Elucid

The product is the algorithm. PlaqueIQ has no meaningful non-AI version: the entire commercial claim rests on convolutional neural networks classifying plaque components, and the company describes itself as an AI medical technology company rather than an imaging company that added AI. No underlying services business or hardware line dilutes this.

Not autonomous, and the company is clear about why. Specially trained analysts segment the CTA data to build the 3D coronary model before the software identifies, classifies and quantifies tissue composition. Output is an interpretive report supporting a physician decision, not a diagnosis.

Graded B rather than A because the human step is disclosed but its extent is not quantified: the company does not publish how much analyst time each case requires or how often analyst segmentation is revised, which matters for both throughput claims and reproducibility.

Unusually specific for an imaging vendor. Independent peer reviewed literature describes the architecture: convolutional neural networks trained on carotid endarterectomy histopathologic images co-registered to CTA for ground truth, using spatial distribution of tissue properties across adjacent voxels rather than fixed Hounsfield unit ranges, precisely because HU values overlap between lipid rich necrotic core, intraplaque hemorrhage and other components. That is a named, checkable technical mechanism rather than a claim of proprietary accuracy.

A dedicated section sets out real measures rather than assurances: processing only as needed and under the direction of the customer, physical, administrative and technical safeguards, confidentiality training that applicable employees sign for, encrypted transfer, a firewall, and access limited to authorised personnel with unique credentials, with onward transfers to agents carrying contractual assurances of equivalent protection.

That last item is the one most vendors omit, since it extends the obligation down the chain rather than stopping at the vendor's own perimeter. The open question is the one that matters most and the company's own wording creates it.

Stated purposes include improving software, algorithms and features based on the data, information and feedback received, and conducting research and development using it, with nothing excluding patient imaging from that use and no de identification qualifier attached.

This index has recorded elsewhere that a purpose limitation permitting improvement is where training sits, and this record is a step further, since algorithms and research and development are named explicitly rather than left to inference. Read plainly, the terms permit patient scans to inform algorithm development. There is also no retention period for submitted studies and no deletion commitment on termination. Ask directly whether patient scans inform algorithm development, on what basis, whether they are de identified first, and for retention and deletion terms.

The histology co-registration validation is a genuinely strong evidentiary foundation and is described in peer reviewed literature. Elucid also appears as one of three named commercial vendors in Radiology: Cardiothoracic Imaging and Applied Radiology reviews of the field, which is third party visibility rather than vendor marketing.

Graded B not A because that same 2026 Radiology: Cardiothoracic Imaging review states plainly that reproducibility, added prognostic value, clinical impact and lesion level assessment for actionable risk prediction remain open questions across the whole category. Validation against tissue truth is not the same as evidence that use changes outcomes.

A dedicated section on protected health information sets out real measures: processing only as needed and under the direction of the customer, physical, administrative and technical safeguards, confidentiality training that applicable employees sign for, encrypted TLS transfer, a firewall, and access limited to authorized personnel with unique credentials. Onward transfers to agents carry contractual assurances of equivalent protection.

The open question is the one that matters most, and the company's own wording creates it: stated purposes include improving software, algorithms and features based on the data, information and feedback received, and conducting research and development using it, with nothing excluding patient imaging data from that use and no de identification qualifier attached. There is also no retention period for submitted studies and no deletion commitment on termination. Worth asking directly whether patient scans inform algorithm development, and on what basis.

Neither HIPAA nor a business associate agreement is mentioned anywhere in the published materials. The company's only formal privacy instrument is a Data Privacy Framework program document scoped to personal data transferred from the European Economic Area, and it describes the relationship in GDPR terms, as a processor acting on behalf of and under the direction of a customer acting as controller.

That is the structural equivalent of a business associate relationship and the substance is sound, but it is written for European data subjects rather than for the US health systems that make up the buyer base. A US buyer should treat the BAA as a contract question and confirm its terms directly, because nothing published addresses it.

No SOC 2, HITRUST, ISO 27001 or trust center was located. What is published is a list of controls rather than an attestation: encryption at rest and in transit, proactive identification and management of vulnerabilities, backups, a firewall, access restricted to authorized personnel holding unique credentials, and confidentiality training that applicable employees sign a statement acknowledging.

Controls described by a vendor and controls tested by an independent auditor are different assurances, and only the first is on offer here. The one external accountability mechanism is real but is not a security attestation: certification to the EU-U.S. Data Privacy Framework, registered with the Department of Commerce, enforceable by the Federal Trade Commission and backed by independent dispute resolution. Worth asking whether a SOC 2 report or HITRUST assessment exists and can be shared under NDA.

PlaqueIQ received FDA 510(k) clearance announced October 2024 for non-invasive quantification and classification of plaque morphology, and a carotid version launched October 2025. Graded A with one important scoping caveat the company states plainly rather than blurring: the FFRCT product derived from the plaque algorithm is pending clearance and is not available.

That disciplined separation of the cleared product from the pipeline product is the same practice that earned Milvue credit, and buyers should confirm that any FFRCT discussion is treated as future capability.

No demographic subgroup analysis located. This matters more than usual here: the ground truth training set is carotid endarterectomy specimens, meaning tissue from patients who underwent surgery, which is a specific and non-representative population. Whether plaque classification performance holds across sex, age and ethnicity is not addressed in any located material, and cardiovascular risk stratification has well documented disparities.

The ground truth here is the strongest reference standard available in imaging and the mechanism is published rather than asserted. Independent peer reviewed literature describes networks trained on histopathologic images of tissue removed at surgery, co registered to the scan, so the label a voxel carries came from examining the actual tissue rather than from another reader's opinion of the image.

Almost every imaging product in this index is validated against expert consensus, which measures agreement with radiologists and inherits their errors; validating against removed tissue measures agreement with the disease. The method is also explained rather than named: spatial distribution of tissue properties across adjacent voxels is used rather than fixed attenuation ranges, precisely because those values overlap between lipid rich necrotic core, intraplaque haemorrhage and other components.

Stating why the simpler approach fails is a technical disclosure that lets a reader judge whether the harder one is warranted, and it tells a physicist exactly where the method would break. Held below the top grade because no per component accuracy is published for the individual tissue classes the product distinguishes, which is what a clinician acts on, and no warranty, indemnity or remediation commitment attaches. Ask for accuracy by plaque component against the histopathologic standard, the size of the validation cohort, and performance on scans acquired outside the protocols used in the co registration work.

Results reach the physician in two stated ways: a DICOM wrapped PDF delivered to the customer's PACS, and a link to an interactive browser for interrogating the coronary tree and the segmentation in more detail. Wrapping the report as DICOM is a well chosen mechanism, because results appear inside the existing radiology workflow without requiring a new system for the reader. Beyond that the picture is thin.

No EHR integration is named, there is no mention of FHIR or HL7 result routing, no PACS vendors or integration partners are listed, and nothing describes how the analysis reaches the ordering clinician or the patient record. Worth asking what integration work a site actually undertakes and how findings land in the chart.

The model is vendor side processing and the company states it plainly, including that certain products may require remote access from the United States to protected health information of customers' patients in the European Economic Area. That candour is creditable and it answers the question that matters most in this category, which is where the scan goes and who can reach it.

What is absent is the detail underneath: no hosting provider or cloud region is named, no data residency commitment is offered to US customers, and there is no on premise or customer tenant deployment option. Certification to the EU-U.S. Data Privacy Framework supplies a lawful transfer mechanism for European data specifically. Worth establishing where studies are stored, who can access them, for how long, and whether any deployment option keeps them on site.

No list price published, but like Cleerly the commercially decisive variable is reimbursement rather than licence cost, and here the coverage position is concrete and verifiable. Four of seven Medicare Administrative Contractors extended coverage for AI enabled quantitative coronary plaque analysis effective November 2024, EviCore added it to its guidelines, and United Healthcare aligned its cardiac imaging guidelines to include coronary CTA plaque quantification across all plans from October 2025. A buyer can establish the revenue path without a price list. Graded B rather than A because payer coverage of the procedure is not the same as a disclosed vendor fee structure.

Deliberately narrow. Coverage is atherosclerosis in coronary and, since October 2025, carotid arteries, serving cardiology and vascular medicine. This is depth rather than breadth and is a reasonable strategy, but against index peers spanning multiple body systems and specialties the coverage is limited, and it is graded on the same scale as those vendors.