Ibex Medical Analytics

Deep learning on whole slide images is the product. Ibex sells AI applications rather than an image management system: Galen Prostate, Galen Breast and Galen Gastric analyze H&E whole slide images and return cancer detection and, as the home page puts it, more than a hundred other diagnostic features into the laboratory's own viewer or image management system. The FDA cleared Galen Second Read is described in its 510(k) summary as software derived from a deterministic deep convolutional neural network developed on prostate core needle biopsy images, and the company says its models were developed from more than 10 million slides from multiple pathology institutes. The products integrate into partners' systems rather than replacing them, so there is no platform underneath that sells without the models.

The artificial intelligence is the product. Remove the model and there is nothing left to sell.

What the cleared product may and may not do is published, with the conditions that route a case to a person. The Galen Second Read 510(k) summary (K241232) states that the device runs only on cases the pathologist has already diagnosed as benign. It first measures the amount of tissue and of out-of-focus tissue on each slide and scores only slides within predetermined ranges; slides whose score crosses a predetermined threshold get a case- and slide-level alert with a heatmap, and slides below it get no output. Every flag goes to a pathologist, who confirms it (changing the diagnosis), rejects it, or seeks more information such as additional stains, and the outputs are not to be used on a standalone basis for diagnosis or to rule out adenocarcinoma. Because the pathologist reads first, the software cannot anchor the initial diagnosis.

The threshold value itself is not published, and the case-level specificity of 46.9 percent in the same filing means many flags will be false positives the pathologist has to clear.

Scope, exclusions, routing and the override path are published for the cleared product.

The approach is named and the training data characterized in outline, without version or update discipline. The Galen Second Read 510(k) summary (K241232) describes the device as derived from a deterministic deep convolutional neural network developed with whole slide images of H&E stained prostate core needle biopsies, and the company says its models were developed from more than 10 million slides from multiple pathology institutes. The summary describes the outputs precisely: a tissue ratio and an out-of-focus ratio for every slide, a slide-level cancer score against a predetermined threshold, and a heatmap. Precision and clinical study results for the cleared product are published in the same filing.

No model version, release history or update practice is published for any Galen product, and no architecture detail is published for breast and gastric.

The approach is named without the version and update discipline behind it.

A short, enumerated chain, with the training terms missing. Ibex builds its own models, so no outside model provider sits between a slide and a result, and the published sub-processor list names four parties: Amazon Web Services for cloud infrastructure and customer data, processing in customer-selected regions, and Zendesk, Salesforce and HubSpot, each marked as receiving no PHI. The data protection addendum commits to 14 days' notice of any new sub-processor, allows deletion of customer personal data 21 days after receipt unless another period is agreed, and requires deletion from sub-processors' systems at termination. The business associate addendum binds subcontractors receiving PHI to substantially similar terms. The list carries its date only in its file name.

What is missing is the training term: neither addendum says whether customer slides, identified or de-identified, train Ibex's models.

Structurally the chain is short, every party is named and retention is fixed, which leaves training as the one open term.

Multi site clinical studies with method and counts, retrospective. The Galen Second Read 510(k) summary (K241232) reports a standalone study on 347 benign-diagnosed cases at three sites and a reader study on 772 cases (396 with cancer, 376 benign) read by 12 pathologists at four sites, three in the United States, each case read with and without the device after a two week washout. With the device, pathologists' sensitivity rose from 90.5 to 93.9 percent (a 3.5 point gain, 95% CI 2.3 to 4.5) and specificity fell from 91.1 to 87.9 percent (a 3.2 point loss, 1.9 to 4.3); on slides first read as benign, pathologists using the device caught 41 of 113 cancers (36.3 percent) with specificity of 96.5 percent. The company's materials also cite a Lancet Digital Health study of the prostate algorithm, and named deployments include the six university health boards of NHS Wales, University of Pittsburgh Medical Center and Alverno Laboratories.

The filed studies are retrospective, prostate only and on one scanner model; breast and gastric evidence is not part of them.

Published research with method and counts, short of prospective independent validation of the product in use.

Retention and de-identification are stated in published contract documents; training use is not. The Data Protection Addendum (last updated February 2026), linked from the trust center, lets Ibex delete customer personal data 21 days after receipt unless a different period is agreed in the purchase confirmation, and requires deletion from Ibex's and its sub-processors' systems at termination or on written request. The Business Associate Addendum (February 2026) permits Ibex to de-identify customer PHI under the HIPAA standard at 45 CFR 164.514(b) and to use it for data aggregation as HIPAA permits. Neither document states whether customer slides, identified or de-identified, train Ibex's models: the addendum lists processing purposes that include improvement and optimization of the services, and the anonymization it permits is governed by the principal agreement's terms. Safety engineering, meaning how a wrong output is handled as a safety event, is not published.

Two of the three elements stated specifically, with training use left open.

Business associate status, the agreement, its scope and its reach to subcontractors are all published. The trust center links a Business Associate Addendum (last updated February 2026) between Ibex Medical Analytics Inc. and the customer. It is incorporated into Ibex's General Terms and Conditions and applies wherever HIPAA governs Ibex's use of customer PHI and the parties have agreed the data may include patient identifiers. It requires subcontractors that receive customer PHI to agree to substantially similar restrictions and conditions, permits de-identification under 45 CFR 164.514(b) and data aggregation as HIPAA allows, requires prompt reporting of security incidents and breaches, and requires deletion of customer PHI from Ibex's and its subcontractors' systems at termination or on request. The trust center also publishes a data protection addendum and a sub-processor list, and its compliance page names HIPAA and HITRUST.

The breach reporting clause gives no timeframe in days.

Status stated, agreement published, scope clear and subcontractors bound.

Recognized certifications are named, and the artifacts are available only on request. The trust center's compliance page names ISO 27001, ISO 27799, ISO 13485, Cyber Essentials Plus, HITRUST and BSI C5:2020, beside HIPAA and GDPR, and the data protection addendum refers to Ibex's ISO 27001 and HITRUST certifications. The security page states that penetration tests of the code and application run at least annually, that data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256, and that the environment is hosted on AWS in a virtual private cloud. No certificate, report, scope statement or date is published, and the trust center directs buyers to contact the company for certifications. ISO 13485 is a quality management standard for device manufacturing rather than a security certification.

In short, the names are public and the evidence behind them is not.

The regulatory position is identifiable and scoped. FDA's database lists one 510(k) for Ibex Medical Analytics Ltd., cleared on 24 January 2025 under K241232 with product code QPN. It covers Galen Second Read, with Paige Prostate as the predicate. It is cleared to analyze H&E whole slide images of prostate core needle biopsies scanned on the Philips Ultra Fast Scanner, for cases the pathologist initially diagnosed as benign, flagging slides likely to contain adenocarcinoma for further review; its outputs are not for standalone diagnosis or to rule out cancer. The company states that the prostate product is FDA cleared and its other solutions are research use only in the United States, and it lists CE-IVD marking under the IVDR with registrations in the UK, Australia and Brazil.

The clearance covers the AI itself, and the cleared label sits on the product it covers. The US scope is narrow: one scanner model, benign diagnosed cases only, prostate only.

Scanner and operator variation is tested and published with counts for the cleared prostate product. The 510(k) summary of 24 January 2025 (K241232) for Galen Second Read reports within scanner repeatability over three runs and between scanner reproducibility across three Philips Ultra Fast scanners and operators, on 39 cancer positive and 38 negative slides judged against a pathologist ground truth. Correct calls on positive slides ran from 94.9 to 97.4 percent per scanner and operator, and on negative slides from 84.2 to 86.8 percent. Scanner variation is the failure mechanism the pathology field names first, so these are results at the product's own point of risk, with the counts behind them. The evaluation stays within one scanner model, because the device is cleared only for the Philips Ultra Fast Scanner.

No results by patient group, site, stain protocol or other scanner makes are published, and no AI governance framework is named. ISO 13485 and the clearances are regulatory and quality credentials, not an evaluation of model behavior.

The published work reaches the product's failure mechanism with counts, and stops short of results compared across the groups the product serves.

The company's own regulatory filing publishes an error rate for the cleared product, and no commitment stands behind it. Filed under K241232 and dated 24 January 2025, the Galen Second Read 510(k) summary reports a retrospective standalone study at three sites (two in the United States, one outside) on 347 cases initially diagnosed as benign on prostate core needle biopsy, scanned on the Philips Ultra Fast Scanner, against a reference standard set by two independent expert pathologists with a third resolving disagreements. Slide-level sensitivity was 81.0 percent (95% CI 69.2 to 92.9) and specificity 91.6 percent (90.9 to 92.3); case-level sensitivity was 80.8 percent (74.1 to 87.6) and specificity 46.9 percent (39.5 to 54.3), so more than half of truly benign cases draw a flag a pathologist has to clear. These are test set results for the cleared second read indication, not performance in use, and they do not cover Galen Breast or Galen Gastric.

No warranty, indemnity or remediation commitment attaches to an output, and the summary leaves the final diagnosis with the pathologist.

Method and denominator are public, and no contractual promise backs the number.

Named integrations with the systems a pathology laboratory runs, with direction not documented. The partners page names image management and viewer partners (Roche's navify Digital Pathology, Philips, Proscia, Sectra, Fujifilm, Indica Labs, PathPresenter, Corista, Gestalt Diagnostics and Tribun Health) and a laboratory information system vendor, Dedalus, and says Galen's results reach clinical workflows through an open API across LIS, image management systems and scanners. The 510(k) summary describes the cleared product ingesting slides automatically from the scanner and image management system, with the diagnosis documented in another system such as the LIS. No integration documentation or marketplace listing is published, and which systems receive results back is not stated. For a pathology product the laboratory information system and image management system, not the patient chart, are the correct surfaces.

Named systems with read access and results returned to the viewer, short of documented bidirectional integration.

A cloud service with its host and region choice stated, and tenant isolation open. The 510(k) summary describes Galen Second Read as cloud-hosted, ingesting slides automatically from the laboratory's scanner and image management system. The trust center's security page states that the environment is hosted on AWS in a virtual private cloud across multiple regions and availability zones, and the published sub-processor list names Amazon Web Services for customer data, processing in customer-selected regions. The data protection addendum names the cross border route: transfers to Ibex Medical Analytics Inc., the US subsidiary, rely on its Data Privacy Framework certification. Named deployments include NHS Wales, University of Pittsburgh Medical Center and Alverno Laboratories.

Tenant isolation is not described beyond the virtual private cloud, no on premises option is described, and which processing crosses a border for a given region is not set out.

The option and residency are stated, with isolation and the processing path left open.

No price is published. The company's pages carry no list price, per case or per slide rate, tier structure or worked example for any Galen application, and commercial contact runs through a contact form. How the product is sold can be established in outline: Galen runs as a cloud service on AWS and integrates into laboratories' existing image management and laboratory information systems through partners the company names (Roche's navify Digital Pathology, Philips, Proscia, Sectra, Fujifilm, Indica Labs, PathPresenter, Corista, Gestalt Diagnostics, Tribun Health and Dedalus), so some laboratories may reach it through one of those relationships. The data protection addendum refers to a per customer purchase confirmation that can set terms such as the retention period. Only the prostate second read is cleared in the United States.

The sales posture is discoverable and no price is published.

Three cancer types, with validation behind the cleared prostate indication. The company sells Galen for prostate, breast and gastric biopsies and says its models were developed from more than 10 million slides from multiple pathology institutes. The US clearance is narrow and precise: H&E prostate core needle biopsies initially read as benign, scanned on the Philips Ultra Fast Scanner, validated in studies at three and four sites. Outside the United States the products carry CE-IVD marking and registrations in the UK, Australia and Brazil; in the United States breast and gastric are research use only. Training institutions are not named, and validated scanners beyond the Philips model are not listed in the filing.

Coverage named with validation behind part of it.