring a biopsy that follow up imaging later justified). The company describes the test as not intended as a sole diagnostic tool, to be considered with other clinical findings, and its annual report cautions that statements about the test's ability to indicate cancer probability are forward looking.

What is missing is what a result is permitted to rule out. With a published positive predictive value of 44 percent and negative predictive value of 99 percent, an Unlikely result is the one most likely to be over read, and nothing states the nodule characteristics or clinical findings under which it should not defer a biopsy. The home page also tells physicians they receive a definitive answer, which sits uneasily beside the company's own sole diagnostic tool caution.

The approach and the training data are described in the company's own paper; versions and updates are not. Lemieux et al., Respiratory Research 2023, describes the pipeline: induced sputum collected over three days is made into single cell suspensions, labeled with a viability dye, antibodies for cell types and a porphyrin for cancer associated cells, run on a flow cytometer, and processed by an automated analysis pipeline feeding a machine learning model, developed on random training and test splits from 150 high risk patients (28 with cancer) using flow data and patient features, then tested on 32 independent samples. The Medicare code descriptor names the five markers (the porphyrin TCPP, CD206, CD66b, CD3 and CD19). The annual report calls the algorithm patented and describes a physician's report generated within minutes of data acquisition.

The site names no model type and does not say whether the production algorithm is the one in the paper, how it is versioned or updated, or how performance is monitored at commercial volume. The annual report mentions a later study concluding that analyzing the entire sputum sample would improve results, which suggests the method has changed since.

A structurally short chain: the model is the company's own and runs in its own laboratory. The annual report describes a patented algorithm the company developed with machine learning that analyzes flow cytometry data acquired in its CLIA laboratory, and the development paper was written by company scientists with an outside bioinformatics consultancy (Bioinfo, Ontario) as first author. Nothing published suggests a patient's data leaves the company for a third party model.

The parties that are named sit around the specimen rather than the model: FedEx carries the prepaid sample kits, Cardinal Health has a logistics agreement, and the annual report says third party cybersecurity providers manage parts of the company's IT, including vulnerability scanning and monitoring. There is no hosting provider named, no subprocessor list, and no retention or research use terms for samples and derived data.

Published research on the test, led by the company and short of independent validation. Lemieux et al., Respiratory Research 2023;24(1):23: a model developed on induced sputum from 150 high risk patients (28 with lung cancer) collected at sites including Mount Sinai, the South Texas Veterans Health Care System, and pulmonary and radiology practices in Connecticut, New Mexico and New Jersey, then tested on an independent set of 32 samples (6 with cancer). Development: area under the curve 0.89, sensitivity 82 percent, specificity 88 percent, negative predictive value 96 percent, positive predictive value 61 percent; nodules under 20 millimeters, sensitivity 92 percent and specificity 87 percent. Independent set: area under the curve 0.85, sensitivity 83 percent, specificity 77 percent, negative predictive value 95 percent, positive predictive value 45 percent.

The headline figures on the home page (92 percent sensitivity, 87 percent specificity, 88 percent accuracy) come from the under 20 millimeter subgroup of the development cohort, not from the independent test set, whose six cancers are too few to settle performance. The company also cites an economic evaluation (Journal of Health Economics and Outcomes Research, 2024) and company case studies. No prospective or independent validation is published, and the September 2026 extension to surveillance of lung cancer survivors has no published performance.

General assurances of security that do not answer what happens to a patient's sample and data. The company's 2025 annual report describes a cyber risk program with industry standard encryption, critical data backups, access management and incident response. The published privacy policies are website notices: bioAffinity's covers its investor site and states it does not process protected health information, and Precision Pathology Laboratory Services' policy covers its website and excludes personal information processed for business customers.

Nothing published says how long specimens and derived flow cytometry data are kept, whether samples or results are used for further research or model development, or whether a patient can withdraw. Patients collect the sample at home and ship it overnight by FedEx in a prepaid pack to the laboratory, so the specimen is a physical object with a chain of custody, and the annual report names a logistics agreement with Cardinal Health.

No safety engineering is published for the algorithm: no monitoring of performance at commercial volume and no process for handling a misreported result.

No statement of HIPAA status and no privacy document that reaches the test. The company's privacy policy governs its investor relations website and states that it does not collect, store or process protected health information and is not subject to HIPAA; the privacy policy of Precision Pathology Laboratory Services, the laboratory that runs the test, governs its website and marketing and says it does not apply to personal information processed for business customers. Neither describes how a patient's sample, report or health information is handled, and no notice of privacy practices is published on the company site, the laboratory site or the CyPath Lung site, which offers a patient portal and a records release form.

A CLIA laboratory billing for tests on physician referral is ordinarily a covered entity with its own notice obligation; that is an inference from the business model, and the notice itself is not published where a patient or ordering practice would look for it.

Controls are described with an outside check behind them, and no attestation. The company's 2025 annual report (Item 1C, filed March 2026) describes a cyber risk management program aligned to the NIST Cybersecurity Framework, run with industry recognized third party cybersecurity providers that perform periodic vulnerability scanning, identity and access management, endpoint detection and response, encryption, backups, incident response and cyber risk assessment and remediation, with the audit committee briefed at least annually.

The laboratory's CAP accreditation and CLIA certification are real credentials for producing an accurate result; they do not assess how the resulting information is secured. No SOC 2 report, ISO 27001 certificate, HITRUST certification, trust center or penetration testing cadence is published, and the scanning cadence is stated only as periodic.

A stated regulatory position and intended purpose, with one line of marketing pulling against it. The home page labels CyPath Lung a laboratory developed test, run in the company's CAP accredited, CLIA certified laboratory, and the company states it is not intended as a sole diagnostic tool and should be considered alongside other clinical findings, for high risk patients with indeterminate pulmonary nodules. No FDA clearance is claimed, and the company publishes no submission or timeline.

The tension comes from the same home page, which tells physicians they receive a definitive answer as well as a probability score. The result is Likely or Unlikely, the published positive predictive value is 44 percent, and a definitive answer is what the sole diagnostic tool caution says the test is not. The September 2026 extension of the test to surveillance of lung cancer survivors widens the intended use without a new statement of it.

No subgroup performance, bias evaluation or model governance framework is published. The company's own development paper (Respiratory Research, 2023) says the model is robust to differences in sample processing and disease state, which is a robustness statement with no groups or counts behind it. A medical and scientific advisory board is named on the company site, and the annual report describes board oversight of risk generally.

The at risk group for this product is specific to the sample. The test reads an induced sputum sample collected over three days, and the ability to produce an adequate sample is not evenly distributed: it varies with smoking history, chronic obstructive pulmonary disease, age and physical capacity, all concentrated in the high risk population the test is sold for. A patient who cannot produce a usable sample is not a false negative; they are absent from the denominator. No sample adequacy or rejection rate is published, broken out by patient characteristics or at all.

A published error rate with its method and denominator, in the company's own paper, cited on its home page. Lemieux, Reveles, Rebeles and colleagues, Respiratory Research 2023;24(1):23 (doi 10.1186/s12931-023-02327-3), with the company's chief scientist as corresponding author: sputum from 150 high risk patients, 28 with lung cancer, was used to develop the model (area under the curve 0.89, sensitivity 82 percent, specificity 88 percent, negative predictive value 96 percent, positive predictive value 61 percent), with 92 percent sensitivity and 87 percent specificity where nodules were under 20 millimeters; on an independent set of 32 samples, 6 with cancer, the model reached an area under the curve of 0.85, 83 percent sensitivity, 77 percent specificity, 95 percent negative predictive value and 45 percent positive predictive value. The home page leads with the under 20 millimeter figures and states a 44 percent positive predictive value and 99 percent negative predictive value beside them. These are study results for the model version tested, not performance in use.

The result reaches the ordering physician as Likely or Unlikely with a probability score, so the physician decides what follows. No warranty, indemnity or correction commitment attaches to a result, and the laboratory's billing pages say it cannot guarantee a health plan will pay for the test.

No integration evidence is published. Ordering runs through a sample requisition form and ICD-10 guidance for billing, and results reach the physician three days after the laboratory receives the sample, with no electronic order interface, result interface, discrete result delivery or named record system described on the company site, the CyPath Lung site, the laboratory site or the annual report.

That matters for what the test is used for. Nodule management runs on surveillance intervals, often over years, and a result that arrives as a document has to be tracked by hand alongside imaging; the company's own case studies describe exactly the follow up imaging and deferred biopsy that depend on it.

A laboratory service, so the work happens at one location that is implied rather than committed as a data location. The patient's sputum travels by overnight courier to Precision Pathology Laboratory Services in San Antonio, where flow cytometry and the automated analysis run and the report is generated; physicians receive results three days after the sample arrives. The company has disclosed in its securities filings that it relies on a single laboratory facility and on commercial couriers, and that losing either would harm its ability to sell tests, which is a continuity question with no second site behind it.

No hosting provider, data location for the analytical data and reports, retention terms or tenancy model is published.

No price is published and the posture is discoverable. Physicians order the test through a sample requisition form and the patient collects the sample at home with a kit that includes prepaid overnight shipping. The CyPath Lung site says Medicare and private insurance are accepted, that health plan coverage varies and some commercial and Medicare Advantage plans require prior authorization, that payment follows the payer agreement or the Medicare fee schedule, and that the laboratory cannot guarantee coverage, so a patient may owe copayments, coinsurance, deductibles or the full cost. The annual report names the Medicare proprietary laboratory analysis code for the test, 0406U, effective 1 January 2024. VA and DoD customers have a separate ordering route.

A payer code and coverage language are what the insurer pays the laboratory, not the company's price, and no list or self pay price is published.

Coverage is named, with validation behind part of it. The validated use is narrow and clearly stated: physicians assessing high risk patients with indeterminate pulmonary nodules, with the published development study drawn from high risk patients at several US sites and its strongest figures in nodules under 20 millimeters. The company also sells to VA and DoD physicians through a separate ordering route and presented veteran focused data in September 2026.

In September 2026 the company extended the test to surveillance of lung cancer survivors after curative treatment, positioned to complement CT when monitoring for recurrence and evaluating new or changing nodules. No performance in that population is published, so the coverage now named reaches past the setting the evidence covers.