Linus Health

The contrast with BrainCheck, also indexed, is the point of this grade. Linus Health does not digitise a paper test and score it; it analyses the drawing PROCESS, capturing temporal and spatial features of stylus manipulation across the entire act of drawing, plus speech and acoustic features, and derives metrics that have no paper equivalent. The LinusAD algorithm combines those behavioural features with age and APOE status to predict amyloid status. Remove the model and there is no product. This is the record that establishes what a genuinely AI-native cognitive assessment looks like in this index.

Positioned as a clinical aid producing provider reports for interpretation, with patient action plans and triage support rather than autonomous diagnosis. The FDA framing as a computerized cognitive assessment AID is explicit about the boundary. Reports include the actual clock drawing and recall recordings so a clinician can inspect the raw performance behind the score, which is a meaningful oversight affordance rather than a black box output.

Graded B rather than A because the company does not publish how discordant cases are handled, specifically what a clinician should do when the algorithmic amyloid prediction and the clinical impression disagree, which is the decision point that matters most as this product moves toward treatment eligibility.

The methods are published in peer reviewed venues in genuine detail, including a Frontiers in Digital Health paper describing how the algorithms were developed, the resulting clinical scores and the validation findings, explicitly framed as clinically interpretable automated analysis of drawing behaviour.

Published work names the specific feature classes used by the LinusAD algorithm: age, APOE status, drawing metrics, speech and acoustic features, and temporal-spatial features of stylus manipulation. Research is conducted under named IRB protocols with tracking numbers disclosed. That is a materially higher standard than the marketing-level description most vendors in the index offer.

The sub processor disclosure is the strongest element here and it is what this axis exists to reward. The company publishes the list of sub processors that may access personal data on its behalf, describes the purpose for each rather than merely listing names, states that it reviews their security practices and certifications before engaging them, and binds them through processing agreements.

A privacy office can therefore see the data supply chain without submitting a questionnaire, which is a materially different starting position from the usual one where the chain is assembled through diligence correspondence over weeks. Security measures are described in specific terms and scaled by the sensitivity of the information held, and the terms commit the company to return or delete personal data and to keep complying with the governing clauses until it does.

Three gaps hold it below the top grade. No retention period is published for assessment data. Nothing states whether that data serves any secondary purpose including model development, which is live for a company whose approach is to collect health and lifestyle data and apply algorithms to it. And storage in geographically diverse locations is a description of practice rather than a residency commitment.

The commercial structure sharpens all three: the same platform is sold to health systems, to life sciences sponsors, and to payers with a published use case covering missed diagnoses, and those three buyers want different things from the same underlying data. Ask what flows between the lines of business.

Among the strongest evidence bases in the index, and critically it is largely INDEPENDENT rather than vendor-run. Massachusetts General Hospital and Harvard Aging Brain Study work published in Neurology found DCTclock significantly correlated with amyloid PET in cognitively normal individuals and outperforming the 30 minute Preclinical Alzheimer's Clinical Composite at differentiating amyloid positive from negative.

A longitudinal study of more than 200 cognitively normal adults published in Annals of Clinical and Translational Neurology found higher amyloid and tau burden associated with faster DCTclock decline, particularly on processing speed and executive function. The Bio-Hermes-001 study evaluated 930 participants with 18F-florbetapir PET confirmation. An independent pilot in the population-based CARRS cohort in urban India tested 303 adults with 99.3 percent of tests yielding analyzable data.

Validation therefore spans concurrent detection, longitudinal prediction, biomarker correlation and cross-cultural feasibility. The honest caveat: much of the amyloid prediction work appears as conference abstracts at AAIC and CTAD rather than full peer reviewed papers, and abstracts are not the same evidentiary weight.

The subprocessor disclosure is the strongest element on this record and is genuinely uncommon. Linus Health publishes the list of subprocessors that may access personal data on its behalf, describes the purpose for each, states that it reviews their security practices and certifications before engaging them, and binds them through data processing agreements. A privacy office can see the data supply chain without submitting a questionnaire. Security measures are described in specific terms and scaled by the sensitivity of the information held, and the company states it has adopted an incident response plan and monitors its systems regularly for vulnerabilities. The terms of use commit it to return or delete personal data and to keep complying with the governing clauses until that happens.

Three gaps matter. No retention period is published for assessment data. Nothing published states whether that data is used for any secondary purpose, including the development or improvement of the models the platform runs on, which is a live question for a company whose stated approach is to collect health and lifestyle data and apply algorithms to it. And the terms state only that information will be stored in geographically diverse locations, which is a description of practice rather than a residency commitment.

The commercial structure sharpens all three and a buyer should raise it directly. The same cognitive assessment platform is sold to health systems and provider practices, to life sciences sponsors for trial recruitment and endpoints, and to payers, where the published use case includes capturing missed diagnoses. Those three buyers want different things from the same underlying data. Ask in writing what flows between those lines of business, what is used for model development, and how long assessment records are retained.

Linus Health states that its Healthcare Delivery platform is HIPAA compliant, and the claim sits alongside its enterprise positioning rather than buried in a policy document. The surrounding assurance is real rather than decorative: a SOC 2 Type 2 attestation with the type named, a published subprocessor list, and data processing agreements with those subprocessors that the company says carry contractual safeguards for personal data. The terms of use additionally carry European standard contractual clause language, committing the company to return or delete personal data, to continue complying with those clauses until it does, and to notify the customer if it becomes subject to local laws that conflict with them.

Held at B because the business associate half is never addressed. No business associate agreement, template or summary of terms was located, the company does not identify itself as a business associate in any retrieved document, and no execution detail is published. That is the same gap this index has found across most vendors it has assessed, but it is conspicuous in this particular group because a direct peer publishes its agreement in full.

Buyers should request the business associate agreement before contracting and ask which of the company's products and markets it covers, since the same platform is sold to providers, to life sciences sponsors and to payers.

Linus Health operates a public trust centre at trust.linushealth.com, hosted on Vanta, and states on its own product pages that the Linus Healthcare Delivery platform is SOC 2 Type 2 certified. Naming the type matters and most vendors in this category do not, since a Type 2 report covers the operating effectiveness of controls over a period rather than their design at a single moment.

The strongest element is one almost nobody in this category publishes. Linus Health maintains a public subprocessor list, states that it reviews the security practices and certifications of each subprocessor before engagement, and states that its data processing agreements with them carry contractual safeguards. A buyer can see who else touches the data without asking for it. The privacy policy describes firewalls, data encryption, physical access controls and information access authorisation controls, an adopted incident response plan with a defined protocol in the event of a breach, and regular monitoring of systems for vulnerabilities.

Held below the top band on three counts. The attestation is a single general purpose audit, with no healthcare specific certification such as HITRUST alongside it and no ISO 27001. No penetration testing statement was located. And the trust centre contents were not enumerated on this pass, because the page renders as an application rather than as readable text, so the current certificate scope and audit dates could not be checked. That last point is the first thing to re open on a refresh, since the grade could move if the centre carries more than the one attestation.

DCTclock is a Class II device described variously across sources as FDA cleared, FDA registered and FDA listed for marketing as a computerized cognitive assessment aid. Peer reviewed literature refers to it as FDA-cleared. Graded B rather than A for two reasons. First, the inconsistent terminology across the company's own materials and third party coverage, with no specific 510(k) number located, which is the same issue flagged on BrainCheck.

Second and more important, a scoping gap that will grow: the regulatory status covers cognitive assessment, but the commercially significant claim is now amyloid and p-tau217 status PREDICTION, which is a different and more consequential intended use. Buyers should establish precisely which claims fall inside the cleared indication and which are research findings presented at conferences.

The best governance posture of any vendor added in this sweep, and rare in the index for being addressed rather than merely disclosed. A Linus Health clinical development lead stated publicly and unprompted that limited representativeness in the original training datasets can bias AI models when applied across differing cultural and educational contexts, naming the failure mode directly.

The research programme then tests it: the Bio-Hermes-001 cohort of 930 participants was 56.8 percent female with 23 percent minorities, and reported as such. An independent pilot in the CARRS cohort in urban India examined performance in a South Asian population and published the uncomfortable finding as well as the reassuring one, that scores were significantly lower with older age and lower educational attainment while showing no difference by sex. Education and cultural effects are the central validity threat in cognitive testing, and this is a vendor publishing where its instrument is sensitive to them rather than concealing it.

The methods are published in peer reviewed venues in genuine detail rather than summarised, including a paper describing how the algorithms were developed, the resulting clinical scores, and the validation findings, framed explicitly as clinically interpretable automated analysis of drawing behaviour. Two things lift this above an ordinary publication record.

The feature classes are named individually, covering age, a genetic risk marker, drawing metrics, speech and acoustic features, and temporal and spatial characteristics of stylus manipulation, so a clinician can judge whether the inputs make sense for the construct being measured rather than accepting a score from an unspecified model.

And research is conducted under named ethics protocols with tracking numbers disclosed, which lets an outside reader locate the governance as well as the science, and is something almost nothing else in this index does. Interpretability is the right target for cognitive assessment specifically, because the output influences a diagnosis a patient will carry for the rest of their life and a clinician needs to be able to explain what the score rests on.

Held below the top grade because no warranty, indemnity or remediation commitment attaches, and because per algorithm performance across the product range is not collected in one accessible place. Ask for performance by algorithm and population, and what a clinician is shown about uncertainty on a borderline result.

EHR integration is offered as part of the health system workflow, with results and care coordination flowing into clinical and operational processes rather than living in a standalone portal. Graded B rather than A because no specific EHR vendors are named in located materials, unlike BrainCheck which names Epic and athenahealth explicitly.

iPad-administered with Apple Pencil, requiring a charged device and stable internet for real-time synchronisation and cloud-based analysis, with a remote administration capability marketed as Anywhere for Health Systems. Practical and demonstrably deployable in low-resource settings, evidenced by the India pilot achieving 99.3 percent analyzable tests.

Graded B rather than A because the hardware dependency is real, requiring specific tablet and stylus hardware plus connectivity, which is a higher deployment bar than a browser-based product, and no data residency terms were published.

No pricing published and no pricing basis disclosed, and unlike BrainCheck there is no published reimbursement guidance naming applicable CPT codes. Given the same cognitive assessment billing codes should be available to health system customers, the absence of published guidance is a gap relative to the direct competitor in the same category.

Genuinely broad across settings and buyer types, which is unusual for a single clinical domain. Health systems with EHR-integrated workflows, primary care and specialist triage, remote and in-clinic administration, population and community brain health screening, and clinical trial recruitment where the value proposition is reducing screening failure rates and prescreening cost for disease modifying therapy trials.

The suite of over a dozen assessments spans cognition, gait, speech and person-specific outcome measures, and the ePSOM work extends into trial endpoint design. Serving both clinical care and trial operations from the same instrument set is a materially wider footprint than any competitor located in this category.