GRAIL

Machine learning on targeted methylation data is what converts a blood draw into a cancer signal and a predicted tissue of origin, and peer reviewed literature describes the ML algorithms as central to the method. Held back from A because the product is a wet lab assay plus an ML classifier: the sequencing chemistry is as load bearing as the model, and the two cannot be separated.

Bounded clearly and stated consistently, which matters more here than in most records because a screening test that overstated its own role would be dangerous.

The test requires a prescription from a licensed healthcare provider, so it does not reach a patient without a clinician deciding it is appropriate. It returns whether a cancer signal was detected and, where one is found, a predicted signal of origin intended to direct the diagnostic workup. It does not diagnose. The diagnosis comes from the workup the clinician then orders, and the company describes the result in those terms rather than as a finding.

The adjunctive framing is repeated in essentially every public statement: Galleri should be used in addition to recommended cancer screening such as mammography, colonoscopy, prostate specific antigen testing and cervical screening, not instead of it. That is the single most important sentence a multi cancer test can publish, because the harm case for this category is a patient who stops attending the screening that has proven mortality benefit.

The supporting operational detail is disclosed too, including a reported median time to diagnostic resolution and an observation that resolution time improves as clinicians gain experience with the workup, which is an honest acknowledgement that the oversight model has a learning curve.

The classifier itself is proprietary and undescribed, and this is still the strongest transparency record in the index, because of what the company has published about how the test performs when tested properly.

The method is described in peer reviewed literature: targeted methylation sequencing of circulating tumour DNA with machine learning classifiers producing a cancer signal and a predicted tissue of origin. Performance is published across PATHFINDER 2 at 25,490 participants and the NHS-Galleri trial at 142,250, alongside cancer signal origin accuracy, detection rate against standard screening, stage distribution and time to diagnostic resolution.

What earns the A is the negative result. NHS-Galleri is the only randomised controlled trial of a multi cancer early detection test ever run, and its combined Stage III and IV primary endpoint was not met. GRAIL published that, presented the full results at a major oncology meeting, and its chief scientific officer explained the mechanism openly, that a substantial fall in Stage IV diagnoses was outweighed by a rise in Stage III, particularly in the first screening round.

A company that runs the hardest possible test of its own product and publishes the result when it does not clear the bar has done something almost nothing else in this index has done.

The limit is real and worth stating: the model architecture is not published, so external parties can characterise what the test does but not why it fails where it fails.

The most consequential data in this index, handled with published instruments and carrying one structural exposure the company cannot fix. What is published is substantial: the privacy notice defines protected health information to include genetic information explicitly rather than leaving it to inference, sets out patient rights, and governs disclosure to business associates, with a provider addendum carrying the contractual commitments including a subcontractors clause and state specific notices alongside.

Secondary research use is disclosed rather than buried, and the disclosure is broad: in the trial context, coded information may be used for further studies by the company, its collaborators and other researchers, potentially linked to sources outside typical research settings including health records and biobanks, on a legitimate interest basis, with anonymisation applied where possible.

That is transparency and it is also a wide grant, and a reader should establish what the equivalent terms are for the commercial test rather than assuming the trial terms carry over. The structural exposure belongs on the record because neither a buyer nor a patient is likely to know it.

Federal genetic nondiscrimination protection covers health insurance and employment and does not reach life, disability or long term care insurance, where it remains lawful to ask whether someone has had testing and to use the answer. A cancer signal result is exactly what those lines underwrite on. That gap is not this company's doing, and it is not disclosed on the consent path either.

The deepest evidence base in the index, and now the only one that includes a published negative result from its own pivotal trial.

PATHFINDER 2 enrolled 25,490 participants. The NHS-Galleri trial enrolled 142,250 demographically representative participants aged 50 to 77 and ran for three years inside England's National Health Service. It is the first and only randomised controlled trial of a multi cancer early detection test.

The result, reported in February 2026 and presented in full at the 2026 ASCO Annual Meeting, is mixed and must be read carefully. The primary endpoint was a statistically significant reduction in combined Stage III and IV diagnoses across a pre specified group of 12 deadly cancers when Galleri was added to standard screening. That endpoint was not met within the one year follow up window after the final appointment.

The secondary findings are substantial. Stage IV diagnoses fell by more than 20 percent, Stage I and II diagnoses rose 16 percent, and cancer detection increased around four fold against standard screening alone. The company attributes the primary endpoint result to the Stage IV reduction being offset by an increase in Stage III diagnoses, particularly in the first screening round, and has extended follow up by six to twelve months.

The grade holds, and the reason matters. This axis measures the existence, scale and design of evidence, not whether the product succeeded. Running the only randomised controlled trial in the category, against a hard population level endpoint chosen with the health service, and publishing the miss, is stronger evidence behaviour than any competitor has attempted. A buyer should nonetheless treat late stage reduction as unproven at present and watch the extended follow up.

The most consequential data in this index, handled with published instruments and one structural exposure the company cannot fix.

What is published is substantial. The HIPAA notice defines protected health information to include genetic information explicitly, sets out patient rights, and governs disclosure to business associates. A provider addendum carries the contractual commitments including a subcontractors clause. State notices sit alongside for California and other jurisdictions.

Secondary research use is disclosed rather than buried, and the disclosure is broad. In the trial context the company states that coded information may be used for further studies by GRAIL, its collaborators and other researchers, potentially linked to sources outside typical research settings including electronic health records and biobanks, on a legitimate interest basis, with anonymisation applied where possible and retention for as long as needed to fulfil the stated purposes. That is transparency, and it is also a wide grant. Establish what the equivalent terms are for the commercial US test rather than assuming the trial terms apply.

The structural exposure is the one a buyer and a patient should both understand. Federal genetic nondiscrimination protection covers health insurance and employment. It does not reach life, disability or long term care insurance, where it remains lawful to ask whether someone has had testing and to use the answer. A cancer signal result is precisely the kind of information those lines underwrite on. That gap is not GRAIL's doing, and it is not disclosed on the consent path either.

Takes the first of the three routes to a top grade in this index: publish the instrument.

GRAIL publishes a full HIPAA Notice of Privacy Practices for US residents, which is a covered entity obligation rather than a marketing page, and it is written for the patient rather than the buyer. It states the HIPAA and HITECH duties directly, defines protected health information to include genetic information explicitly, sets out patient rights, and describes the circumstances in which information is disclosed to business associates and the obligations those parties carry.

It also publishes a Data Protection and Information Security Addendum for ordering providers, which is the contractual instrument itself rather than a description of one. That addendum commits the company to applicable privacy and data security law including HIPAA, binds its use and disclosure of protected health information to the published notice, and carries a subcontractors clause.

State layers sit on top and are handled properly rather than collapsed: a California notice, supplemental state notices, and explicit reference to the California Confidentiality of Medical Information Act, with the HIPAA notice stated to control in any conflict with the general privacy policy.

A patient or a provider can read what governs this relationship before entering it. Very little in this index clears that bar.

One distinction governs this grade and it is easy to get wrong.

GRAIL's laboratory is certified under the Clinical Laboratory Improvement Amendments and regulated to perform high complexity testing. That is a rigorous regime and it is the right one for the analytical validity of a laboratory developed test. It is not an information security attestation. CLIA governs whether the test result is accurate and the laboratory competent to produce it. It says nothing about how the data generated is protected once it exists.

Searching specifically for an information security position surfaced the company's privacy notices and its provider data protection addendum but no SOC 2 report, no HITRUST certification, no ISO 27001, and no trust centre publishing certificates, audit dates or scope.

The addendum does commit the company to applicable data security law and carries a subcontractors clause, and that is a contractual assurance rather than an independent one.

The gap is notable given what is held. This organisation holds methylation sequencing data and cancer signal results for a large and growing screened population, which is among the most sensitive datasets in this index. An independent security attestation is the ordinary way a buyer verifies that such a holding is protected, and none was found.

Regulatory positioning is stated with exemplary precision. Galleri holds FDA Breakthrough Device designation (2018), GRAIL submitted the final module of its Premarket Approval application in January 2026, and the test is currently offered as a laboratory developed test pending that decision. The company does not describe the test as FDA approved. This axis grades clarity of positioning, and GRAIL is the reference standard for it.

Stronger than most on representativeness by design, short of the top grade on published subgroup performance.

The NHS-Galleri trial was built as a demographically representative sample of a national population aged 50 to 77, run inside a public health service rather than a selected commercial cohort. Designing the pivotal study to reflect the population it would screen is a governance choice, and it is the opposite of the convenience sampling common in this index.

Publishing a null primary endpoint belongs on this axis as well as on transparency, because a company willing to report that its own trial did not clear its endpoint is unlikely to be concealing subgroup weakness.

What is not published, and what would move this to an A, is performance broken down by group. For a screening test the relevant question is whether detection rate, false positive rate and signal of origin accuracy hold across sex, ethnicity, age band and comorbidity, since methylation signal and tumour biology are not uniform across populations.

Two governance issues are inherent to the category rather than to this company and belong in any buyer's evaluation. False positives send healthy people into diagnostic workups they did not need. And a test that increases detection raises the overdiagnosis question, since some cancers found would never have harmed the person. The Stage III increase seen in the trial is the sharpest available prompt for that discussion, and the company addressed it directly rather than avoiding it.

The classifier is proprietary and undescribed, and this is still the strongest record on this axis in the index, because of what the company did with the hardest available test of its own product. Performance is published across a large registrational study and a randomised trial of over a hundred and forty thousand participants, alongside signal origin accuracy, detection rate against standard screening, stage distribution and time to diagnostic resolution.

What earns the top grade is the negative result. That randomised trial is the only one of its kind ever run for a multi cancer early detection test, its combined late stage primary endpoint was not met, and the company published that, presented the full results at a major oncology meeting, and had its chief scientific officer explain the mechanism openly: a substantial fall in the most advanced diagnoses was outweighed by a rise in the stage below it, particularly in the first screening round.

A company that commissions a randomised trial it could have avoided, and then publishes and explains the result when it does not clear the bar, has done something almost nothing else in this index has done, and the explanation is more useful to a reader than the headline would have been.

The limit is real and worth stating: the model architecture is not published, so external parties can characterise what the test does but not why it fails where it fails, and no warranty, indemnity or remediation commitment attaches. Ask what changed in the analysis after the endpoint miss.

The thinnest axis on this record, and largely a consequence of the delivery model rather than neglect.

Today the workflow is a prescription and a report. A licensed provider orders the test, the specimen is drawn and sent to the laboratory, and a result returns to the ordering clinician. Nothing published describes native integration with electronic health record systems, structured result delivery, discrete result coding, or ordering through an existing laboratory interface.

That matters more than it would for a one off diagnostic, because this is a screening test intended for annual repetition in adults over 50. A result that arrives outside the record, in a population where the clinician is also tracking mammography, colonoscopy, prostate specific antigen and cervical screening intervals, is a result that is easy to lose track of.

The company has stated an intention to integrate Galleri into the Epic platform to broaden access. That is a plan rather than a shipped capability, and it is graded as such here. If it lands it would change this axis materially, since ordering and result return inside the record is the difference between a test a practice can operate at scale and one it cannot.

This is a laboratory service rather than deployed software, and that determines the answer. A blood sample and everything derived from it leave the ordering practice entirely and come to rest with GRAIL, which processes them in its own clinical laboratory, certified under the Clinical Laboratory Improvement Amendments and regulated to perform high complexity testing.

That places this record at the far end of the where does the data go spectrum this index uses elsewhere. The cardio CT lane splits on where the scan goes and drug discovery on where the chemistry goes. Here the entire specimen goes, along with the sequencing data generated from it, and there is no configuration in which it does not. The model is total transfer by design rather than by omission.

What is unpublished is everything about where the derived data then sits. No hosting provider, no region, no residency statement, and no subprocessor list, although the provider addendum contains a subcontractors clause whose terms are not public.

The questions that follow are specific to this architecture and should be put in writing: how long is the physical specimen retained, how long is the sequencing data retained, and what happens to both if the patient withdraws or the ordering relationship ends.

Two channels with very different transparency, and a listing that discloses more than either.

Consumer facing pricing exists for the individual test, so a person can find out what it costs before ordering. The business channel this index covers, health system and employer contracting, has no published rate card and is negotiated.

What lifts this above the private vendors in this batch is the filing obligation. GRAIL trades on Nasdaq and reports quarterly, publishing both Galleri revenue and test volume in the same release. A buyer can therefore derive average realised revenue per test from the company's own numbers rather than accepting an assertion, which no privately held vendor in this index permits.

The more useful disclosure is the one most companies would rather not make. GRAIL reports a GAAP gross loss, meaning the current price does not cover the cost of delivering the test, alongside substantial net losses and a large cash position funding the gap. That is a material commercial fact for anyone signing a multi year agreement, because it says plainly that present pricing is not a steady state and the economics have to move as the assay cost falls or the price rises.

Held at B rather than higher because none of that is contract terms. There is no published mechanism for the business channel, no term length, no renewal or escalator language, and no volume banding. Reimbursement is the live variable, and a pending premarket approval decision is what would change it.

Scope is explicit: multi cancer early detection as an addition to standard of care single cancer screening, in adults typically over 50, with signals reported across more than 50 cancer types. Intended use is clearly bounded as a complement to and not a replacement for existing screening.