BrainCheck

A learned component exists, and it sits beside the flagship rather than being it.

The flagship carries almost no algorithmic content and the company does not pretend otherwise. BrainCheck Assess is a digitized, normed battery of established neuropsychological instruments, including Stroop, Trail Making, Digit Symbol Substitution and recognition memory, delivered on a tablet and scored against a normative database of more than 5,000 patients. That is digitization plus norming, not a trained diagnostic model, and nothing describes a learned classifier producing the impairment determination. The moat is the validated battery, the normative data and the reimbursement workflow.

The learned part sits in a second line. BrainCheck Population Analytics takes a record system extract and returns a prioritized patient registry sorted into diagnosed, elevated signal and moderate signal, built on phenotypes derived from a published analysis of more than 153 million patient records and paired with eRADAR, an externally validated published risk score for undiagnosed dementia. A risk score whose coefficients were fitted to cohort data is a learned component: parameters estimated from data rather than a fixed formula or a curated lookup.

The company's own main pages carry no artificial intelligence claim at all, no mention of machine learning, algorithms or predictive models. The learned component is real and the marketing does not claim it.

The scope boundary is drawn plainly and repeatedly, and the threshold inside the population product is not published.

The candor stands out. The company states that the assessment is not intended for use as a standalone diagnostic tool, that it is designed to support clinical interpretation rather than replace it, and that structured cognitive data is meant to be read alongside history, examination findings and functional status rather than in isolation. That appears in product copy and in the regulatory statement rather than buried in a disclaimer, and the published indication says the same thing in the language the regulator uses. A clinician orders the assessment, the patient performs it, and the clinician interprets the result.

The population analytics product carries more structure than a scope statement, and it deserves recording. Each prioritized patient record is published with the structured record system data elements and the research derived analytic criteria that placed it there, so a clinician can evaluate the basis for prioritization rather than receiving a ranking to trust. The company describes the registry as organizing information for review, a starting point and not a verdict, and states it does not diagnose. Publishing the basis behind each inclusion is what makes the registry reviewable.

What is missing is the operating point. The registry sorts a population into diagnosed, elevated signal and moderate signal, and nothing published states what separates elevated from moderate, what a clinician is expected to do with each tier, or what proportion of a panel typically lands in each. For a product whose output drives outreach to people who have not asked to be assessed, the threshold is the control that decides who gets contacted.

Nothing describes what happens to a score generated from an unsupervised remote administration either, where the conditions the norms assume may not hold.

The battery composition is fully disclosed down to the individual instruments and the cognitive domains each targets, and the normative database is described as an expanding reference set. No model card or algorithmic description is published, which is consistent with there being little algorithmic content to describe.

Not enumerating the chain is a stated policy here, which is a different thing from an omission. The published policy says the company does not publish its list of service providers because they change from time to time, offering to supply names by email on request instead.

Category level disclosure does exist and is better than nothing, since sharing of test results with third party cognitive health services is disclosed plainly and described as including care management providers, brain training products and pharmaceutical companies, gated behind consent. Naming categories is not naming parties. A separate published term makes any list a snapshot rather than an answer.

The test taker privacy policy permits the company to use, share, disclose and sell personal data in anonymized or aggregated form without restriction. An unrestricted permission to sell de identified data means the set of recipients is open ended by design, so even a complete list supplied on request would describe today's chain and carry no commitment about tomorrow's.

Retention compounds it: data transferred to United States servers may be maintained indefinitely, the retention section commits to no period, and backups may persist with no expiry stated. Nothing addresses whether test results train models, and the unrestricted permission would encompass that use.

A validation study of 99 participants reported at least 88 percent sensitivity and specificity separating normal cognition from dementia and at least 77 percent separating mild cognitive impairment from the other groups, with three group true positive rates reported separately, including the weaker 64 percent for the mild cognitive impairment group. A later analysis found a Pearson correlation of 0.77 against the Montreal Cognitive Assessment with a confidence interval reported. A 529 participant study across four United States clinical sites, run with BrainBox Solutions and registered as NCT04423198, tested test retest reliability and concurrent validity against the corresponding paper instruments. A separate finding that remote self administration is statistically indistinguishable from coordinator led in person sessions validates the deployment claim rather than only the test.

Multi site, prospective where the claim requires it, published in peer reviewed venues with the method available to read, and reporting the unflattering numbers alongside the good ones. The claim this product makes is detection of cognitive impairment, and detection accuracy against a clinical reference is precisely what the studies measure, so claim and evidence match.

The population analytics line rests on different evidence. Its prioritization is built on published phenotype research across a very large record system dataset and on an externally validated risk score for undiagnosed dementia, neither of which is the assessment battery, and no study of the registry's own performance in a deployed population is published.

Scale is separately stated: more than 450,000 patient assessments, a normative database of more than 5,000 patients, and more than 500 healthcare organizations including named academic and health system customers.

The disclosure here is unusually detailed, and the weakness lies in what the published terms permit rather than in any silence. Assessment data is handled under role based access controls with activity logging, encrypted in transit and at rest, and BrainCheck states that retention and deletion can be aligned to customer contractual requirements. Sharing of test results with third party cognitive health services, which the policy says may include care management providers, brain training products and pharmaceutical companies, is gated behind consent and disclosed plainly in the policy rather than left to inference.

Three published terms work against the buyer. The test taker privacy policy permits BrainCheck to use, share, disclose and sell personal data in anonymized or aggregated form without restriction. It states that data transferred to United States servers may be maintained indefinitely, and the retention section commits to no period at all, adding that copies may persist in backups for additional time with no expiry given. BrainCheck also states as a matter of policy that it does not publish its list of service providers because they change from time to time, offering to supply names by email on request instead.

Nothing published addresses whether test results are used to train or improve models, and the unrestricted permission over de identified data would encompass that use. The policy collects race and ethnicity, which is ordinary practice for demographically adjusted cognitive norms but does mean the data required to answer questions about performance across patient groups is already held. Nothing published says whether the sale permission over de identified data can be struck from an agreement. The policy was last updated in September 2024 and its change of control clause refers to a different company's assets, which suggests it has not been reviewed recently.

Business associate status is stated and supported, and the agreement itself is not reachable on the surfaces where it would sit.

The status is unambiguous. The security and compliance page states that the company supports health privacy compliant workflows and executes a business associate agreement with covered entities and eligible partners, and describes the handling underneath it: protected health information under role based access controls, activity logged to support auditability and compliance reviews, and retention and deletion able to align with customer contractual requirements. A separate privacy policy and a terms of use are published, and a health privacy compliance program declaration has been published as its own document.

What cannot be read before contracting is the agreement. The terms of use contain no business associate provisions at all, and no separate agreement page appears in the site's own navigation, so the obligations, the liability allocation and the subcontractor terms cannot be examined in advance.

The scope question is unresolved and the company's own product structure makes it material. The platform markets more than thirty tools of which one, Assess, carries device status, and nothing states which products the agreement covers or whether its terms are negotiable.

The test taker privacy policy frames the business associate obligation conditionally, as applying if the company ever creates, receives, maintains or transmits protected health information, which sits oddly with a product that plainly does handle it.

Two independently assessed certifications, named, with every artifact behind a request and usually an agreement.

What is held is real. The platform is HITRUST certified, meaning its security and privacy controls have been independently assessed against a healthcare specific framework rather than a general one, and the certification is listed at the i1 tier. The cloud platform is separately certified under TX-RAMP Level 2, the Texas program for cloud services processing confidential or regulated government data, which aligns to a moderate federal control baseline. Named controls include encryption in transit and at rest, secure key management, segregated environments, role based access control, least privilege permissions, audit logging and monitoring, and defined incident response procedures. A structured vendor security review process is described for hospitals, health systems, academic medical centers and research organizations.

Retrievability is the gap, and the company states the position plainly itself. Regulatory documentation, certification materials, security architecture overviews, policy summaries and questionnaire responses are listed as available upon request, often under a non disclosure agreement. Nothing is published as a document that can be opened, no certificate appears with its scope and expiry, and the certification page does not state the HITRUST tier, so currency and depth are not shown.

Three further gaps remain. No SOC 2 report of any type is claimed. The i1 tier is a materially lighter assessment than r2, changing both the control count and the assessment period. And no penetration testing statement or subprocessor list is published.

BrainCheck states its regulatory position plainly, and the position is a device listing rather than a clearance. The security and compliance page describes BrainCheck Assess as a Class II, 510(k)-exempt computerized cognitive assessment aid regulated by the FDA, indicated as an aid in the assessment of cognitive impairment and not intended as a standalone diagnostic tool, with a pointer to the product labeling for full indications, limitations and intended use. The same page says the company maintains a compliant quality system, that Assess is subject to FDA audits as required for Class II devices, and that development, validation and change management follow the applicable regulatory requirements. Assess is identified as the single regulated component within a platform of more than thirty tools, so it is clear which part carries the status and which parts do not.

A 510(k)-exempt device is registered and listed with the FDA under its classification rather than cleared: no premarket submission is reviewed, so there is no clearance number and its absence signals nothing. An exempt listing records the device and its classification; it is not a clearance or authorization reviewed for this product, with the version and indication it covers. Marketing pages describe Assess as FDA registered, and registration is an annual filing obligation rather than a review, so a row of trust marks can read as more than it is. The security and compliance page states the position accurately.

Cognitive testing is acutely sensitive to language, education and cultural background, and normative data quality is the governance surface rather than an abstract fairness policy. The company has publicly expanded its normative database specifically to support accuracy and consistency, states that the assessment maintains consistency across devices and demographics, and offers the battery in English and Spanish. Offering a second language on a cognitive battery is a substantive step rather than a translation convenience, because norms and instructions both have to travel.

What is absent is any performance breakdown by race, education level or primary language, and those are exactly the dimensions on which cognitive instruments are known to misclassify. Its privacy policy states that it collects race and ethnicity, which is ordinary practice for demographically adjusted norms.

The population analytics layer adds a second surface nothing addresses. A registry that sorts a panel by risk from record system data inherits whatever patterns sit in who previously received care and who was previously tested, so the misses would fall on the groups with least prior contact, and the people missed generate no signal and no complaint.

No model card, bias testing methodology, calibration analysis or drift concept is published for either line.

The product's inspectability comes from the design rather than from disclosure practice.

The battery composition is published down to the individual instruments and the cognitive domains each targets, so a clinician who wants to know what a score means can read the instrument and the construct it measures, and there is comparatively little algorithmic content standing between the test and the result. That is a real mechanism: an unexplained output is contestable only in principle, while a score from a named instrument is contestable in practice. The population analytics line extends the same logic, publishing the data elements and analytic criteria behind each prioritized patient so a clinician can evaluate the basis rather than accept a ranking.

Two gaps remain, and the second is unusual. No accuracy or validation figure is published for the impairment determination as distinct from the individual instruments, which is the output a clinician acts on, and none for the registry's performance in a deployed panel.

And several published terms work against the person being assessed rather than merely being silent. The test taker privacy policy permits indefinite retention on United States servers, commits to no retention period, describes backups with no stated expiry, and grants an unrestricted permission to sell de identified personal data. A test taker in a cognitive assessment is frequently the party least equipped to read those terms or to object to them, and they are not the purchaser. The policy was last updated in September 2024 and its change of control clause refers to another company's assets, which suggests it has not been reviewed recently.

No warranty, indemnity or remediation commitment is published for either line.

Named live integrations with Epic and athenahealth, with athenahealth customers described as having instant integration, and assessment scheduling and results linked to the patient chart. The systems are named, not left as a generic interoperability claim. The named list stops at those two, and the company notes some feature availability is determined by EHR integration, meaning capability varies by platform.

Flexible delivery, with the infrastructure beneath it undescribed.

The assessment runs on any tablet or smartphone, supports both in clinic and remote administration, and the company reports same day setup by a United States based team, with sign up and go live presented as immediate. The remote equivalence finding gives the deployment claim evidentiary support rather than leaving it as marketing: remote self administration has been reported as statistically indistinguishable from coordinator led in person sessions.

What is not published is where any of it runs. No hosting provider, region, tenancy model, segregation approach or residency commitment appears, and the cloud platform's TX-RAMP Level 2 certification tells a buyer the environment meets a state government control baseline without saying where it sits.

Two product facts make that gap matter more. Retention terms in the test taker privacy policy state that data transferred to United States servers may be maintained indefinitely, with no committed period and backups that may persist with no stated expiry, so residency and retention compound one another. And the population analytics engagement involves a health system sending a structured record system extract to the vendor, which is a bulk transfer of identifiable or re-identifiable data on a different scale from a single assessment.

The revenue side is published in detail and the cost side is not published at all.

What the company does publish is a practically useful reimbursement disclosure, open rather than gated behind a sales call. It names the specific procedure codes involved, including 96136 and 96138 for test administration and scoring depending on whether a professional or a technician administers, 96132 for interpretation, and 99483 for cognitive care planning; states the sixteen minute minimum for the time based codes; addresses modifier use when an evaluation and management service is billed the same day; notes which codes can be delivered by telehealth including audio only; and maintains an annually updated reimbursement guide. It also says plainly that billing decisions remain provider driven and payer dependent and that the material is educational rather than billing advice. Naming the revenue path that precisely, with the caveats attached, is valuable.

None of it is a price. No list price, no unit of charge, no tier structure, no per provider or per assessment figure, no minimum commitment and no implementation fee position is published. The sign up route invites a clinician to sign up and go live immediately, and reaching it produces a contact form rather than a rate.

So a practice can compute exactly what it will be paid and not what it will pay, which is half a business case; every other input to the decision is already in the open.

Explicitly spans primary care, neurology, geriatrics, behavioral health and research, in clinic and remote, and the platform is used in clinical, academic and translational research across neurological disease, aging, cancer, post viral syndromes and population health. Broad across care settings for a single clinical question: the clinical scope is one domain, cognition, however many settings it reaches.