Qure AI

Detection and localization on imaging is the entire product line. The qXR suite identifies, highlights, and categorizes findings on plain film chest X-rays across six regions of interest including lung, pleura, mediastinum and hila, heart, bone, and hardware, and the qER products cover neurocritical findings on CT. The company sells nothing but algorithms, with nine products spanning X-ray and CT and no hardware or services business underneath.

Cleared as computer assisted detection to be used alongside standard clinical interpretation, meaning the radiologist reads every study and the AI marks regions warranting closer attention. The company frames it explicitly as a frontline support tool for identifying findings that may warrant further workup, and outputs are bounding boxes indicating suspicious regions rather than diagnostic conclusions. Buyers should note that in the emergency and family medicine settings the company targets, the reader may not be a radiologist, which raises the stakes on how findings are presented and acted on.

Among the strongest in the index because the clearance record itself is unusually detailed and the company adds a rare structural commitment. Validation for the most recent clearance included both a standalone performance test and a multi reader multi case clinical study meeting predefined success criteria, which is the higher evidentiary bar for imaging AI.

More significant is that qXR-Detect is stated to be the only chest X-ray computer aided detection device cleared with a Predetermined Change Control Plan, meaning the company has pre specified with the FDA how models may be updated. Publishing a change control mechanism addresses the hardest transparency problem in deployed AI, which is silent model drift.

The published notice is properly scoped, which is more than most vendors manage and is worth crediting before the gaps. It names the products it governs rather than gesturing at services generally, and it identifies the contracting entity together with its subsidiaries and affiliates, so a reader knows which corporate group is involved. Separate notices exist for job applicants and for the United States market. What is absent is the substance.

Across two differently phrased searches nothing was retrieved stating retention periods for imaging or derived data, whether studies are de identified and at what point, whether customer imaging trains or improves models, or whether a customer can decline, and for a company whose models are built on radiological data at scale the training question is the material one.

The on premise option is a real mitigant and belongs on this axis rather than only on deployment: where a site runs locally the imaging does not leave, and where it runs in the cloud none of the above is answered, and the published material does not distinguish the two. Cross border compounds it, since the contracting entity is incorporated in one jurisdiction while operations span more than a hundred countries with different regimes in each. Absence of a retrieved statement is not proof none exists. Ask for retention, training use, the deployment mode, and the entity of record before deployment.

Regulatory validation at exceptional breadth is the core of the case: 26 FDA cleared indications across nine products, exceeding 65 CE certified indications plus other global validations, each requiring performance data reviewed by a regulator. The latest clearance was supported by both standalone and multi reader multi case studies. The company also holds a global health grant to build point of care ultrasound AI, indicating deployment in resource limited settings. What remains thinner in public materials is prospective outcome evidence showing earlier detection changes patient results rather than reader performance.

Converted from Not Rated. A privacy notice is published and it is properly scoped, naming the products it governs including qXR, qER, qCT, qScout and qTrack, and identifying the contracting entity and its subsidiaries and affiliates. A separate privacy notice exists for job applicants and a separate regulatory and privacy page exists for the United States market. That is more published material than the earlier review found.

What is absent is the substance this axis measures. Across two differently phrased searches nothing was retrieved stating retention periods for imaging or derived data, whether studies are de identified and at what point, whether customer imaging is used to train or improve models, or whether a customer can decline that. For a company whose models are trained on radiological data at scale, model training use is the material question and it is unanswered.

The on premise deployment option is a real mitigant and should be weighed here rather than only on the deployment axis. Where a site runs the software locally, much of this becomes moot because the imaging does not leave. Where it runs in the cloud, none of it does, and the published material does not distinguish the two.

The cross border question compounds it. The contracting entity is incorporated in India, operations span more than 100 countries, and the applicable health data regime differs in each. Which entity holds the data, under which law, and whether it moves between affiliates are questions a buyer must resolve in contract because the published notices do not settle them.

Absence of a retrieved statement is not proof none exists. Ask for retention, training use and the entity of record before deployment.

Converted from Not Rated. Nothing published sets out the posture, and the cross border structure makes it the question to settle first rather than last.

Across two differently phrased searches, including one aimed at the company's own regulatory, privacy and documentation pages, no business associate agreement, no HIPAA role statement, no subcontractor flow down and no breach notification terms were retrieved. Absence of a retrieved document is not proof that none exists, and any United States health system already running this will have executed one in contracting. The point is that a buyer cannot establish the position before entering a sales process.

The role itself is not ambiguous. The health system is the covered entity. A vendor receiving imaging and returning findings processes protected health information on its behalf and is a business associate, with direct liability under the rule.

What makes this more than a paperwork gap here is corporate structure. The contracting entity is incorporated in India, the privacy notice extends to subsidiaries and affiliates, and deployment spans more than 100 countries. Which legal entity signs, whether processing or support access occurs outside the United States, and how affiliate access is controlled are all live questions that a single agreement has to answer. Where support or model operations touch protected health information from outside the country, the agreement and the subcontractor terms are the only thing governing it.

The on premise option changes this materially and should be raised in the same conversation, since a local installation narrows what the vendor receives at all.

Ask which entity contracts, whether any access occurs outside the United States, and for the subcontractor terms.

Corrected from Not Rated. The previous note recorded that no attestation and no trust centre were found. Qure publishes a security position in two places, its regulatory and privacy pages and its product documentation, and it is more substantial than the earlier review captured.

ISO 27001 certification is held and maintained, with periodic external surveillance and recertification audits rather than a one time award. The supporting detail is specific enough to test: access granted on need to know and least privilege, a documented access management lifecycle covering provisioning, authentication, authorisation, removal and periodic review, evidence of all of it provided to external auditors, an annual internal review of security policies against the standard, and annual information security training for all staff. A cybersecurity team assesses threats to processing servers continuously, covering both cloud and on premise installations.

One point here is genuinely distinctive and worth carrying to other device manufacturers in this index. Qure states that its cybersecurity audit reports form part of its Food and Drug Administration submissions and its European technical files, and are evaluated by the agency and by the notified body as part of device review. That is a regulator examining security documentation, which a software only vendor never gets.

Draw the distinction carefully, because this index has ruled the other way on a related point. Device quality management standards such as ISO 13485 are not information security attestations and should not be counted as such. Premarket cybersecurity review is different: it examines the security of the product itself. It is still not an examination of the company's enterprise information security posture, which is what ISO 27001 covers here. Qure holds both kinds, and that combination is the reason this is a B rather than a C.

Held at B rather than A: no SOC 2 of either type, no HITRUST, and no public trust centre, so a United States health system cannot self serve the evidence its procurement process will ask for.

The deepest regulatory footprint of any vendor in this index. FDA cleared indications total 26 across nine products for X-ray and CT, alongside more than 65 CE certified indications and additional global validations. US clearances span lung nodule identification and quantification, triage and notification for pneumothorax and pleural effusion, multiple neurocritical findings including intracranial hemorrhage, cranial fracture and midline shift, and most recently a six indication chest X-ray detection clearance covering the breadth of findings on plain film.

The Predetermined Change Control Plan is the standout element, since it establishes an agreed path for model updates rather than freezing the cleared version or requiring a new submission for each improvement.

No formal governance framework was located, but two structural facts partially substitute. The Predetermined Change Control Plan is a governance mechanism in the most consequential sense, committing the company to a pre agreed process for model change under regulatory oversight. And the global deployment footprint spanning high and low resource settings implies validation across markedly different populations and equipment. What is absent is any published subgroup performance analysis, which matters because chest X-ray AI performance is known to vary with acquisition equipment and patient demographics.

Two things earn this and the second addresses a problem most of this index cannot even see. The first is the evidentiary bar cleared: validation for the most recent authorisation included both a standalone performance test and a multi reader multi case clinical study meeting predefined success criteria, which is the higher standard for imaging software because it measures what radiologists do with the output rather than only what the algorithm outputs.

Predefined criteria matter for the same reason pre specified targets do elsewhere in this index: a threshold set in advance can be missed. The second is a regulator agreed change control plan, stated to be the only chest radiography detection device cleared with one. That addresses silent model drift, which is the hardest transparency problem in deployed artificial intelligence: a model that changes without anyone being told leaves a hospital validating one system and running another.

A published change control mechanism is simultaneously a commitment about how change happens and an acknowledgement that it will, and both are useful to a buyer. Held below the top grade because no warranty, indemnity or remediation commitment attaches, and because the plan governs how models may be updated without stating what data drives the updates. Ask what the change control plan permits, what triggers an update, how sites are notified, and whether customer imaging feeds it.

Converted from Not Rated. Real integration clearly exists in practice and almost none of it is enumerated by the vendor.

Deployment across more than 4,500 sites in over 100 countries is not achievable without picture archiving and communication system integration, worklist delivery and results routing. The capability is evidenced by the scale. What is missing is any published statement of which systems, which standards, which versions, or what a hospital imaging team can rely on. No conformance statement, interface specification or integration list was retrieved.

That contrast is worth naming because a peer in this index publishes a full DICOM conformance statement, which lets a buyer verify compatibility from a document before purchase rather than discovering it in implementation. Publishing the specification is achievable in this category and some vendors do it.

One named route does exist and it is worth crediting. The products are available through a third party radiology artificial intelligence platform that aggregates regulated algorithms behind a single contract, billing and support framework. For a hospital already running that platform, integration is effectively solved and the question becomes commercial rather than technical. That is a genuine distribution and integration channel, independently documented by the partner, not a vendor claim.

It is a channel rather than depth, though. Buying through an aggregator means the integration belongs to the aggregator, and a site not using one is back to an unpublished answer.

Ask for the conformance statement, the supported archive and worklist systems at your site, and whether findings can reach the report or only the viewer.

Corrected from Not Rated. Both a cloud and an on premise installation model are supported and stated, and the company's own security material confirms it by describing threat assessment across both.

That matters more than a hosting region would. On premise deployment is the strongest available answer to a residency question, because it does not locate the transfer, it removes it. For a buyer with data localisation obligations, or one unwilling to send imaging outside its own estate, the option existing at all is the answer to the question. This index treats the same architectural choice as decisive elsewhere in imaging, where the lane splits on whether the scan leaves the building.

Scale supports the claim rather than resting on it: deployment is reported across more than 4,500 sites in over 100 countries, which is not achievable without both models working in practice.

What is still not published, and what holds this at B rather than A: for the cloud path, no hosting provider, no region list, no tenancy model, no subprocessor list and no statement of whether imaging is retained after inference. For an organisation operating across jurisdictions with materially different health data localisation rules, a published region map would be the natural next disclosure and it does not exist.

Ask which model your deployment uses, and if cloud, in which region inference runs and what is retained afterwards. Ask separately whether the on premise option carries feature parity, since it frequently does not.

Converted from Not Rated. No pricing, no mechanism, and a portfolio structure that makes the absence more consequential than usual.

Nothing is published: no rate card, no basis, no term, no minimum, no volume banding, and no statement of whether the model is per study, per site, per module or subscription.

The portfolio is what makes the silence bite. This is not one product. It spans chest radiography, head and chest computed tomography, point of care ultrasound and patient tracking, across a large number of separately cleared indications. A buyer wanting two indications and a buyer wanting nine are having completely different commercial conversations, and nothing published indicates whether indications are licensed individually, bundled by modality, or sold as a platform. That is the first question in any evaluation and it cannot be answered without a sales process.

One partial route to a number exists and should be understood for what it is. The products are resold through a third party radiology platform that bundles multiple vendors under a single contract and billing framework. That gives a buyer a procurement path and possibly a comparable line item, but the price is set in that relationship rather than published, so it is a channel rather than a disclosure.

The global footprint adds a further unknown. Pricing in a high burden tuberculosis screening programme and pricing for a United States emergency department are unlikely to be the same, and nothing describes how or whether it varies.

Ask for the licensing unit first, before the clinical evaluation, since it determines the shape of everything after it.

Broad and substantiated by clearance record rather than assertion. Modality coverage spans chest X-ray and CT with point of care ultrasound in development, clinical coverage spans pulmonary findings, neurocritical findings, and cardiothoracic indicators, and reader settings explicitly include emergency physicians and family medicine practitioners alongside radiologists. Geographic reach is global, spanning US, EU, and low resource health system deployments. For a pure play imaging AI vendor this is unusually wide.