GRAIL

The model is the engine of the result, and the signal starts in the laboratory. Galleri sequences targeted methylation regions of cell-free DNA from a blood draw, and machine learning classifiers turn that data into two outputs: whether a cancer signal is present and, when one is, a predicted cancer signal origin to guide the diagnostic workup. The company describes its platform as next generation sequencing, population scale clinical studies and machine learning, and the validation work it cites (Klein et al., Annals of Oncology 2021) describes the classifier as the step that produces the result.

The sequencing chemistry carries as much of the result as the model does, so the product is a laboratory test with a learned component at its core rather than a model on its own.

What the test may and may not be used for is published, with the route for each result, including the result that turns out wrong. Galleri is prescription only, ordered by a licensed provider with prescriptive authority, recommended for adults with elevated cancer risk such as those aged 50 or older, and not recommended in pregnancy, at age 21 or younger, or during active cancer treatment. It is to be used in addition to guideline screening, not instead of it.

Each result has a stated next step. A No Cancer Signal Detected result does not rule out cancer, and the patient continues recommended screening. A Cancer Signal Detected result requires confirmatory diagnostic evaluation guided by the predicted cancer signal origin, and results are to be interpreted by a provider alongside history, signs and symptoms. When the workup does not confirm cancer, the company states that this may mean no cancer is present or that testing missed it, including a cancer elsewhere in the body, and eligible patients are offered a complimentary retest at three to six months. In PATHFINDER 2, 7 of 63 participants who had PET/CT after a negative targeted evaluation had cancer found, which shows why a negative workup is not the end of the question.

The approach, the training data and the versions studied are described; the update practice for the version on sale is not. The method is published: targeted methylation sequencing of cell-free DNA, with machine learning classifiers that detect a cancer signal and predict its origin, developed and validated in the Circulating Cell-free Genome Atlas case control study (Klein et al., Annals of Oncology 2021) and then studied prospectively. The PATHFINDER 2 report names the versions: the study version whose results were returned to participants, a different version analyzed for the premarket approval application whose results were not returned, and the commercial version now on sale, with an updated signal origin algorithm that predicts one origin instead of two and adds supplemental biological information. The patient FAQ explains the same change, and the company describes a bridging analysis between the study version and the version submitted to FDA.

The classifier's architecture and the features it weighs are not published, and neither is a practice for telling ordering providers when the commercial version changes or how its performance compares with the versions studied.

A structurally short chain: the classifier is GRAIL's own and runs in its own laboratory. Samples are sequenced and analyzed at GRAIL's laboratory in Durham, North Carolina, and nothing published suggests a patient's data goes to an outside model.

The parties that are named sit around the sample and the record: AWS as GRAIL's preferred cloud provider, Epic for the planned record integration, partner laboratories and mobile technicians for blood draws (unnamed on the patient pages), and business associates such as a billing service (unnamed in the privacy notice). The provider data protection addendum requires a security and privacy risk assessment of every subcontractor handling PHI and written terms at least as protective as its own. No subprocessor list is published.

Randomized and prospective evidence in the intended use population, and the randomized trial did not meet its primary endpoint. NHS-Galleri (Sasieni et al., New England Journal of Medicine, 22 September 2026) randomized 142,250 people aged 50 to 77 in England to testing or stored blood across three annual rounds, led by academic investigators with NHS England and funded by the company. The incidence of stage III or IV cancer across 12 prespecified cancers did not differ between the groups (incidence rate ratio 1.03, 95 percent confidence interval 0.92 to 1.14). Stage IV cancer, a key secondary endpoint, had a ratio of 0.86 (0.74 to 1.00). Fewer than 1 percent of participants had trial related adverse events and none was serious. Follow up continues.

The performance data come from two reports in Nature Medicine published the same day. In NHS-Galleri, positive results went to 0.80 to 1.03 percent of participants per round, positive predictive value was 58.0, 50.4 and 45.8 percent by round, specificity 99.50 to 99.60 percent, episode sensitivity 26.7 to 37.2 percent for all cancers, and cancer signal origin accuracy 91.1 to 93.6 percent. PATHFINDER 2, a prospective study at US and Canadian sites (35,878 enrolled, 32,007 analyzable, aged 50 and older), found a cancer detection rate of 0.54 percent, positive predictive value 60.3 percent, specificity 99.64 percent and episode sensitivity 39.3 percent, with 0.6 percent of participants having an invasive procedure after a positive result.

The company's own summaries lead with stage IV reductions in the second and third rounds (22 and 26 percent) and a fourfold increase in detection. The trial's published primary result is the null one above. The version of the test studied has since been replaced commercially by one with an updated signal origin algorithm, with a bridging analysis supporting the version submitted to FDA.

Categorical commitments are published, with retention left general and one sales channel left unexplained. GRAIL's HIPAA notice of privacy practices covers test results and genetic information, and states that GRAIL will not sell a patient's PHI without written authorization and will not disclose it to third parties for marketing without authorization. It also states that PHI may be used for research within GRAIL and with outside collaborators under contract, generally subject to review by a committee responsible for protecting research subjects, and that PHI may be de-identified. The provider data protection addendum commits the company to administrative, technical and physical safeguards under a written security program.

What is not stated is how long blood specimens, sequencing data and results are kept, or whether a commercial patient's sample and data enter research by default. The privacy policy's retention language is general: kept as long as necessary for the purposes collected. Safety engineering for the classifier, meaning how a model error is detected and handled, is not published.

One channel needs its own answer. The company markets Galleri to life insurers and their policyholders, with John Hancock Vitality and Munich Re featured on its life insurance page, and federal genetic nondiscrimination law does not reach life, disability or long term care insurance. The life insurance page does not say what, if anything, the insurer receives about who tested or what the result was.

GRAIL's status is stated, and the instrument is published before contracting. The test is run by a laboratory that is a covered entity in its own right, and GRAIL says so in both documents a buyer needs. Its HIPAA notice of privacy practices sets out the HIPAA and HITECH duties, patient rights, breach notification within 60 days, and the requirement that business associates protect PHI.

Its Data Protection and Information Security Addendum (last updated 27 May 2025), incorporated into every Galleri testing agreement, states that the customer and GRAIL are each covered entities and that GRAIL holds an indirect treatment relationship with the customer's patients. It binds GRAIL's use of PHI to the notice, requires any subcontractor handling PHI to agree in writing to terms at least as protective, with a business associate agreement meeting 45 CFR 164.504(e) where the subcontractor is a business associate, and sets out the security program behind it. It applies to every customer under the testing agreement, so no tier question arises.

Certifications are named and published as documents anyone can open. GRAIL's quality and regulatory page links a Schellman Compliance ISO/IEC 27001:2022 certificate (number 1579261-7, version 7, issued 25 August 2025, first registered 24 June 2021, expiring 22 June 2027). Its scope covers the information security management system supporting the software development, commercialization and production support of GRAIL's commercial products and services, including research, clinical trial and commercialization activities, with in-scope locations in Menlo Park, Durham and London. The page labels the certificate ISO 27001:2013; the certificate itself is to the 2022 revision.

The same page links ISO 13485 and ISO 15189 certificates and the laboratory's CLIA, CAP and state licenses, which cover quality and laboratory competence rather than information security. The provider data protection addendum commits GRAIL to a security framework aligned to ISO/IEC 27001 and to provide current certifications on written request. No SOC 2 report is named.

The pathway is stated and in progress, with a favorable advisory panel vote and no approval yet. Galleri is offered today as a laboratory developed test, and the provider pages state that it has not been cleared or approved by FDA. It has held Breakthrough Device designation since 2018, GRAIL submitted its premarket approval application on 29 January 2026, and on 23 September 2026 FDA's Molecular and Clinical Genetics Devices Panel voted unanimously on safety, 6 to 4 on effectiveness, and 7 to 2 with one abstention that benefits outweigh risks, for screening adults aged 50 and older. The company's release states that FDA is not bound by the vote and that a decision is expected in the coming months.

Three versions appear in the published record: the version used in the PATHFINDER 2 study, the commercial version with an updated signal origin algorithm, and the version submitted to FDA, supported by a bridging analysis. The proposed indication (adults aged 50 and older) is also narrower than today's commercial recommendation (adults with elevated risk, such as those aged 50 or older). Any approval will name a version and an indication, and either may differ from what is ordered today.

Subgroup performance is published across clinical and demographic groups, with the weak spots visible. The PATHFINDER 2 report (Nabavizadeh et al., Nature Medicine, September 2026; 35,878 enrolled and 32,007 analyzable, aged 50 and older, at US and Canadian sites) reports performance by age group, sex and smoking status, and episode sensitivity by cancer type and prespecified cancer group. The results show where the test is weaker: the cancer detection rate rises with age and is higher in men and in people with a smoking history, the group aged 80 and older had lower positive predictive value and specificity than other ages, and episode sensitivity was 39.3 percent across all cancers against 69.8 percent in a prespecified group of 12 deadly cancers, with more than half of that gap explained by breast and prostate cancers. The NHS-Galleri performance report (Neal et al., Nature Medicine, September 2026) gives the same measures by screening round in 142,250 participants aged 50 to 77 recruited through the NHS in England.

Race and ethnicity were recorded, and PATHFINDER 2 subgroup analyses by race, ethnicity, body mass index and prior cancer history are prespecified in the protocol, but those results are not in the published report. For a test sold for population screening, that is the comparison still missing. Both studies were funded by the company, with academic investigators leading NHS-Galleri.

Error rates are published with their method and denominators, and a retest route follows a false alarm; nothing makes the company answerable for a result. The provider pages give the positive and negative predictive values from PATHFINDER 2 and cite the study, and the full reports set out the counts: in PATHFINDER 2, 60.3 percent of positive results led to a cancer diagnosis and 99.2 percent of negative results were correct at 12 months, with episode sensitivity of 39.3 percent across all cancers; in NHS-Galleri, positive predictive value fell from 58.0 percent in the first screening round to 45.8 percent in the third. Every figure is published with its denominator and follow up rule.

When a diagnostic evaluation after a Cancer Signal Detected result does not confirm cancer, the provider FAQ says the patient may be eligible for a complimentary retest within three to six months. That is a correction route offered on eligibility rather than as a commitment. No guarantee, indemnity or remediation obligation attaches to the result, and the diagnostic workup a positive result triggers is not included in the test price.

One named record system is in early adoption, and the working route today is a portal and fax. GRAIL announced a collaboration with Epic in April 2026 to make Galleri orderable, with results available, inside Epic through Aura, with implementation begun in the first quarter of 2026, early adopter programs underway and broad availability expected by the end of 2026; Ochsner Health's chief population health officer is quoted on the plan. No health system is named as live, and the provider pages describe no ordering or results inside a record system. Providers order through GRAIL's Provider Portal or a test requisition form and receive results in the portal or by fax.

That matters for a test meant to be repeated each year alongside mammography, colonoscopy and other screening intervals, because a result held outside the record is harder to track. A health system named as live on the Epic integration would change this answer.

A laboratory service with one testing site and a named cloud provider, and no committed data location. Blood drawn at a partner laboratory or by a mobile technician ships to GRAIL's clinical laboratory in Durham, North Carolina (CLIA certificate 34D2231294, CAP 9151388), where sequencing and the classifier run; results reach providers about two weeks after the sample arrives, through the Provider Portal or by fax. The April 2026 Epic announcement names AWS as GRAIL's preferred cloud provider.

No region, residency commitment, tenancy model or retention period for specimens and sequencing data is published, and no second laboratory is listed for continuity.

A list price is published for the individual test, and the business channels are negotiated. The provider pages state a list price of $949 for the Galleri test, with a 0 percent payment plan of up to 12 months (not available for online requests), FSA and HSA eligibility, an income based financial assistance program, and a note that most health insurance plans do not cover the test and that the price does not include the diagnostic workup a positive result triggers. Health systems, employers, life insurers, health plans and first responder programs contract separately, with no published rate card. Some TRICARE plans cover the test, and Priority Health covers it in two Medicare Advantage plans.

The company's quarterly results fill in the rest. In the second quarter of 2026, Galleri revenue was $42.6 million on more than 61,000 tests, under $700 per test on average and below the list price, and the company reported a GAAP gross loss of $12.6 million (non-GAAP adjusted gross profit of $21.6 million) and a net loss of $110.2 million for the quarter.

Coverage is named, and validation covers part of it. The studies behind the test enrolled adults aged 50 and older (PATHFINDER 2, at US and Canadian sites) and aged 50 to 77 (NHS-Galleri, in England), and the indication before FDA is screening adults aged 50 and older. The commercial recommendation is wider: adults with elevated cancer risk, such as those aged 50 or older, excluding people who are pregnant, 21 or younger, or in active cancer treatment, sold through employer, health system, life insurance, health plan and first responder programs as well as individual orders. Adults under 50 with other risk factors fall inside the commercial recommendation and outside the populations studied.

Within the studied ages, the published subgroup results show where the test is weaker, including lower positive predictive value and specificity at age 80 and older. Signals are reported across more than 50 cancer types.