Primaa

Deep learning image analysis is the entire offering. Cleo Breast and Cleo Skin are algorithms that detect and quantify biomarkers in whole slide images, with no viewer, scanner, or laboratory of the company's own. The deliberate choice to integrate into other vendors' platforms rather than build a workspace confirms the model: the company sells algorithms, not infrastructure.

Assistive by design and, unusually, measured as such. Cleo Breast is described as automated diagnostic support complementing pathologist expertise, and the dermatopathology validation study was structured specifically to compare pathologist performance with and without access to the AI, which treats the human plus machine pairing as the unit of evaluation rather than testing the algorithm alone. That study design is itself the strongest evidence of a genuine assistive posture, since it presumes the pathologist remains the decision maker.

Product function is described concretely, including which biomarkers Cleo Breast addresses and named capabilities such as mitosis and lymph node metastasis detection, and the company states clinical development was conducted with European reference laboratories. What is not published is training data scale or composition, model architecture, or performance figures, and the completed results of the dermatopathology validation study were still pending at the time of review. Clear about what the products do, quiet about how well and on what basis.

This vendor makes the strongest architectural claim in the lane and undermines it slightly by where it puts it. The product page states that the software does not collect any personal data and that all data stay within the customer's own network, and if that holds the vendor never receives patient material at all, which is a stronger position than any retention or deletion policy could be.

A data protection officer is appointed and named publicly, which is an accountability role many vendors fill without ever identifying the person. Held below the top grade for three reasons. The claim appears as an asterisked footnote on a product page rather than in a formal instrument, and no technical description explains how the boundary is enforced or whether it covers support access, which is the usual exception.

Nothing addresses the patient material used in the company's own clinical performance studies, which were run with named cancer institutes and plainly did involve patient slides, so material has demonstrably reached the company by some route.

And there is an unreconciled tension a buyer should raise directly: trade coverage of the launch described a solution that refines its sensitivity over time as new data arrives, which is recorded here as reported rather than established, and a model that improves from new data and a claim that no data leaves the customer network need to be squared with each other. Ask for the architecture in writing, the position on support access, and a plain statement on whether customer material is ever used in model development.

There is a published peer reviewed record, which lifts this off the floor, though it remains thinner than the established competitors in this lane. Primaa published a multi centre study in PLOS Digital Health in 2023 on automatic detection of invasive carcinoma in breast whole slide images, and multi centre design is the property that matters most for a pathology algorithm, because staining protocol, scanner and preparation differences between laboratories are the failure mode most likely to bite in routine use.

Alongside it, CE-IVDR certification implies a clinical evidence dossier reviewed by a notified body, so further evidence exists in the regulatory file even where it is not public. Evidence generation is also visibly continuing rather than stalled: a clinical performance study for Cleo Breast is running with several named French cancer institutes, and a dermatopathology validation study for Cleo Skin began in late 2025 on a third party platform, comparing diagnostic efficiency and agreement with and without AI assistance.

Neither had reported in full at the time of review. Held at B rather than A on three counts. The published record is a single detection performance study rather than a body of work. It measures whether the algorithm finds what a pathologist finds, not whether using it changes what happens to the patient. And no independent validation by a group unconnected to the company was located, which is the step that separates this from the strongest evidence positions in the lane. Worth revisiting when the Cleo Breast and Cleo Skin studies report.

Primaa makes the strongest architectural claim in this lane and undermines it slightly by where it puts it. The Cleo Breast product page states that the software does not collect any personal data and that all data stay within the customer's own network. If that holds, the vendor never receives patient material at all, which is a stronger position than any retention or deletion policy could be, and it is the same reasoning that credits on premise vendors elsewhere in this index.

A data protection officer is appointed and named publicly, which is a GDPR accountability role that many vendors fill without ever identifying the person. Held at B rather than A for three reasons. The claim appears as an asterisked footnote on a product page rather than in a formal instrument, and no technical description explains how the boundary is enforced or whether it covers support access.

Nothing addresses the patient material used in the company's own clinical performance studies, which were run with named cancer institutes and plainly did involve patient slides. And there is an unreconciled tension a buyer should raise directly: trade coverage of the product's launch described a solution that refines its sensitivity over time as new data arrives, which is recorded here as reported rather than established, but a model that improves from new data and a claim that no data leaves the customer network need to be squared with each other. Ask for the architecture in writing, for the position on support access, and for a plain statement on whether customer material is ever used in model development.

No HIPAA position was located. HIPAA is not named, no business associate status is stated, no business associate agreement is referenced, and the published legal material addresses the General Data Protection Regulation and French data protection law rather than any United States regime.

For a French company selling into French and European laboratories, with no United States entity or United States customer identified, that is a coherent position rather than an oversight, and it should not be read as a compliance failure. There is also an argument available to this vendor that it has not made. The company states that all data stay within the customer's own network and that its software does not collect personal data.

Where a vendor genuinely never receives protected health information, the business associate relationship that an agreement exists to govern may not arise for the licensed product at all, which would make the absence of a HIPAA posture a consequence of the architecture rather than a gap in it. The company does not make that argument anywhere, and the architectural claim itself sits in a product page footnote rather than a documented instrument.

A United States laboratory considering this product should ask for the architecture in writing, and should still ask whether the company will sign a business associate agreement covering support access and any incident in which data does reach the vendor.

No information security certification was located. No ISO 27001, no SOC 2 of either type, no trust centre, no penetration testing statement and no vulnerability reporting route. One absence is worth examining rather than simply recording, because it is specific to this vendor's market.

France operates a mandatory regulatory certification for hosting personal health data, Hébergeur de Données de Santé, required under the Public Health Code and built on ISO 27001 with additional health and data protection requirements. No HDS certification was located for Primaa. For a French company whose customers include French laboratory networks and a major public hospital group, that would normally be a conspicuous gap.

It is not necessarily one here, because the company states that all data stay within the customer's own network, and a vendor that hosts no health data does not need the certification that governs hosting it. That gives a buyer a clean test worth reusing in this market: HDS status is a way of checking whether a vendor actually holds health data, because a vendor that does and is not certified has a regulatory problem, while a vendor that does not has an explanation.

What remains missing either way is any assurance over the software installed inside the laboratory, which is where the exposure sits under this architecture. A data protection officer is named publicly, which is an accountability role rather than a security credential. Ask for the security assurance position over the installed software, the penetration testing history, and confirmation of whether any component or support process touches health data.

Meaningful European authorization, no US clearance. Cleo Breast is CE-IVDR marked as a primary diagnostic solution and, per the company, transitioned from the earlier standard to full IVDR compliance, while Cleo Skin is described as the first AI tool for dermatopathology to receive CE-IVDR certification, which if accurate is a genuine first in a specialty with little AI presence. No FDA clearance was located; US market entry is via platform partnerships rather than independent clearance.

One scope caveat a buyer should catch: in the AISight integration the company itself lists Cleo Breast as CE-IVDR and Cleo Skin as research use only, so the regulatory status of the skin product depends on the market and route.

Stronger than most of this lane on generalisation across sites, and silent on performance across patients, which is what holds the grade. Primaa published a peer reviewed study in PLOS Digital Health in 2023 on multi centre automatic detection of invasive carcinoma in breast whole slide images, and has run a clinical performance study with several named French cancer institutes.

Multi centre design is a genuine test of whether a model survives the staining protocol, scanner and preparation differences that vary between laboratories, and it is the failure mode most likely to bite a pathology algorithm in routine use. Cleo Breast also carries CE marking under the In Vitro Diagnostic Regulation, which sets a higher clinical evidence bar than the directive it replaced. None of that is a bias disclosure.

No performance breakdown by any patient group was located, there is no responsible AI or fairness statement, and no AI management system certification is held. Site level generalisation and patient level equity are different questions and this index does not let one stand for the other. One item is flagged as reported rather than established and should be resolved: trade coverage at launch described a solution that refines its sensitivity over time as new data arrives.

A model that continues to learn after certification raises version control and revalidation questions that a defined regulated device is not supposed to leave open, so a buyer should establish whether the deployed model is locked at a stated version. Publishing subgroup performance and a statement on model versioning would move this materially.

Product function is described concretely, including which biomarkers the breast product addresses and named capabilities such as mitosis counting and lymph node metastasis detection, and the company states clinical development was conducted with European reference laboratories.

What is not published is training data scale or composition, model architecture, evaluation methodology, any performance figure, or any warranty, indemnity or remediation commitment, and the completed results of the dermatopathology validation study were still pending at the time of review. Clear about what the products do, quiet about how well and on what basis.

The named capabilities make the absence more pointed rather than less, because each is a task where the error profile is known and measurable: mitosis counting drives tumour grade, and a systematic difference in counts shifts patients between grades and therefore between treatment pathways, while lymph node metastasis detection has a well characterised difficulty gradient from macrometastases down to isolated tumour cells.

A single figure would not describe either task adequately, and no figure at all describes neither. Naming a capability tells a laboratory what the software claims to do and gives them nothing to validate it against, so the first deployment becomes the evaluation. Ask for sensitivity by metastasis size category, agreement with expert mitosis counts including the spread rather than the mean, and the pending study protocol and timeline.

The clearest multi platform integration strategy of any algorithm only vendor in this index. Cleo runs inside PathAI's AISight, Proscia, PathPresenter, and Gestalt environments, and the breast product is described as integrating into existing viewers such as Sectra. Three of those hosts are separately indexed here.

For a laboratory, this means adoption is likely a matter of enabling an algorithm in a workspace already deployed rather than running an integration project, and it reduces the platform lock in risk that comes with single host algorithms. This is the laboratory image environment rather than the EHR.

The clearest answer in this lane to the question the rest of it leaves open, paired with the thinnest supporting detail. Primaa states that all data stay within the customer's own network, which is a data residency position of the strongest kind and directly answers what a laboratory most needs to know: the slides do not leave.

The software is described as integrating into the existing laboratory workflow and with laboratory machines, and is stated to run inside existing viewers, with Sectra named. Deployment partners and customer institutions across French and European laboratory networks and a major public hospital group are identified by name. Held at B on two counts, and the comparison with Visiopharm in the same lane is instructive because the two are strong in opposite places.

Visiopharm enumerates named platform integrations, a named reference site and a published economic result, but never states where computation happens. Primaa states where the data stays and names only one viewer, with no enumeration of supported systems, no scanner compatibility documentation retrieved, and no implementation timeline or resourcing expectation.

The residency claim is also carried in a product page footnote rather than in documented architecture, so a buyer should get it in writing along with the position on remote support access, which is the usual exception to a claim of this shape.

No pricing is published. The multi platform distribution model means commercial terms likely vary by host environment, and the company discloses corporate milestones such as a pre Series A round rather than product economics. A buyer should establish which platform route they are purchasing through and whether the license covers Cleo Breast, Cleo Skin, or both, given their differing regulatory status.

Two specialties, one of them genuinely underserved. Breast pathology is the most crowded application in pathology AI, but dermatopathology has very little AI presence, and the company positions Cleo Skin as the first CE-IVDR certified tool in that specialty. A stated multi organ roadmap suggests intended expansion. Narrow today, but the dermatopathology position is differentiated rather than duplicative.