Nanox.AI

The models are the product. Nanox.AI, the imaging AI business of Nano-X Imaging (formerly Zebra Medical Vision, acquired in 2021), sells three solutions that each read CT scans already taken for other reasons: HealthCCSng detects coronary artery calcification on non gated chest CT, HealthOST detects vertebral height loss and measures bone mineral density on chest and abdominal CT, and HealthFLD measures liver density for fatty liver disease.

Each output is produced by the company's AI; its first bone clearance (HealthVCF, K192901, 2020) describes an artificial intelligence algorithm that identifies suspected vertebral compression fractures. Nano-X's scanner, teleradiology and health IT businesses sit in the parent, not in this product line, and do not change what the AI solutions are. Remove the models and the solutions have nothing left to sell.

The AI solutions flag and measure; clinicians decide. The first bone clearance (HealthVCF, K192901, May 2020) describes a passive notification, prioritization only, parallel workflow tool for bone health clinicians: it flags suspected vertebral compression fractures on chest and abdominal CT in a standalone worklist application, does not alter the original images, does not remove cases from the radiology worklist and sends no proactive alerts.

The AI page describes the three current solutions as surfacing findings for follow up through PACS, record and reporting integrations. That is an oversight structure described with one part missing. What the products do not settle is who owns an incidental finding: the scans were ordered for other reasons, so the software generates work nobody requested, and neither the summary nor the AI page says who acts on a flag, how quickly, or what happens when one is wrong.

Nanox.AI describes what its products detect and measure, not what produces the output. The AI page names the three solutions and their tasks, and the HealthVCF 510(k) summary (K192901, 2020) says only that an artificial intelligence algorithm analyzes chest and abdominal CT images.

No model architecture, training data (size, sources, sites, scanners or period), versioning or update practice is published, beyond the company's announcement that a version 2.0 of HealthCCSng was cleared in 2024. The parent's securities filings describe the business, not the models.

The model layer is short. The solutions run on Nanox.AI's own models, first cleared under the company's former name, Zebra Medical Vision (HealthVCF, K192901, 2020), with further clearances since, so a change to a model goes back through the company's own regulatory process rather than to an outside supplier.

Who else handles studies is not published: no cloud provider, hosting region or subprocessor is named for the AI solutions, and the parent describes cloud infrastructure for its imaging business. The customer base reported for the solutions (hospitals, integrated delivery networks, health plans and pharmaceutical companies) makes the recipient of a finding part of the chain too.

Named deployments publish dated yield figures, and the regulatory evidence is retrospective. The AI page reports that Corewell Health identified nearly 4,000 new patients with coronary artery calcium in 2023, against 268 with calcium reported in the previous two years; that 31.0 percent of patients in Atlantic Health's lung cancer screening program had moderate to severe calcium; that Rabin Medical Center identified 694 patients unknown to it as having cardiovascular disease; and that in the ADOPT study in UK National Health Service hospitals spine fracture detection outperformed the national average.

The HealthVCF 510(k) summary (K192901, 2020) reports a standalone test on 611 cases against three US board certified radiologists. These figures show how many patients the products surface, which is the company's headline; they do not show that surfacing them changes management or outcomes, and none states how many flagged findings were confirmed. A prospective study of whether opportunistic detection changes care is the evidence the population health claim calls for.

Secondary use is the business model here, and little is published on what happens to the studies the products analyze. The solutions read CT studies acquired for unrelated reasons, at archive scale, so most patients whose scans are analyzed will not know a second analysis occurred. There is no published retention period, de identification standard or statement on whether analyzed imaging trains the models.

The parent's Notice of Privacy Practices under HIPAA (last updated 20 June 2024) sets out uses and disclosures of health information in general terms and does not mention the AI solutions, de identification, research or model development. It is a general assurance that leaves those questions open. The recipient matters too: the reported customers include health plans and pharmaceutical companies alongside providers. Safety engineering, meaning guardrails and how a safety event is handled, is not published.

Nano-X Imaging Ltd. publishes a Notice of Privacy Practices under HIPAA (last updated 20 June 2024) which says that the company "operates as a service provider and not as a covered entity under HIPAA". The notice does not name Nanox.AI or the AI solutions, and it does not mention business associate agreements. The status is stated in general terms, with no scope position for the AI solutions and no agreement terms behind it.

The page at the site's privacy policy address is a notice for job applicants, which does not reach the product. The customer mix means one agreement will not cover the business: hospitals, delivery networks and health plans are covered entities and need business associate terms, while pharmaceutical companies generally are not covered entities, which makes the patient's own authorization the operative instrument there.

The operating company is in Israel under an Israeli parent selling into US health systems, so Israeli privacy law, strengthened in 2025, governs the corporate entity while the US framework attaches to the deployments.

No security attestation or trust center appears on the AI page or in the HealthVCF summary. The parent, a Nasdaq listed foreign private issuer, filed its annual report on Form 20-F on 30 April 2026. Item 16K of that filing (page 160) is the cybersecurity disclosure foreign issuers make, and is where any outside assessment of the group's security would be described. The filing's risk factors name no certification, framework or outside assessment.

They say that the Nanox.CLOUD may be subject to cyber attacks or other security breaches, and that integration with third party systems and legacy infrastructure brings cybersecurity risks the company does not fully control. A risk factor is a warning to investors, not evidence that controls exist or have been examined.

Nanox.AI's solutions carry US clearances a buyer can look up. The AI page lists HealthCCSng (coronary artery calcium on non gated chest CT) as 510(k) cleared and CE marked, HealthOST (vertebral height loss and bone mineral density on chest and abdominal CT) as FDA cleared and CE marked, and HealthFLD (liver density) as 510(k) cleared, and states seven FDA clearances and two CE marks.

The first bone clearance, under the company's former name, is HealthVCF (K192901, 12 May 2020, 21 CFR 892.2080, product code QFM): passive notification, for prioritization only, of suspected vertebral compression fractures on chest and abdominal CT, not diagnostic and not removing cases from the worklist. The company announced HealthOST's clearance in April 2022, HealthCCSng's in September 2021 and a version 2.0 of HealthCCSng in August 2024. The clearance numbers for HealthOST, HealthCCSng and HealthFLD are not given on the AI page; the FDA database lists the company's earlier filings under Zebra Medical Vision.

No results by patient group are published for any solution. The HealthVCF summary (K192901) reports its 611 case test with no subgroup analysis, and the AI page gives none. The gap matters most for the measurements: bone density reference ranges differ by sex and ancestry, and the reference population chosen decides who crosses a diagnostic threshold, while coronary calcium distributions differ by sex and ethnic group at the same underlying risk.

A solution applying those thresholds across a whole archive decides who is flagged for follow up, and nothing published says which reference standards it applies or how it performs across groups. No governance framework or monitoring commitment is published.

An error rate with its denominator is on the record in the company's own filing. The HealthVCF 510(k) summary (K192901, 12 May 2020), filed by Zebra Medical Vision, the company's former name, reports a standalone test of its artificial intelligence algorithm on 611 anonymized chest and abdominal CT cases from the US and Israel (306 with vertebral compression fractures, 305 without), against three US board certified radiologists: sensitivity 90.20 percent (86.35 to 93.05), specificity 86.89 percent (82.63 to 90.22), AUC 0.950.

It covers the 2020 fracture notification tool, the first version of the bone solution now sold as HealthOST; it is a result on a test set, not performance in use, and it says nothing about the calcium or liver measurements. No warranty, indemnity or remediation commitment is published.

For an opportunistic screening tool both errors land unusually: a false positive starts a workup in a person with no symptoms, and a false negative is invisible because the scan was never read for that purpose.

Nanox.AI claims integration and names deployments without naming a system. The AI page describes integration with PACS, record and reporting systems, and record integration to streamline patient care, and names Corewell Health, Atlantic Health System, Jefferson Einstein Hospital, Rabin Medical Center and NHS hospitals as users. The HealthVCF summary describes findings shown in a standalone worklist application. No PACS, record system, interface standard or marketplace listing is named.

The AI solutions run on scans pulled from a customer's archive, and where they run is implied rather than committed. The AI page describes integration with PACS, record and reporting systems and names no deployment option; the HealthVCF summary describes a standalone worklist application; the parent describes a cloud software platform for its imaging business.

No hosting provider, region, tenancy arrangement or residency commitment is published for the AI solutions, which matters for an archive scale product whose reported customers include health plans and pharmaceutical companies.

No price, tier or unit of charge is published for the AI solutions. The reported buyers are health systems, delivery networks, health plans and pharmaceutical companies. The parent, a Nasdaq listed company, describes its business model in securities filings, including software as a service billing and a pay per scan model for its imaging hardware.

Whether the AI solutions are licensed per scan, per site or per population is not stated, and the answer changes the cost of running a screening program across a whole archive. The follow up workload that incidental findings create is a cost on top of the software.

Coverage is named, CT centered and focused on chronic disease found in scans already taken: bone (vertebral height loss and bone density), cardiac (coronary calcium on non gated chest CT) and liver (fatty liver density), with earlier acute products for pneumothorax and brain hemorrhage cleared under the company's former name.

Validation stands behind part of it: the HealthVCF summary tests fracture notification on 611 cases from the US and Israel, and named deployments report calcium yield in lung cancer screening and routine chest CT (Atlantic Health, Corewell Health) and spine fracture detection in UK National Health Service hospitals (the ADOPT study). The liver solution's validation is not described on the AI page.