Creyos

The asset is a validated task battery and a large normative sample, not a model.

A patient performs twelve short tasks, each mapping to a named cognitive domain, and the resulting scores are compared against a normative database the company states holds more than 85,000 participants. That is psychometrics done well, and the comparison to norms is the product. More than 20 million tasks have been completed and the underlying research runs back three decades.

Machine learning is claimed, but only in boilerplate: company material says it applies machine learning to digital cognitive assessment and leverages machine learning techniques, without naming what is learned, from what, or which output depends on it. No mechanism description is published.

A product whose moat is a dataset and a validated instrument is a legitimate product; it is simply not one whose value comes from a model.

One place a learned component would most plausibly sit is the newer screening output that combines multiple task scores into a single impairment result, and nothing published describes how that combination is derived.

A clinician orders the assessment, the patient performs it, and the clinician reads a report and decides. Nothing is diagnosed autonomously and the company consistently describes the product as supporting clinical decisions rather than returning an answer. Reports are structured for a clinician to interpret, and the company's own marketing argues against the single score model, positioning domain level detail as the point.

One oversight question is specific to this delivery model and is not addressed anywhere. Assessments can be completed remotely at home through a secure link, unsupervised. Unsupervised cognitive testing carries validity risks a supervised administration does not, since nobody can confirm whether the patient was distracted, assisted, using an unfamiliar input device, or attempting the task more than once, and the normative comparison assumes standard administration. No published material describes how invalid or assisted attempts are detected or flagged, whether repeated attempts are recorded, or what a clinician sees to tell a clean administration from a compromised one.

That gap sits directly under the product's main claim. A percentile against a normative sample is only meaningful if the conditions of the attempt resemble the conditions the norms were collected under, and remote unsupervised testing is the case where they most plausibly do not.

A second question follows from the 2026 care planning capability. A care plan generated from assessment results is a further step away from raw scores, and nothing describes what the clinician is expected to review before adopting one.

Unusually inspectable at the base, and undocumented at the layer that is actually sold.

The twelve tasks are published instruments described in the peer reviewed literature across three decades, each task states the cognitive domain it measures, and the company points to more than 400 studies that have used them. A clinician who asks why an individual task score came out as it did can read the task and the construct it targets. That is a real and durable form of transparency, and it comes from the product being psychometrics rather than a learned model.

The science is transparent and the artificial intelligence is not. The machine learning claim carries no description at all: no model, no method, no statement of what is learned or which output depends on it. The screening output that combines multiple task scores into a single impairment signal has no published derivation, weighting or validation, and that composite is the thing the newer product sells.

So the older half of the product is highly inspectable and the newer half is not, and the combined signal rests on something the published literature does not cover.

No version or update discipline is published for the scoring or the norms either. The normative database is described as growing, which means the reference population a percentile is computed against changes over time, and nothing tells a clinician which version of the norms produced a given report or how a score from last year compares with one from today.

Nothing identifies any party in the chain. No model or model family, no foundation model provider, no hosting arrangement and no sub processor register is published, and the published privacy policy routes patient data handling to the customer agreement rather than describing it.

The absence matters less than it might, because the product is largely psychometrics rather than a learned model, so the model supply chain question may have a short answer. That is exactly why the company should give it: if no third party model service touches assessment data, saying so is a strong answer that costs nothing.

One question is specific to this business and bears on both privacy and scientific integrity. The normative database is the commercial asset, it is described as growing, and nothing published says whether results from clinical patients flow into it. If they do, patients are contributing to a proprietary dataset as a byproduct of receiving care, and the comparison population is shifting from a research cohort toward whoever happens to be tested in clinics, which changes what a percentile means over time without anyone being told. If they do not, that goes unstated.

A second follows from the machine learning claim. The company says it applies machine learning to digital cognitive assessment without describing what is learned or from what. If there is a learned component anywhere, the corpus behind it is the same patient data question stated differently.

A large and independent research base, and a distinction that matters.

The instrument level evidence is exceptional. The tasks have been used in more than 400 peer reviewed studies by investigators with no commercial relationship to the company, and independent validation exists inside the Prospective Imaging Study of Aging, where the platform was compared against comprehensive in person cognitive assessment in 141 participants and task performance was related to cortical sulcal width from structural magnetic resonance imaging. Two studies featured at the 2026 Alzheimer's Association International Conference. More than 20 million tasks have been completed and the underlying research runs back three decades.

But instrument validation and product validation are different claims. That these tasks measure cognition validly is well established. That this screener detects dementia in primary care better than existing practice rests on far less. The headline screening validation reported perfect sensitivity across 14 patients with clinically diagnosed Alzheimer's disease and 86 percent specificity in case matched controls. A sensitivity figure computed on 14 patients carries a confidence interval so wide that it says little about performance, and perfect sensitivity in a sample that size is what small samples produce rather than evidence of perfection.

The company reports a study under way that would settle the product claim. A longitudinal study is tracking cognitive trajectories over 12 months across cognitively normal adults, subjective cognitive decline, mild cognitive impairment and dementia, assessing sensitivity across the continuum and performance in relation to daily functioning, and examining how the two task screener works alongside the longer assessment. That is the right design for the claim and it has not reported.

Deployment scale is stated at more than 10,000 clinicians.

A privacy policy exists and it routes the question that matters somewhere a buyer cannot read.

The published policy states in terms that it does not apply to protected health information, that the customer's collection and use of that information is governed by the customer's own notice of privacy practices, and that the company's collection and use of it is governed by the customer agreement. So the document covers the website and the company's own dealings, and the handling of patient assessment results sits in a contract.

That leaves the rest unanswered. No retention schedule, no deletion process, no data minimization commitment and no access control description is published for assessment results.

One question is specific to this business and is worth putting to the company directly, because the answer bears on privacy and scientific integrity at once. The normative database is the commercial asset, it is described as growing past 85,000 participants, and nothing published says whether results from clinical patients flow into it. If they do, patients are contributing to a proprietary dataset as a byproduct of receiving care, and the comparison population is quietly shifting from a research cohort toward whoever happens to be tested in clinics, which changes what a percentile means over time without anyone being told. That is a training data question and a validity question in the same breath, and it becomes very hard to unwind once a corpus exists. If clinical results do not enter the norms, nothing published says so.

The remote delivery model adds a second question. Assessments completed at home generate results about a patient's cognition captured outside any clinical setting, and nothing describes what is retained from an attempt that is abandoned or repeated.

A status is stated and the only privacy document published excludes the patients it would need to cover.

The status appears on the home page, in a statement block reading HIPAA and SOC 2 compliant presented among the company's own headline figures. That is a compliance claim about this company.

What sits underneath does not support it, and the policy says so itself. The published privacy policy states in terms that it does not apply to medical information that is protected health information as defined by the health privacy act, that the customer's collection and use of that information is subject to the customer's own notice of privacy practices, and that the company's collection and use of it is governed by the customer agreement. So the document a buyer can read covers the website and the company's own dealings, and expressly routes the patient data question to a contract nobody outside the relationship can see. A terms of service page is published alongside it.

No business associate agreement template, execution requirement, subcontractor flow down position or statement of which entity contracts is published. Those agreements certainly exist, since the company states use by large North American health systems.

Two regimes are in play at once and neither is addressed in published material. This is a Canadian company selling into United States health systems, so the American health privacy framework applies for its American customers, and Canadian federal and provincial health privacy law, including Ontario's personal health information legislation, applies at home. Nothing published says which rules govern a given deployment or where the data rests.

An attestation is claimed as the company's own, with none of the detail needed to assess it.

The home page carries a statement block reading HIPAA and SOC 2 compliant, presented among the company's own headline figures alongside clinician count, tasks completed and years of research. Presented that way it is a claim about this company rather than about a hosting partner.

Everything that makes a SOC 2 assessable is missing. No report type is given, and the distinction decides what the claim means: a Type 1 assesses whether controls were suitably designed at a point in time, a Type II tests whether they operated effectively across a period. No audit period, no date, no assessor, no scope statement, and no trust center or report request process. No vulnerability disclosure policy is published.

The wording itself is loose. SOC 2 produces an attestation report from an accounting firm. There is no certifying body and no compliance status to hold, so compliant is the wrong word; it is very likely shorthand for having been through an audit rather than a standing state.

The data at issue makes scope matter. This platform holds cognitive performance results for patients being screened for dementia and attention disorders, which are findings with consequences reaching into driving, employment and legal capacity, held by a company operating across the Canada United States border.

No device claim appears in the company's current material, and no device determination does either.

The company's earlier material described the platform as registered with the FDA. The current home page, how it works page and screener validation article carry no reference to the agency at all. The distinction it invited still matters, because it travels. Registration is establishment listing, which means notifying the agency that a company and its device exist; it involves no review of safety, effectiveness or clinical performance. Clearance means the agency reviewed a submission. The two are routinely conflated, and the confusion had already propagated outward here: a clinic publishing its own list of assessment tools described Creyos as FDA cleared, alongside cleared devices, in material patients read. The company stated the weaker and accurate term; a downstream user upgraded it. That clinic page may still be live.

What is absent now is any regulatory position at all. No classification, no rationale, no clearance, and no statement that the product sits outside device regulation.

The question is live rather than academic, and the commercial framing sharpens it. The output is an impairment signal that triggers referral, further investigation or a conversation with a family, and the consequences of a false positive in cognitive screening reach into driving, employment and legal capacity. The company also markets to payers on the basis that missed cognitive decline means missed diagnoses and undocumented risk adjustment codes, so a screening threshold sits next to a documented financial incentive to cross it.

The bias question here is not about a model, it is about the normative sample, and that makes it more consequential rather than less.

Norms decide what counts as impaired. A patient is flagged because their score sits far enough below a reference population, so the demographic composition of those 85,000 or more participants determines who gets flagged and who does not. Nothing published describes that composition by age, education, language or ethnicity. Education and language effects on computerized cognitive tasks are large and well documented, and the tasks are delivered online in English on a desktop or tablet, which adds device familiarity and digital literacy as further sources of variance that fall unevenly across the population being screened.

Despite a normative database of that size, no such analysis is published.

The commercial framing makes the absence sharper than it would otherwise be. The company markets to payers and plans on the basis that missed cognitive decline means missed diagnoses and undocumented risk adjustment codes, and that the product catches it earlier so an organization can document it, code it and act on it. That places a financial return on the far side of a screening threshold. Where the threshold is a percentile against a reference population whose composition is unpublished, and where crossing it produces both a clinical referral and a coding opportunity, the direction of any error in the norms matters to more than the patient.

No model card, bias testing methodology, calibration analysis or drift concept is published, and no external audit of the scoring.

The validated part of this product and the marketed part are different parts, and that is the assessment.

Twelve published cognitive instruments described in the peer reviewed literature across three decades sit at the base, each stating the domain it measures, with more than 400 studies having used them. That is external validation of an unusually durable kind, and it means a clinician who asks why an individual task score came out as it did can read the task and the construct it targets. Contestability at that level is real.

What is not documented is the layer the product actually sells. The screening output that combines multiple task scores into a single impairment signal has no published derivation, weighting or validation, and the machine learning claim carries no description at all. A buyer relying on the composite is relying on something the published literature does not cover.

That distinction matters clinically, because a combined impairment signal is what triggers referral, further investigation or a conversation with a family, and the consequences of a false positive in cognitive screening reach into driving, employment and legal capacity.

On the commitment side nothing exists. No service level agreement, accuracy warranty, indemnity or remediation commitment is published, and the published screening figures come from a study of 14 patients, which is a research finding rather than a performance guarantee, with a confidence interval too wide for it to stand as either.

One recourse route is absent. Assessments can be completed unsupervised at home, so a patient may be flagged on the basis of a session nobody observed. Nothing describes how a patient or clinician challenges a result they believe reflects the conditions of the attempt rather than the patient's cognition.

Delivered as a web platform: a clinician sends an assessment link, the patient completes it in clinic or at home on a desktop or tablet, and a report returns to the clinician. That makes adoption easy and integration shallow, which is a reasonable trade for an assessment ordered occasionally rather than a tool used continuously, and the company sells the absence of setup as a benefit.

No named record system integration, no interoperability standard and no documented path for results to land as structured data in the chart is published.

The consequences are getting larger rather than smaller as the product grows. Cognitive screening during an annual wellness visit produces a result that has to be documented to be billed, and the company markets to payers on diagnosis capture and risk adjustment coding, both of which depend on the finding reaching the record. A result that lives only in the vendor's platform has to be transcribed by hand to become part of the chart, and a hand transcribed screening result is where coding errors originate.

The 2026 care planning capability raises it again, since a care plan that lives only in the vendor's platform is a second place a clinician has to look, and cognitive care planning is billable work whose documentation generally needs to sit in the record.

A hosted web platform with no published hosting architecture, named region or residency commitment.

Residency is a live question rather than a formality for this vendor specifically, because it operates across a border in both directions: a Canadian company holding assessment results for United States health systems, and a Canadian customer base whose provincial health privacy rules carry their own expectations about where records are held. Buyers on either side would reasonably ask where the data sits, and nothing published answers it. The published privacy policy routes patient data handling to the customer agreement rather than describing where it rests.

No cloud provider, region, tenancy model, segregation approach, backup posture or customer controlled option is described.

The delivery model adds a wrinkle. Assessments are completed by patients at home on their own devices through a link, so the collection point is outside any controlled environment and the transit path is the open internet. Nothing describes what protects the session between the patient's browser and the platform, or what is held on the device.

No pricing, pricing mechanism or contracting model is published, and every route terminates in a demo request.

The absence is less forgivable here than in categories with no payment pathway, because this one has an established pathway. Cognitive assessment and cognitive care planning carry their own procedure codes in the United States, so a practice can already compute the revenue side of the decision from public fee schedules. Every input to the economics is publicly computable except the one number the vendor holds. Publishing a per assessment price would let a primary care practice work out the whole case in an afternoon, which is a strong sales argument the company is declining to make.

The buyer spread compounds it. Independent practices, senior focused primary care, health systems and integrated delivery networks, payers and plans, and researchers are five different commercial conversations with different volumes and procurement routes, and nothing indicates whether they are priced per assessment, per clinician, per site or by annual license.

The payer pitch makes the omission stranger still. The company argues to plans that earlier detection means diagnoses documented and risk adjustment codes captured, which is an explicitly financial case, and it supplies the return side of that case without the cost side.

Broad, and breadth is a real differentiator here.

The same task battery is pointed at several clinical questions: mild cognitive impairment and dementia screening, attention deficit assessment including longitudinal monitoring of treatment over time, concussion and traumatic brain injury including baseline and return to play decisions, and behavioral health measurement through digitized standard questionnaires. The questionnaire library is enumerated rather than implied, covering attention and autism scales, substance misuse instruments including alcohol, drug and opioid risk measures, and brain injury, daily living and sleep measures. Condition focused assessment protocols are published for attention disorders and for dementia. A separate research offering is used in academic and commercial studies.

Settings run from primary care and senior focused primary care to neurology, psychiatry, occupational therapy, concussion clinics, health systems and integrated delivery networks, payers and plans, and research. More than 10,000 clinicians are claimed. Delivery works in clinic or remotely on a desktop or tablet with ordinary touch or mouse input, requiring no proprietary hardware, which removes a capital barrier. Geography is principally North America.

The breadth comes from one instrument being pointed at many questions rather than from validated indication specific products, and the strength of evidence differs considerably between those uses. The task battery's validity as a measure of cognition is well established; that it screens for dementia in primary care, or tracks attention disorder treatment response, or supports a return to play decision, are separate claims with separate evidence, and only the first has a published product study at all.

Delivery is in English and nothing addresses other languages, which matters for a percentile scored against a normative sample.