BostonGene

The models carry a large share of the report, and the sequencing underneath is load bearing too. The Tumor Portrait test runs tumor DNA, normal DNA and tumor RNA sequencing in the company's own laboratory, and the report then leans on learned components: Kassandra reconstructs the tumor microenvironment's cell composition from bulk RNA, RNA signatures sort tumors into four microenvironment types, treatment selection algorithms combine the molecular profile with clinical history and approved therapies, and an AI trial recommendation tool ranks recruiting trials. Remove the models and a sequencing report remains; remove the sequencing and nothing does.

The oversight structure is described, and the review of the algorithmic parts is missing. The test is ordered by a clinician on a requisition form, run in the company's CAP and CLIA certified laboratory, and returned as a report the physician acts on. The report lists actionable findings and the key alterations not detected, therapy options matched to the molecular profile, and recruiting trials selected on stated criteria: country, sex, age, diagnosis and clinical parameters first, then molecular findings, location (trials at the patient's hospital first), study characteristics and sponsor, from a ClinicalTrials.gov feed updated daily.

What is not described is whether a person reviews the therapy options and trial list before release, what the physician sees about trials the tool excluded, and how a disagreement is handled. A missed trial leaves no trace in the report, which is why that step matters.

The approach behind each model is named, without version or update discipline. Kassandra, the deconvolution model, is published in Cancer Cell as a decision tree machine learning method trained on artificial transcriptomes built from reference expression profiles, resolving up to 51 cell types from bulk RNA. The four microenvironment types come from RNA signatures published by the company's scientists. The trial matching tool is described by its inputs: a ClinicalTrials.gov feed updated daily plus sponsor and clinic sites, filtered on country, sex, age, diagnosis and clinical parameters, then ranked on molecular findings, location, study characteristics and sponsor. Treatment selection combines clinical history, molecular profile, FDA-approved therapies and the literature.

How each component is versioned, how a change is validated inside a regulated laboratory, and how an ordering physician learns that a model behind a report has changed are not published.

A structurally short chain for the models, with the host named. Kassandra, the microenvironment typing, treatment selection and trial matching are the company's own and run on its platform, so no outside model provider sits between a patient's sequence and the report. The trust center names AWS as the storage and processing provider within multi-cloud environments, and ClinicalTrials.gov as the trial data source.

No subprocessor list is published, the other clouds are unnamed, and the parties that receive de-identified data through biopharma projects and the Tokyo joint venture are not listed.

Published research on the assay and the models, led by the company and short of independent validation of the AI layers. The Tumor Portrait assay validation (Communications Medicine, 2025) covers analytical performance on exome-wide reference standards, orthogonal testing, including 52 tumors run in an independent laboratory, and 2,230 clinical tumor samples, in which the combined DNA and RNA assay found clinically actionable alterations in 98 percent of cases and recovered variants and fusions that DNA-only testing missed. That establishes the sequencing is accurate and informative.

It does not test the parts of the report the models produce. Kassandra's deconvolution and the four microenvironment types were published by the company's scientists in Cancer Cell from retrospective cohorts, and no published study evaluates the treatment selection or trial matching outputs, or shows that the microenvironment classification changes outcomes for patients tested. The company reports research with MD Anderson, Weill Cornell and the Parker Institute and abstracts at ASCO 2026.

Categorical commitments are published, and retention is tied to contracts rather than a schedule. BostonGene's notice of health information privacy practices (effective 1 April 2021) says it never shares a patient's information for marketing or sale without written permission and may use it for research under the conditions the law sets. Its trust center says data used in biopharma work is processed only in de-identified form, with customer data processing agreements confirming that the data exporter obtained patient consent, and that sensitive information is anonymized where appropriate; data is encrypted in transit (TLS 1.2 or better) and at rest (AES-256 on AWS), with least privilege access granted per project.

Retention is stated as the duration of services and whatever customer agreements and law require, so no period is published for specimens, germline and tumor sequence, or derived data. Germline sequence identifies relatives as well as the patient. Whether clinical test data feeds model development or partner research, and how a patient opts out, is not stated. Safety engineering for the report's algorithms is not published.

Covered entity status is evident and a substantive privacy document reaches the patient; no contracting instrument is published. BostonGene runs a clinical laboratory that receives specimens on a physician's order and bills insurers, which makes it a covered entity in its own right, and it publishes a notice of health information privacy practices (effective 1 April 2021) covering patient rights, choices, uses and disclosures. Its trust center lists HIPAA among the frameworks the services align with, and says biopharma work runs on de-identified data under data processing agreements.

No provider agreement, business associate terms for the biopharma and research side, or subcontractor terms are published. The general privacy policy page returned an access error.

Recognized certifications are named with their versions, without the artifacts. The company's trust center page lists ISO/IEC 27001:2022, SOC 2 Type 2 (SSAE 18 and ISAE 3402) and ISO/IEC 27018:2019, and says the company undergoes independent assessments; the certificates themselves are shown only as badges, and no report, certificate number, issuing body or scope is published. It describes an information security management system with written policies reviewed at least annually, a data backup and media protection policy, a disaster recovery plan, encryption in transit and at rest, and least privilege access by project.

The laboratory's CAP, CLIA and state licenses cover testing quality rather than information security, and AWS's own certifications, which the FAQ also cites, are the host's.

The regulatory position is stated plainly for a laboratory test, with no FDA status claimed. Tumor Portrait is a laboratory developed test run in the company's CAP accredited, CLIA certified laboratory, and the company describes it as approved by the New York State Department of Health, whose review of laboratory tests is stricter than CLIA alone. No FDA clearance or approval is claimed or implied, and no FDA submission is described.

The report includes algorithm-generated therapy options and trial matches alongside the sequencing results, which sit within the laboratory's own validated test rather than under a separate device review.

The methods are published and no evaluation across patient groups stands behind them. Kassandra was trained on artificial transcriptomes built from reference expression profiles, so its accuracy for a given patient depends on how well those references represent that patient's tumor and immune biology; the published validation reports accuracy by cell type and tissue, not by patient population, and the assay validation in Communications Medicine (2025) reports no results by ancestry, sex or age. No AI governance framework, model review process or monitoring of the report's algorithms after release is published, and the trust center's standards (ISO 27001, SOC 2, GxP alignment) cover security and quality rather than model behavior.

For a report that recommends therapies and trials, the useful evidence would be deconvolution accuracy and microenvironment classification broken down by ancestry and tumor type, and how often recommendations differ across those groups.

Analytical error rates are published with method and denominators; nothing makes the company answerable for a result. The assay validation in Communications Medicine (2025) built exome-wide reference standards (3,042 SNVs and 47,466 copy number variants in cell lines at varying purity) and reports sensitivity of 96.1 percent for SNVs and 96.9 percent for indels exome-wide, above 99 percent for clinically actionable alterations, copy number sensitivity above 92 percent and specificity above 95 percent at over 30 percent purity, and 98.5 percent per-nucleotide concordance with an independent laboratory on 52 tumors. The Tumor Portrait page headlines 99.9 percent accuracy and specificity, with the detailed metrics behind a sign-up form.

No error rate is published for the algorithmic layers of the report (microenvironment typing, treatment options, trial matching), and no guarantee, indemnity or correction route attaches to a report.

No integration evidence. Ordering runs on a test requisition form sent with progress notes and pathology reports; the company retrieves the tumor block from pathology and the patient sends a normal sample from home or a local laboratory; results are delivered through a customer portal opened from an emailed activation link. No record system, interface standard, structured result delivery or live integration is named on the provider pages or anywhere else on the site.

For a report that carries therapy options and a trial list, a document held in a separate portal is seen once by whoever opens it, and trial eligibility changes as the patient's disease does.

A single hosted service on a named provider, with location implied rather than committed. Specimens go to the company's laboratory in Waltham, Massachusetts, and the trust center says data is stored and processed on enterprise systems including AWS, in multi-cloud environments, with backups handled under customer agreements. Results reach physicians through a customer portal.

No AWS region, residency commitment or tenancy model is published. The company runs a joint venture in Tokyo and research collaborations abroad, and nothing states whether analysis for a Japanese patient happens in Japan, how the joint venture's data relates to the parent's, or which transfer mechanism covers sequence data crossing borders.

No price is published and the posture is discoverable. The Tumor Portrait test is billed to insurance, and the company states it is in network with Medicare and works with all US insurers; a financial assistance program covers all tests ordered within 18 months of approval for eligible US residents, with applications decided in one to two business days, and self-pay patients receive a discounted fee and payment plan. A balance billing disclosure is published. Biopharma work (trial support, biomarker discovery, indication selection) is contracted separately.

No list price, self-pay rate or biopharma rate card is published.

Coverage is named in detail, and validation stands behind part of it. The Tumor Portrait page describes the test as for patients with advanced solid tumors, then lists cancer-specific reporting for 14 types, including two lymphomas (follicular lymphoma and diffuse large B-cell lymphoma), alongside a separate immune profiling test from blood, immunohistochemistry and an unknown primary test. Drug development work for biopharma is described separately.

The assay validation covers 2,230 clinical tumor samples, with no results broken out by tumor type, and the lymphoma panels sit outside the advanced solid tumor description the test carries.