Qure AI

The detection models are the engine of Qure's imaging products, and the company now sells workflow platforms around them. qXR (chest X-ray), qER (head CT), qCT and qMSK are deep learning products that do not exist without their models.

Around them Qure sells qTrack for tuberculosis care cascades, a lung nodule management pathway that tracks patients through follow-up, a stroke care coordination suite for hub and spoke hospital networks, and Aira, a care delivery platform for health programs that digitizes records, guides frontline workers and follows patients up. Those carry value beyond the detection models, so the models are the engine of core modules rather than the whole of what is sold.

Each cleared product states its role, and one marketed use, sorting out normal chest X-rays, has no published routing. qXR-Detect (K251934) is a concurrent reading aid that highlights and categorizes suspicious regions on adult chest X-rays; qXR-LN (K231805) is a second reader for nodules of 6 to 30 mm and is not a substitute for the original read; qER and qXR-PTX-PE are triage and notification devices.

The qXR page also markets clearing backlogs by segregating unremarkable chest X-rays, citing a 99 percent negative predictive value, and pre-filled reports; it does not say whether a clinician still reads the studies set aside as normal. The cleared users include emergency and family medicine physicians as well as radiologists, so the reader may not be a radiologist. Model updates under the qXR-Detect change plan are locked and announced through revised labeling. Aira, the care delivery platform, flags patient responses that need clinical attention, with no published threshold or routing.

The products, their training data and their update discipline are published. The qXR-Detect 510(k) summary (K251934) says the algorithm was trained on about 2.5 million chest X-rays from the US, the EU, India, Vietnam and Brazil, and the qXR product page gives a training figure of 9 million scans.

Versions are named in the regulatory record (qXR v3.1 and v4.0, qER v2.0). qXR-Detect carries a Predetermined Change Control Plan with two predefined modifications, including retraining on newly acquired adult chest radiographs without changing the architecture; it rules out continuously learning algorithms, requires each change to be trained, tested for regression across the six categories with subgroup analysis and then locked, and tells users through updated labeling and instructions for use.

That meets A: models identified, training data characterized, versioning and update practice published. Gaps: the training description gives size and geography, not sites, time period or case mix, and the change plan covers qXR-Detect only.

A structurally short chain for the models, with the hosts named and no subprocessor list. Qure builds and trains its own models, and the cleared qXR-Detect model can change only through the locked steps of its FDA change plan. The Security and Regulatory page names AWS and Azure as cloud hosts, the privacy notice places QureApp on AWS in Mumbai and Hyderabad and says service providers are contractually bound not to share personal data, and images are de-identified before they leave the customer's premises for the cloud. The site gives no subprocessor list, and it does not say which affiliates can reach data or on what terms channel partners resell or host Qure's products.

Independent evidence is strong for tuberculosis screening accuracy; the outcome claims rest on thinner work. Qure's evidence library lists independent diagnostic accuracy studies of qXR for tuberculosis across several countries (the Philippines, Viet Nam, household contacts, a 2025 systematic review and meta-analysis), program evaluations and a cost-effectiveness study in Nigeria, and the company markets its TB products as WHO evaluated.

US claims rest on retrospective regulatory studies: for qXR-LN (K231805), a standalone study across 40 US sites with nodule level sensitivity of 84.1 percent at 0.18 false positives per image, plus a reader study; for qXR-Detect (K251934), standalone AUCs of 0.879 to 0.958 by category and an 18 reader study on 301 cases in which reader sensitivity rose from 89.0 to 93.4 percent.

Product page figures (40 percent faster turnaround, 99 percent negative predictive value for unremarkable X-rays, 90 percent of missed abnormal X-rays identified with no false positives) come from customer case studies and service evaluations. A real world study at one hospital in India reports faster stroke treatment. There is no prospective, multi site evidence that earlier detection changes outcomes.

De-identification is stated and the processing role is defined; retention and training use are not. Qure's Security and Regulatory page says data is de-identified before it leaves a covered entity's premises for cloud processing, and that on-premise installations may process identifiable images only on servers the customer owns and operates.

Its privacy notice says Qure acts only as a data processor for patient scans uploaded to QureApp, under a customer data processing agreement, and does not decide the purpose or means of that processing; QureApp runs on AWS in Mumbai and Hyderabad. Not stated: how long scans and outputs are kept after processing, and whether customer images feed retraining, which the qXR-Detect change plan contemplates with newly acquired datasets. Safety engineering, meaning how a missed or false finding is handled as a safety event, is not published. Categorical commitments without the retention and training terms.

Qure states a position a buyer can rely on: its cloud path is built not to receive protected health information. The Security and Regulatory page says Qure complies with HIPAA by de-identifying data before it leaves a covered entity's premises for cloud processing, and that on-premise deployments may skip de-identification only where processing stays entirely on servers the covered entity owns and operates.

The privacy notice, which covers the company's products and apps, says Qure acts only as a data processor for uploaded scans under a customer data processing agreement. That is the scope route to B: a plain statement of why the product does not handle protected health information, with a service privacy document behind it. No business associate agreement is published, and the position does not address support access to on-premise servers or Aira, which keeps longitudinal patient records in programs outside the US.

ISO 27001 is claimed as the company's own, with further outside checks and no trust portal. Qure's Security and Regulatory page states it is ISO/IEC 27001 certified, audited annually by third parties for GDPR compliance, MDSAP certified for ISO 13485 and compliant with IEC 62304. Its cybersecurity audit reports form part of its FDA submissions and EU technical files, a review of the product's security rather than the company's operations.

It describes real time threat assessment for cloud and on-premise installations, encryption in transit and at source, and cybersecurity liability insurance issued after underwriter due diligence. Hosting is on AWS and Azure. No SOC 2 or HITRUST report is claimed and there is no trust portal to download evidence from, so B: a recognized certification named without the artifact.

The US position is stated product by product, with links to the FDA summaries. qXR-Detect was cleared on 16 January 2026 (K251934; 21 CFR 892.2070, Class II, product code MYN) as a concurrent reading aid that highlights and categorizes suspicious regions on adult chest X-rays into six categories, with a Predetermined Change Control Plan. qXR-LN was cleared in December 2023 (K231805; 892.2070, MYN) as a second reader for pulmonary nodules of 6 to 30 mm in adults.

The company's regulatory page lists qER v2.0 (triage for intracranial hemorrhage, mass effect, midline shift and cranial fracture), qER-Quant, qCT-Quant, qXR-BT, qXR-PTX-PE and qXR-CTR as cleared, each linked to its 510(k) summary, though that page does not yet list qXR-Detect; the company counts 26 cleared indications across nine products. CE certification covers qXR v3.1 and qER v2.0 (Class IIa, MDD) and qXR v4.0, qER-NCCT, qCT and qMSK (Class IIb, MDR).

Not US cleared: qMSK, the tuberculosis and care cascade products, segregation of normal X-rays, and Aira, for which a September 2026 company announcement describes a class certification as a clinical decision support system whose scope the product page does not state. Match each module in a quote to its clearance number.

A regulator reviewed change plan governs how the chest X-ray model may change; subgroup results are described but not published. The qXR-Detect clearance carries a Predetermined Change Control Plan that fixes two permitted modifications, bars continuously learning algorithms, requires each update to be tested for regression across the six categories with subgroup analysis before it is locked, and tells users through revised labeling.

The qXR-LN summary says subgroup analyses by age, gender, race, nodule characteristics, equipment manufacturer and scan view were performed and presented to the FDA, and the qXR-Detect summary describes a test set drawn from 40 states with a balanced sex split and ages from 22 to over 85, but neither publishes results by group.

Those missing results matter for this kind of model: chest X-ray classifiers trained on public datasets have been shown to underdiagnose women, Black and Hispanic patients, younger patients and patients on Medicaid.

Mechanisms exist to review and trace outputs, and nothing stands behind them. Findings are marked as bounding boxes for a reader to accept or reject, qXR-LN states it is not a substitute for the original read, and model changes under the qXR-Detect change plan are locked and announced through labeling.

Two of the company's 510(k) summaries report device performance, and neither gives an error rate with its denominator. qXR-LN (K231805) reports nodule level sensitivity of 84.1 percent at 0.18 false positives per image, and scan level sensitivity of 93.8 and specificity of 81.1 percent, on data from 40 US sites, without stating how many scans were tested. qXR-Detect (K251934) reports standalone results only as area under the curve by category; its sensitivity and specificity figures are for readers, not the device. The company publishes no warranty, indemnity or remediation commitment, and its cybersecurity insurance covers breaches, not findings.

Integration is claimed and not enumerated. The qXR page promises zero integration effort and deployment on cloud or on premise, the company says its software works with new and old X-ray systems, and the qXR-Detect summary describes results returned to radiology software or the X-ray console; qXR-LN is cleared for use with any DICOM viewer or PACS.

No conformance statement, interface list or named record system integration is published, and the company also sells through channel partners, including a third party radiology AI platform that aggregates algorithms under one contract. With no system named, the integration rests on standards claims with nothing to verify.

Cloud and on-premise options are stated, with the cloud path and one hosting region described. Qure runs on AWS and Azure; images are de-identified before leaving the customer's premises for cloud processing, and on-premise installations keep processing on servers the customer owns. The privacy notice places QureApp on AWS in Mumbai and Hyderabad, India.

For hospital deployments in the US or EU, the region where cloud inference runs, tenant isolation and retention after inference are not published. Options and part of the residency stated, with isolation left open.

No pricing, no mechanism, and a portfolio structure that gives the absence extra weight.

Nothing is published: no rate card, no basis, no term, no minimum, no volume banding, and no statement of whether the model is per study, per site, per module or subscription.

The portfolio is what makes the silence bite. This is not one product. It spans chest radiography, head and chest computed tomography, point of care ultrasound and patient tracking, across a large number of separately cleared indications. A two indication deal and a nine indication deal are completely different commercial conversations, and nothing published indicates whether indications are licensed individually, bundled by modality, or sold as a platform. That cannot be answered without a sales process.

There is one partial route to a number. The products are resold through a third party radiology platform that bundles multiple vendors under a single contract and billing framework. That offers a procurement path and possibly a comparable line item, but the price is set in that relationship rather than published, so it is a channel rather than a disclosure.

The global footprint adds a further unknown. Pricing in a high burden tuberculosis screening program and pricing for a United States emergency department are unlikely to be the same, and nothing describes how or whether it varies.

Coverage is named across modalities, readers and settings, with validation behind part of it. Qure covers chest X-ray, head and chest CT and musculoskeletal X-ray, sold to hospitals, imaging centers, teleradiology services, immigration screening and public health programs in more than 105 countries.

The US clearances name the readers: qXR-Detect's reader study included radiologists, emergency physicians and family medicine practitioners, and qXR-LN's included radiologists, pulmonologists and emergency physicians, on data from 40 US sites. Tuberculosis screening is backed by independent evaluations in high burden countries.

Heart failure detection, musculoskeletal reporting and Aira's care delivery work in Nigeria, Kenya, Mozambique and the Solomon Islands are named without published validation by setting. Named coverage with validation behind part of it.