C the Signs

The vendor claims artificial intelligence centrally and consistently, and the prediction task is real: risk across more than 100 cancer types plus likely tumour origin. The grade is held at C because no source located describes a learning mechanism. The product's own account of itself, and the NHS description of it, both lean on a curated evidence base and guideline mapping, phrased as over 1,000 validated evidence based data points assessed against national, regional and local guidelines.

That describes a large, well maintained knowledge base being evaluated against a patient, which is the moat is the dataset precedent applied to clinical content rather than to a network. Nothing independent characterises the method as machine learning, which is the distinction that let MedAware reach a higher grade on a similar claim. What would move this to a B or an A is a published description of the model: what is learned, from what data, and how performance was measured out of sample. Nothing here says the product does not work, and the interoperability and real world detection results are graded elsewhere on their own merits.

Clear and conventional human in the loop design. The tool runs inside a general practice consultation, returns a risk assessment and a recommended pathway, and the general practitioner makes the referral decision and owns it. Nothing is actioned without a clinician.

The residual oversight question is not about the individual recommendation but about the patients the tool never sees: because it runs when a clinician opens it during a consultation, its coverage depends on clinician behaviour, and no published material describes how usage variation across practices is monitored or corrected.

Neither of the two routes to transparency is available here. The company publishes no architecture, no training data description, no validation methodology and no model card, and the over 1,000 data points figure is a marketing quantity rather than a specification. Separately, MHRA Class I registration is self certified, so unlike a De Novo or a 510(k) there is no reviewed technical file on a public regulatory record either.

The contrast with Digital Diagnostics inside this same index is exact and worth drawing: that company also keeps its weights private, but a regulator reviewed and published a device description and imposed special controls, so an outside party has something to read. Here there is neither vendor publication nor regulatory record, and the performance claims cannot be independently characterised.

Substantial real world evidence generated inside a national health system, which is a setting very few vendors in this index can access. Reported results include cancer detection rates rising from 58.7 to 66.0 percent without an increase in referral activity, an evaluation across all 64 general practices in Somerset presented at ESMO 2025, a health economic assessment presented at ASCO, an ovarian cancer real world study in the Journal of Cancer Policy, and a disparities analysis presented at an NCI symposium.

Three limits hold it at B and all three are visible from the company's own research page. First, publication type: the material is largely conference abstracts at ESMO, ASCO, AACR and an NCI symposium, collectively presented as peer reviewed research, and a conference abstract receives limited review and often is never followed by a full paper. The Journal of Cancer Policy study is the clearest exception.

Second, company employees are co authors on the evaluations, which is disclosed in the publications and recorded here rather than treated as disqualifying. Third, nothing randomised or controlled was located, so improvement over time cannot be separated from the other things an integrated care board changes when it runs a cancer programme.

A privacy policy and cookie policy are published, which is more than several vendors in this index manage. Beyond that the detail is absent: two passes located no statement on retention periods, data minimisation, or whether patient data contributes to model improvement.

The last of those matters more here than usual, because the product both reads the record and writes coded assessments back into it across roughly 1,400 practices, so the same system is a large scale reader and writer of primary care data. A buyer should ask for the position on secondary use in writing.

Graded against the framework that actually governs the vendor rather than the American one, following the precedent set on the LGPD scoping call. HIPAA does not apply: this is a United Kingdom company operating inside the NHS, so the governing regime is UK GDPR and the Data Protection Act, with ICO registration and an NHS Data Security and Protection Toolkit submission required of any supplier handling identifiable NHS data. A privacy policy is published.

Not located: ICO registration details, DSPT status, or data processing agreement terms. A DSPT submission almost certainly exists, because its NHS deployments would not be permitted without one, so this grade describes what a buyer can read before contracting rather than what is contractually true.

Two passes located no ISO 27001, no Cyber Essentials or Cyber Essentials Plus, no penetration testing statement, no DSPT status, no trust centre and no vulnerability disclosure policy. The detail that makes the point without any editorialising is what the company does publish in its site footer alongside the privacy and cookie policies: a carbon reduction plan.

A carbon reduction plan is a United Kingdom public procurement requirement, and NHS technical security assurance under DTAC is equally a requirement, yet only the first is published where a buyer can find it. The pattern is publication driven by whichever obligation is most visible, not by what a buyer most needs, and it is the same observation drawn on VigiLanz, where product level publication and corporate level attestation diverged.

No FDA involvement and no United States market entry located. The company registers the product with the MHRA as a Class I medical device and states this prominently, including in the site's own meta description, where it functions as a trust signal. The distinction a buyer needs is that Class I is the lowest risk classification and conformity is self certified by the manufacturer, with registration notifying the regulator that the product exists.

No regulator has reviewed its clinical performance. This is the same finding recorded against InsightRX's Class I self certification in the medication safety lane, and it belongs to the same family as the ONC certification distinction drawn on TheraDoc: a real and correctly declared status that buyers routinely read as a stronger assurance than it is. Graded C because the status is legitimate and accurately stated, not because it is meaningless.

Above average and deliberately so. Equity is a repeated research theme rather than a statement of intent: a disparities analysis in areas of high deprivation presented at an NCI symposium on cancer health disparities, and an AACR abstract reporting reduced diagnostic burden with improved cancer detection and equity together. Running equity analyses at all puts this vendor ahead of most of the index. Held at B rather than A for three reasons.

The equity work sits in abstracts rather than full papers, so the methods cannot be examined. No subgroup performance figures were located. And no bias testing methodology, model card or drift monitoring concept is published, which matters for a guideline anchored product, since thresholds and referral criteria drift as national guidance changes and nothing describes how that is detected.

The strongest axis on this record and among the deepest distribution in the index. The product is integrated with EMIS, SystmOne and Vision, which between them account for essentially the entire English general practice software market, so it reaches the point of care through every primary care record system in a national health service rather than through one vendor's marketplace.

Integration is bidirectional and structured: assessments, safety netting and cancer tracking are coded back into the patient record, not left in a separate portal, which means the output is available to every later clinician reading that record. Deployment is reported at roughly 1,400 practices, including every one of the 64 practices in Somerset from a single integrated care board decision. Comparable in kind to the distribution that earned FDB an A, achieved by a far smaller company.

Delivered as a hosted service reached through the general practice record system and a web application. Two passes located no published hosting architecture, no named region and no data residency statement. United Kingdom residency is effectively compelled by its NHS contracts and by the DTAC data protection criteria, so it very likely holds, but a buyer outside the NHS procurement process cannot confirm it from anything the company publishes. Graded on what is published.

No pricing, no pricing mechanism and no contracting model published. What is published is unusual enough to credit: a health economic assessment presented through ASCO, and a widely repeated return on investment figure of roughly 808 percent for the NHS. Two cautions keep this at C rather than higher. A return on investment figure is a claim about value, not a disclosure of price, and a buyer still cannot compute what the service costs or what margin the supplier takes.

And the economic assessment carries company involvement, so it is a vendor supported valuation of a vendor product. Artrya remains the benchmark on this axis because a stock exchange listing forces the price out alongside the mechanism and the concentration risk.

Broad within its domain and narrow outside it. Coverage spans more than 100 cancer types across the whole of primary care, with the company stating expansion from primary into secondary care. That breadth of tumour coverage in one tool is unusual.

Against that, it is a single disease area and effectively a single jurisdiction: every deployment located is inside the NHS, and the product is built around NICE guidance and English general practice record systems, so the guideline layer would need rebuilding for another health system.

The claim of 99 out of every 100 patients with cancer identified should be read with its denominator in mind, since sensitivity is measured among patients the tool was actually run on, and patients never assessed are not counted in it.