Massive Bio

The product is the matching engine: natural language understanding extracts structured data from medical records and a neuro symbolic, multi agent architecture over an oncology specific knowledge graph performs the trial matching. AI is the deliverable.

Human oversight is explicit and structural rather than implied: AI generated matches are audited and managed by certified oncology case managers before reaching the patient or physician, and a virtual tumor board program sits over the process. One of the clearest oversight disclosures in the index.

Better described than most matching products, and described in a place that carries weight.

The architecture is named rather than gestured at: a neuro symbolic, multi agent design operating over an oncology specific knowledge graph, with natural language understanding extracting structured elements including biomarker results from unstructured records. Naming a hybrid symbolic and neural approach is a real technical claim, and it is a defensible one for this problem, because eligibility criteria are logical statements that a purely generative approach handles poorly. The description appears in a peer reviewed prospective evaluation rather than only in marketing, which is what lifts this above the category norm.

Held at B rather than A because several things a buyer would need are absent. No model documentation or card exists for any component. The knowledge graph's provenance, maintenance cadence and coverage are not described, which matters because a matching engine is only as current as its trial and criteria data, and the company reports matching against more than nineteen thousand active studies. No versioning or update practice is documented. And no comparison against an alternative approach is published, so the architectural claim is asserted as a design rationale rather than demonstrated as an advantage.

Ask how often the trial and criteria corpus is refreshed, how a criterion that is ambiguous in the protocol is represented in the graph, and what happens when a trial's criteria change mid study.

The secondary use is disclosed in the document the patient signs, which is the right place for it and rarer than any policy page. The published authorisation states the scope plainly, and the scope is wide: complete medical records, discharge summaries, diagnostic tests, genetic and genomic testing results, and mental health records.

It then states explicitly that anonymised and aggregated information created by the company is no longer subject to the health privacy rule and may be used for analytics, model training and real world evidence research. Many vendors in this index leave that to inference or bury it elsewhere; putting it in front of the person granting the permission is the correct practice and deserves the credit. Three things hold it below the top grade.

No de identification method is named, and the rule offers two routes whose protection differs materially, which matters more here than usual because the dataset expressly includes genomic results that are durably re identifiable and that the identifier removal route was not designed for.

Revocation is available and does not reach disclosures already made, with nothing stating what happens to records already held or to anonymised derivatives already incorporated into training data, which by construction cannot be withdrawn. And mental health records carry heightened state protection while substance use records fall under a separate federal regime, with no segmentation described. Ask for the de identification method, retention, and how sensitive categories are handled distinctly.

Rare peer reviewed prospective evidence for a matching product: a study in ESMO Real World Data and Digital Oncology prospectively evaluated the platform in 3,804 metastatic cancer patients in routine practice during 2024, reporting matching four times faster than conventional methods. Graded on the existence and design of the evidence; this index does not re verify the underlying results.

Disclosed in unusual detail, with three questions the disclosure raises rather than settles.

The published authorization states the scope plainly, and the scope is wide: complete medical records, discharge summaries, diagnostic tests, genetic and genomic testing results, and mental health records. It also states, explicitly, that anonymised and aggregated information created by the company is no longer subject to the health privacy rule and may be used for analytics, AI training and real world evidence research. That is a candid statement of a secondary use that many vendors leave to inference, and it is set out in the document the patient signs rather than buried in terms elsewhere. Credit is due for the candour.

The first question follows directly from it. No de identification method is named. The rule offers two routes, a documented expert determination or removal of the enumerated identifiers, and which one applies determines how much protection the word anonymised is carrying. That matters more here than usual because the dataset expressly includes genomic results, which are durably re identifiable and which the identifier removal route was not designed for.

The second is retention and revocation. A patient may revoke, and revocation does not reach disclosures already made. Nothing states what happens to records already held, or to anonymised derivatives already incorporated into training data, which by construction cannot be withdrawn.

The third is the sensitive categories. Mental health records carry heightened protection in many states, and substance use records carry a separate federal regime. Nothing describes segmentation.

Ask for the de identification method, the retention schedule, and how sensitive record categories are handled distinctly.

One of the better disclosed records on this axis, and the structure it discloses is the thing a reader most needs to understand.

The company publishes a patient facing authorization rather than describing a business associate posture, and that is not an omission. It is the correct instrument for how this business works. Patients sign an authorization permitting the company and its subcontractors to obtain and use their protected health information to assess trial eligibility and support enrolment. The document names the categories of record covered, states the purposes, extends to subcontractors, provides a right to refuse and a right to revoke in writing, and applies the standard rule that revocation does not undo disclosures already made. Publishing that document openly, in patient facing language, puts this ahead of most of the category.

The structural consequence should be understood rather than assumed. Where a provider releases records to a non covered entity under a valid patient authorization, the recipient does not thereby become a business associate, and the health privacy rule does not follow the data into their hands. The rule attaches to covered entities and their business associates, not to the information itself. So a patient signing this authorization is moving their complete record from a regime with federal privacy and security requirements into one governed by the authorization's own terms, general consumer protection law, and the health breach notification rule.

That is lawful, it is disclosed, and it is the same shape this index has recorded elsewhere where a company acts on an individual's behalf rather than a provider's. At a reported two hundred thousand onboarded patients it operates at meaningful scale.

A provider or sponsor working with this company should establish which instrument governs their own relationship, since the patient authorization governs the patient's data and not the institution's arrangements.

No SOC 2, HITRUST, ISO 27001 or equivalent attestation was located and there is no trust centre.

The reason this matters more here than the grade alone conveys is a consequence of how the business is structured, and it is worth stating precisely because it is easy to miss. The privacy rule and the security rule travel together. Where records reach a non covered entity through a patient authorization rather than through a business associate relationship, the security rule does not follow them any more than the privacy rule does. There is therefore no federal security floor applying to this data in this company's hands. What governs is the authorization's own terms, general prohibitions on unfair or deceptive practices, applicable state law, and the health breach notification rule.

That is a lawful position and a common one. It does mean the usual reasoning a buyer applies, that a vendor handling protected health information is subject to defined administrative, physical and technical safeguards, does not hold here, and an attestation would be doing more work than usual as a substitute.

The holdings are substantial. Complete medical records, including genomic and mental health information, for a reported two hundred thousand onboarded patients, assembled deliberately into one place because assembling them is the product.

Ask what security programme exists, whether it has been examined by anyone external and against what, what encryption and access controls apply, who inside the company and among its subcontractors can read a patient record, and what the breach notification commitment is in practice.

A scoping determination and it closes cleanly.

The product identifies trials a patient may be eligible for. It does not diagnose, does not recommend a treatment, and does not direct care. Matches are reviewed by certified oncology case managers before they reach a patient or physician, and the decision to pursue a trial rests with the patient and their treating clinician, with formal eligibility determined by the investigator at the site. No device pathway attaches and none is claimed.

The electronic records and data integrity framework that governs several other vendors in this category does not reach this one either, because the platform does not generate or transform data that enters a regulatory submission. Its output is a candidate list, and the trial's own systems handle everything downstream.

What does govern is worth naming so the grade is not misread as an absence of oversight. Record acquisition runs on the patient's authorization and the access rights that support it. Referral to an investigator is a research recruitment activity, so the site's institutional review board approval and the study protocol govern what happens once a patient is referred, including how the patient is approached and consented. And the promotional dimension of a patient facing service that presents specific trials is subject to general prohibitions on misleading claims.

Establish who is responsible for the accuracy of eligibility information presented to a patient, and what happens when a patient is told they may qualify and the site determines otherwise.

No governance framework, model documentation or bias evaluation was located, and two domain questions apply here with particular force.

The first is the one this index puts to every trial matching product. The system surfaces candidates from records, so it inherits what those records contain. Patients whose documentation is thin, whose biomarker testing was never done, or whose care has been fragmented are less matchable regardless of actual eligibility, and those characteristics track the populations trials already under enrol. The published prospective evaluation is a real and rare piece of evidence, and what it measured was speed: matching four times faster than conventional methods across 3,804 patients. Nothing published compares the demographic or socioeconomic profile of matched patients against the underlying population, or against patients the system did not match. Without that, faster matching is consistent with either widening access or concentrating it.

The second is structural and follows from the commercial model. The patient facing service is free to patients, and revenue comes from pharmaceutical, contract research and provider contracts. Sponsors pay because they need trials filled. Nothing published states how the matching engine handles the resulting tension: whether trials are ranked by clinical fit alone, whether sponsor relationships influence ordering or presentation, or whether a patient is shown options from sponsors with no commercial relationship on the same footing.

Neither point is an allegation, and the case manager review layer is a real mitigation. Both are questions a buyer and a patient advocate should ask, and both are answerable in a sentence each.

The architecture is named with a defensible rationale and described in a venue that carries weight, which is what puts this above the category norm. The design is stated as neuro symbolic and multi agent, operating over an oncology specific knowledge graph, with language understanding extracting structured elements including biomarker results from unstructured records.

Naming a hybrid symbolic and neural approach is a real technical claim rather than an atmospheric one, and it is defensible for this problem specifically: eligibility criteria are logical statements with hard boundaries, and a purely generative approach handles them poorly because it will produce a plausible reading of a threshold rather than applying it. That the description appears in a peer reviewed prospective evaluation rather than only in marketing is what lifts it further.

Held at C because the component that decides whether a match is real is undescribed. The knowledge graph's provenance, maintenance cadence and coverage are not stated, and the company reports matching against more than nineteen thousand active studies, so a matching engine is only as current as its trial and criteria data and nothing establishes how current that is.

No model card, versioning practice or comparison against an alternative approach exists, so the architectural claim is a design rationale rather than a demonstrated advantage. Ask how often the criteria corpus is refreshed, how an ambiguous protocol criterion is represented, and what happens when criteria change mid study.

An unusual and rather elegant answer to this axis, achieved without building an integration at all.

Rather than connecting to record systems, the company obtains records by acting as the patient's authorised agent and invoking the patient's own right of access. Its published authorization notes the obligation on providers, pharmacies and health plans to release records within thirty days of a request from the patient or their authorised agent, and frames the request in those terms. The patient's legal right becomes the integration layer, which means the mechanism works against any holder of records regardless of what system they run, including small community practices and laboratories that no integration project would ever reach.

That is a genuine capability and it is the right design for a patient facing product whose users are scattered across every kind of provider. It also explains how the platform can serve community oncology without an integration programme.

Two limits keep this at B. No technical integration, interoperability standard or named record system connection was evidenced, so acquisition depends on each holder responding rather than on a data connection. And the mechanism's own timeline is the constraint: thirty days is the outer bound of the release obligation, and for a patient with metastatic disease looking for a trial, thirty days is a long time. Ask what the median time to assembled record actually is, how often requests are refused or ignored, and what happens when a record holder does not comply.

Nothing was located on hosting location, region, tenancy, retention or subprocessors.

One element is disclosed and it is the one that most needs following up. The published authorization extends expressly to the company's subcontractors, permitting them to access and use protected health information for the stated purposes. That is honest drafting and it confirms that third parties are in the data path. It does not say who they are, what each does, where they operate, or what governs their handling. For a company assembling complete medical records including genomic and mental health information, the subprocessor question is not administrative detail.

The patient facing architecture adds a second question. Patients interact through physician and patient facing assistants, so participant identifiable material is moving through consumer facing interfaces as well as through whatever back end assembles and analyses records. Nothing describes where that sits or how the two are separated.

And because records are gathered from many holders rather than received from one institution, the assembled corpus is a new artefact that exists only in this company's environment. Where that environment is, and who else can reach it, is the whole of this axis.

Ask for the subprocessor list with the role of each, the hosting region, the retention schedule for assembled records, and whether a patient can obtain deletion rather than only revoke future disclosures.

No public pricing. Contact the vendor. Revenue comes from pharma, CRO, and provider contracts; the patient facing matching application is free to patients.

Precisely bounded: oncology and hematology trial matching, spanning solid and hematological malignancies, adult and pediatric, delivered through community oncology practices and pharma and CRO partners. Explicit scope.