Oxipit

The models are the product. ChestLink classifies chest X-rays as normal and issues the final report on those studies with no radiologist involved. ChestEye, in the same CXR Suite, sends real time notifications on 75 chest X-ray findings for a radiologist to review, and a quality review module is described by the company as an automated safety net. CT Eye (chest CT) and MSK Eye (musculoskeletal X-ray) extend the same detection approach to other study types.

Remove the models and nothing is left to sell: there is no reading platform, archive or workflow product underneath them. Oxipit has been part of Sectra, an enterprise imaging company, since 2026, and its products are still sold under the Oxipit, ChestLink and ChestEye names, so the change of ownership does not change what the product is.

ChestLink is sold to act alone on one class of study. Its user manual (software version 1.0, 9 March 2023) states the intended use: it evaluates a chest X-ray study automatically and autonomously, without a radiologist; when it is confident a study has no actionable radiological findings it generates the report, and when it cannot confidently rule them out the study goes to a radiologist. The manual sets the limits: adults aged 18 and over who can stand for an erect posteroanterior radiograph; AP images and children's images are not analyzed, and patients unable to stand are contraindicated. It also describes a check afterward: a sample of the studies ChestLink reported is given to radiologists, periodically, to confirm there are no false negatives. Studies it does not report go to radiologists, who review ChestEye's notifications on 75 findings, and a quality review module is described as an automated safety net. Autonomous operation is CE marked for Europe and, the company states, not available in the United States. That is an oversight structure with the autonomous channel named, its exclusions published and an audit described.

The missing part is the rule itself and the size of the check. Neither the manual nor the product pages publish the confidence threshold or operating point that decides a study is normal, and the manual says the sampling may be done periodically without a rate or frequency. The manual warns that the software may report a study as normal when actionable findings are present, and says such errors occur at a much lower rate than radiologist interpretations, with no figure beside the comparison. The Radiology study the company cites (Plesner and colleagues, 2023) found the tool identified abnormal radiographs with 99.1 percent sensitivity on a retrospective set; that is a test set result, not a rate from live autonomous use.

The product page quotes the head of the imaging services group at Leiden University Medical Centre saying the hospital implemented autonomous normal case detection "while maintaining complete control over quality and safety". That describes the customer's own process, not a promise about the product's output.

The products are described by what they do, not by what produces the output. The ChestLink user manual (software version 1.0, dated 9 March 2023), the product pages and the regulatory page describe ChestLink's task (evaluating an adult chest X-ray and issuing the report when it is confident there is no actionable finding), ChestEye's 75 findings, the quality review module and the CT and MSK suites, and the products are Oxipit's own devices certified under the EU Medical Device Regulation.

None of them names a model architecture, characterizes the training data (size, sources, sites, equipment makers or time period), or publishes versioning and update practice. The manual carries a software version and date, and the DICOM conformance statement (6 November 2024) names ChestLink 1.0 and ChestEye 2.6, so each document can be tied to a release; neither says how a new release is validated or announced.

That matters most for an autonomous product, where a new release changes the system that reports normal studies with no radiologist reading them. Figures on supervised operation before certification describe validation, not the model.

The model layer is short and fixed. ChestLink, ChestEye, CT Eye and MSK Eye are Oxipit's own models, certified as medical devices under the EU Medical Device Regulation: the CE certificate posted on the company's regulatory page is dated 4 February 2026, and ChestLink is Class IIb. The manufacturer's own certified model cannot be swapped for another supplier's without a regulatory change, which keeps the chain structurally short. What is not published is the rest of the chain.

No hosting provider, cloud region or on premises option is named for the products, and no subprocessor list is published for the service. The website privacy notice names Formspree and Google, but only for the website's contact forms and analytics, not for studies. Since 2026 Oxipit has been part of Sectra, and the company does not state whether Sectra's infrastructure or marketplace now sits in the processing path.

The company's research page summarizes the one study of ChestLink with a design and population a buyer can read: Plesner and colleagues, "Autonomous Chest Radiograph Reporting Using AI: Estimation of Clinical Impact" (Radiology, 2023), led by the Department of Radiology at Herlev and Gentofte Hospital in Copenhagen.

It was retrospective and multicenter: chest X-rays of 1,529 patients from four hospitals in Denmark's capital region, emergency, inpatient and outpatient, read against two board certified thoracic radiologists with a third on disagreement, all blinded to the AI. The tool identified abnormal radiographs with 99.1 percent sensitivity and classified 120 of the 429 normal radiographs (28 percent) as normal, so 7.8 percent of all studies could have been reported autonomously.

That estimates what autonomy would have done on past studies; it does not measure the product in live use. The product pages give figures without method: 99.9 percent sensitivity for identifying normal chest X-rays and automation of up to 40 percent of chest X-ray cases, with no population, denominator or design stated beside them, and the study's 7.8 percent sits well below the 40 percent headline.

A separate clinical performance paper on the autonomous application and a case study of Leiden University Medical Centre's implementation are also listed on the company's pages. The research is independent, peer reviewed and multicenter, and no prospective evaluation of autonomous reporting in live use stands behind the headline claim.

One categorical control on patient data is stated for ChestLink, and nothing on retention or training. The ChestLink user manual (software version 1.0, 9 March 2023) says anonymization is set up by enabling the anonymization options in the customer's archive, which "ensures that no sensitive personal data is processed by ChestLink".

That is a deidentification statement specific enough to be contradicted, though it rests on a setting the customer enables, and the product also takes in the clinical inquiry and ordering information. No retention period for studies or reports is published, and nothing says whether customer studies are used to train or improve the models.

The regulatory page posts an ISO 27001 information security certificate (9 July 2026) and a Cyber Essentials certificate (16 June 2026), and the DICOM conformance statement states TLS 1.3 in transit. The privacy notice on the site covers only the website.

Safety engineering, meaning guardrails and how a safety event is handled, is not published; the manual's warning that the software may report a study with actionable findings as normal, and its periodic radiologist sampling, are oversight controls and are described under autonomy. The question carries extra weight because ChestLink issues final reports on studies no radiologist reads.

Oxipit states no business associate status, and no data processing agreement or service privacy document is published. The one statement touching HIPAA sits in the company's DICOM conformance statement for ChestLink 1.0 and ChestEye 2.6 (6 November 2024), which lists "HIPAA and GDPR compliance" beside TLS 1.3 encryption, with no document behind the claim.

The only privacy document on the site is a website privacy notice from Oxipit, UAB, last updated 4 November 2019, which covers visits to oxipit.ai and contact form submissions, does not mention medical images, patient data or the products, and still names the EU-US Privacy Shield, invalidated in 2020, as the transfer basis for its website processors.

The ChestLink user manual says that when the customer enables the archive's anonymization options no sensitive personal data is processed by ChestLink; that is a setting the customer controls rather than a stated scope position, and the product also takes in the clinical inquiry and ordering information. The company states that its autonomous product is not available in the United States.

A data processing agreement or a published processor role statement for the service would carry this to B; so would a plain statement that the products do not process protected health information, with a service privacy document behind it.

Certificates are posted as downloadable files on the company's regulatory compliance page, which is linked from the site footer: an ISO 27001 information security management certificate dated 9 July 2026 and a Cyber Essentials certificate dated 16 June 2026, alongside its ISO 13485 quality management certificate. These are Oxipit's own certificates, issued after the Sectra acquisition, not the parent's.

The page names the standard without its revision year or the certified scope; both are stated on the certificate itself, and the page does not say whether that scope covers the systems that process customer studies. An ISO 27001 certificate runs three years with annual surveillance audits, so a certificate dated July 2026 is current as of September 2026.

Oxipit's regulatory position is stated plainly and is European. ChestLink holds CE Class IIb certification as an autonomous AI application for reporting normal chest X-rays, which the company describes as the world's first autonomous AI medical device.

The ChestLink user manual (software version 1.0, 9 March 2023) states the classification, Class IIb under Rule 11 of the Medical Device Regulation (EU) 2017/745, and the intended use: autonomous evaluation of erect posteroanterior chest X-rays in adults, with children, AP images and patients unable to stand excluded, in listed EU member states. ChestEye has been CE certified since 2019, and CT Eye and MSK Eye are CE certified.

The company's regulatory page posts its EU Medical Device Regulation certificate (dated 4 February 2026), its ISO 13485 quality system certificate, an Australian TGA ARTG certificate (January 2020) and a Brazilian Anvisa certificate (November 2022). No FDA clearance is listed for any product. The company states that autonomous operation is not available in the United States and says nothing about its assistive products there, which leaves them without a stated US clearance.

Neither the page nor the manual states the notified body or the certificate numbers; those sit in the certificate files, and matching them to the version on offer is what separates this from a fully verifiable position.

No evaluation of how the models perform across patient groups is published. The product and regulatory pages give no results by sex, age, body habitus, projection, equipment maker or disease prevalence, and no fairness or bias assessment. Two documented mechanisms make this matter for chest X-ray models.

Classifiers trained on public chest X-ray datasets have underdiagnosed female, Black, Hispanic, younger and Medicaid insured patients (Seyyed-Kalantari and colleagues, Nature Medicine, 2021). And for an autonomous product, any group in which abnormal studies are judged normal goes unseen, because no radiologist reads those studies.

The quality review module is a standing control in operation, and certification under the EU device regulation is a regulatory finding; neither is an evaluation by group. The Radiology study and the clinical performance paper listed on the company's research pages may report results by group.

A peer reviewed study cited by the company puts a measured error rate on ChestLink's autonomous task. The company's research page summarizes Plesner and colleagues, "Autonomous Chest Radiograph Reporting Using AI: Estimation of Clinical Impact" (Radiology, 2023), a retrospective study led by the Department of Radiology at Herlev and Gentofte Hospital in Copenhagen: chest X-rays of 1,529 patients from four hospitals in Denmark's capital region (emergency, inpatient and outpatient), with two board certified thoracic radiologists as the reference standard, a third on disagreement, all blinded to the AI.

The tool identified abnormal radiographs with 99.1 percent sensitivity. The page gives the percentage, not the count; 1,529 less the 429 normal radiographs leaves 1,100 abnormal, so the figure is about 1,090 identified and about 10 classed as normal, which is the error that matters for autonomous reporting. It classified 120 of the 429 normal radiographs as normal (28 percent), 7.8 percent of all studies. The version tested is not stated on the page.

This is a result on a retrospective test set, not a rate in live autonomous use. Nothing stands behind the output beyond it: no warranty, indemnity or remediation commitment is published, and the user manual's route for questions is the sales representative or a general mailbox. The manual describes periodic radiologist review of a sample of autonomously reported studies, without a rate.

Oxipit's ChestLink user manual (software version 1.0, 9 March 2023) describes the integration: the archive forwards chest X-rays by DICOM or DICOMweb, ChestLink sends its results to PACS, RIS or HIS by DICOM, DICOMweb or HL7, and its output appears in the archive as a standalone DICOM Structured Report; the connection is configured by IP address, port and application entity title.

The DICOM conformance statement (6 November 2024) covers ChestLink 1.0 and ChestEye 2.6 as a storage provider and user, including Basic Text SR, secondary capture, presentation state and encapsulated PDF objects. The products run in named clinical service: the head of the imaging services group at Leiden University Medical Centre describes the hospital's implementation of autonomous normal case detection, and the company publishes a case study of that deployment.

That is standards support with a named deployment behind it. No integration with a named record system, RIS or PACS vendor is published. Oxipit has been part of Sectra, an enterprise imaging and archive vendor, since 2026. The company does not say whether integration is now native on a Sectra archive, or whether the products stay available to sites on other archives.

The ChestLink user manual (software version 1.0, 9 March 2023) states two deployment options: in a cloud environment outside the institution's network, or locally in the institution's network on a virtual machine the institution provides. Studies arrive from the archive by DICOM or DICOMweb and results return to PACS, RIS or HIS by DICOM, DICOMweb or HL7, and the manual says that enabling the archive's anonymization options means no sensitive personal data is processed by ChestLink.

Neither the manual nor the DICOM conformance statement (6 November 2024, which states TLS 1.3 encryption in transit) names the cloud operator, the region where studies are processed or stored, or how customers are isolated, and the privacy notice on the site covers only the website. Options are stated and the location is not. Two facts make the answer matter.

Oxipit is a Lithuanian company selling into Europe, so where a study is processed decides which transfer rules apply; and since 2026 it has been part of Sectra, whose infrastructure may change the answer over time.

No price, unit of charge or tier is published. The packaging and the seller are public: Oxipit sells three suites (the CXR Suite with ChestLink and ChestEye, the CT Suite and the MSK Suite) through a contact route on its site, and since 2026 it has been part of Sectra, so contracting and support may run through the parent. Neither fact lets a buyer size the cost. The company's figure of automating up to 40 percent of chest X-ray cases is a workload claim, not a price. Whether the products remain available outside the Sectra platform is not stated.

Coverage is named, and part of it has a published evaluation behind it. The ChestLink user manual states the indication: adults aged 18 and over who can stand for an erect posteroanterior chest radiograph, with AP images and children excluded; autonomous reporting covers the studies ChestLink is confident have no actionable finding, in Europe.

The Radiology study the company cites (Plesner and colleagues, 2023) tested the tool retrospectively on 1,529 patients from four Danish hospitals across emergency, inpatient and outpatient care, and reported 7.8 percent of all studies as potentially reportable autonomously, with a higher share among outpatients (11.6 percent).

ChestEye covers 75 chest X-ray findings, and CT Eye and MSK Eye extend detection to chest CT and musculoskeletal X-ray; the ChestEye validation study listed on the company's research pages may describe the populations behind them. Leiden University Medical Centre uses the autonomous product. Autonomous use is stated as not available in the United States, and no FDA clearance is listed for any product, so none is offered to US buyers as a cleared device.