Rayscape

Deep learning image analysis is the entire offering, spanning chest radiograph interpretation and lung nodule detection on CT with no hardware, PACS, or services layer of its own. The company is small, reported at roughly 26 employees, which reinforces rather than undermines the point: there is no adjacent business the algorithms are decorating.

Assistive detection with an interesting wrinkle worth noting. The reporting engine converts detections into draft narrative documentation for radiologist review and validation, which the company frames explicitly as preserving physician oversight while reducing transcription.

Separately, the company co-authored research on how textual versus visual AI explanations affect reader decision making, which indicates unusual awareness that HOW a result is presented changes whether a clinician defers to it. That is a more sophisticated read of the oversight problem than most vendors demonstrate.

The company publishes research rather than only claims, including work on the capabilities and evidence coverage of CE-marked AI products for lung nodule analysis, effectively surveying its own competitive category, and contributing to a study on how explanation format affects clinical decision making.

Threshold sensitivity is acknowledged openly, with the tuberculosis work highlighting the importance of tailored threshold settings, which is an honest admission that out-of-the-box performance depends on local configuration. Model architecture, training data composition, and per-finding accuracy across the claimed 148 findings are not published.

The commitment made here is unusually direct and it answers most of what this axis asks. Published material states that patient data is never transmitted outside the customer's institution and is not shared with any external party, alongside stated adherence to European data protection law and the legislation governing medical imaging.

A commitment that nothing leaves the institution is stronger than a retention policy, because it removes the vendor from the position of holding patient data at all, and it disposes of the training use question this index has to put to almost every other vendor: imaging that never reaches the company cannot contribute to model development. Held below the top grade on three points, all of which are about turning the claim into something enforceable rather than doubting it.

An absolute covering all circumstances is exactly the kind that should be reduced to contract language rather than accepted from a support page, since operational reality usually carries defined exceptions for support access, diagnostics and incident investigation, and a vendor that cannot reach the system cannot fix it. No retention period is stated for data the product holds inside the institution.

And the phrase describing the customer's institution needs definition where a site runs a cloud hosted archive, because the boundary the commitment protects is then not physically the hospital and the guarantee may be satisfied while the data sits with a third party the vendor never touched. Ask for the commitment in the agreement, the support access exceptions, and local retention.

One genuinely strong independent evidence point anchors this. Performance was assessed in a computer-aided tuberculosis detection study within a South African tuberculosis prevalence survey published in The Lancet Digital Health, which is both a high impact venue and a population screening setting rather than a curated retrospective cohort. That is materially more rigorous than vendor-run accuracy testing.

Against that, the claim of detecting up to 148 pathologies on chest X-ray is not matched by per-finding published performance, and user reported figures such as up to 50 percent reduction in comparative study analysis time are anecdotal. Strong evidence where it exists, thin across the breadth claimed.

The company makes an explicit architectural commitment that answers most of what this axis asks, and it is unusually direct. Its published material states that patient data is never transmitted outside the customer's institution and is not shared with any external party. Alongside that it states adherence to European data protection law and all relevant data protection legislation governing medical imaging and patient information.

A commitment that nothing leaves the institution is stronger than a retention policy, because it removes the vendor from the position of holding patient data at all. It also disposes of the training use question that this index has to ask of almost every other vendor: imaging that never reaches the company cannot contribute to model development.

Held off A on three points. An absolute claim covering all circumstances is exactly the kind that should be reduced to contract language rather than accepted from a support page, since the operational reality usually has defined exceptions for support access, diagnostics and incident investigation. No retention period is stated for data held inside the institution by the product itself. And the phrase describing the customer's institution needs definition where a site runs a cloud hosted archive, because the boundary the commitment protects is then not physically the hospital.

Ask for the commitment in the agreement, for the exceptions that apply to support and troubleshooting access, and for what the product retains locally between studies.

Graded on category non application with the domain equivalent addressed, which is the pattern this index applies to vendors outside the United States framework. A Romanian company holding CE marking under the European medical device regulation, without a United States clearance, is not positioned for clinical sale in the United States, so there is no covered entity relationship to document and no business associate agreement to publish. The framework genuinely does not reach it.

What lifts this to a B rather than a C is that the governing local instrument is addressed rather than ignored. The company states adherence to European data protection law and to the data protection legislation governing medical imaging and patient information, and separately makes an architectural commitment that patient data never leaves the customer's institution and is not shared with any external party. That second point matters more than the first, because a vendor whose product does not move patient data outside the controller's environment occupies a much narrower processor role than the usual cloud arrangement.

Where this sits below the strongest examples of the pattern: no data protection officer contact is published, no legal bases for processing are stated, and no data processing agreement terms were located. Those are the specifics that a fully worked European disclosure carries.

One forward looking note. If the company pursues United States clearance and market entry, this analysis changes entirely and the United States framework attaches to those deployments. Ask about that intent, since the answer determines which questions a buyer should be asking a year from now.

No SOC 2, ISO 27001, HITRUST or equivalent information security attestation was located, and no trust centre or security page exists.

What the company does hold is different in kind and should not be conflated with it. It states that it operates under ISO 13485 quality management and is certified under the European medical device regulation, with independent conformity audits. Those are real external examinations conducted by third parties, and they are more than most early stage vendors can show. But ISO 13485 certifies a quality management system for designing and manufacturing medical devices, not an information security management system. The two standards sit in the same family and are routinely confused, and holding one says nothing about the other.

There is, however, a specific document a buyer can ask for, and it is the useful part of this row. Under the European medical device regulation, cybersecurity forms part of the general safety and performance requirements, so a manufacturer placing a device on that market must produce a cybersecurity risk analysis within its technical documentation, and a notified body reviews it as part of conformity assessment. That material therefore exists for this product and has been examined by an external party, even though nothing about it is published.

Ask for the cybersecurity section of the technical documentation, or a summary of it, rather than asking only whether an attestation exists. For a certified European device that is the document with the substance in it.

CE marked and externally evaluated, with no FDA clearance located. Graded C on the standard applied throughout this index to vendors holding genuine European authorisation without United States clinical clearance: the European mark is real regulatory approval, but a US hospital cannot deploy on the strength of it.

The tuberculosis focus is worth reading alongside this, since the highest value deployments for chest X-ray tuberculosis screening are in high burden countries outside the US and Europe, where CE marking plus evidence aligned to World Health Organization guidance often matters more commercially than FDA clearance does.

Stronger than most small vendors, driven by where the evidence was generated. Validation within a South African tuberculosis prevalence survey tests the algorithm on a population and disease burden profile very different from the European and North American cohorts that dominate imaging AI training data, which is a direct test of the generalization gap that most vendors leave unexamined.

The company also publicly acknowledges that threshold settings need tailoring for diagnostic efficiency, which is an honest statement about performance varying by deployment context. No formal governance framework or demographic subgroup breakdown was located.

The company publishes research rather than only claims, and two pieces of it are the kind a vendor has no commercial reason to produce. One surveys the capabilities and evidence coverage of certified products for lung nodule analysis, which means it has effectively catalogued its own competitive category, inviting comparison rather than avoiding it and producing a document a buyer can use against the vendor as easily as for it.

The other contributes to a study on how explanation format affects clinical decision making, which addresses the question underneath every interpretability feature in this index: whether the way a finding is presented changes what a clinician decides. Almost every vendor here asserts that explanations help and none has tested it.

Threshold sensitivity is also acknowledged openly, with the tuberculosis work highlighting the importance of tailored settings, which is an honest admission that out of the box performance depends on local configuration and quietly contradicts the plug and play framing common in this lane.

Held below the top grade because per finding accuracy across a claimed scope of well over a hundred findings is unpublished, and a scope that broad makes an aggregate figure meaningless even if one existed. Model architecture, training composition and any warranty, indemnity or remediation commitment are also absent. Ask for accuracy on the twenty findings you most care about, and who sets thresholds at your site.

Integrates directly into on-premise or cloud PACS, returning annotated images and structured outputs inside the native radiology viewer with no parallel workspace, and the interface is described as configurable so institutions can align outputs, thresholds, and visualization with local reporting standards. Configurable thresholds are an unusual and genuinely useful integration feature, since it lets a site tune sensitivity to its own case mix. No named connector list or API documentation was located. Radiology environment integration; no EHR integration claimed.

Both on-premise and cloud PACS integration are offered, described as a plug-and-scan model. Offering an on-premise path is meaningful for institutions that cannot export imaging, and is particularly relevant given the company's tuberculosis screening footprint in settings where data export may face regulatory or connectivity constraints. Specific tenancy and residency terms for the cloud path are not published.

No pricing, licensing structure, or commercial model detail was located in the materials reviewed. The company is early stage, reporting a seed round in March 2024 and roughly 26 employees, so a buyer should weigh vendor durability alongside product fit, particularly given that another vendor in this same lane entered administration in 2025.

Thoracic focused across two modalities: chest radiography with a claimed 148 findings, and lung nodule detection on CT with automatic longitudinal comparison across a patient's prior scans to track disease evolution. The longitudinal comparison capability is a real differentiator, since lung cancer screening depends on measuring nodule change over time rather than single timepoint detection, and most competitors handle only the latter. Tuberculosis detection extends the relevance to global public health screening programmes. Confined to the chest.