Valar Labs

The AI is the test. Vesta extracts prognostic and predictive signal from routine hematoxylin and eosin slides using the Computational Histology AI foundation, and the company's own framing is that it surfaces signals not visible to the human eye. The laboratory the company operates exists to deliver the algorithm's result as a clinical test, not the other way round. Without the model there is no product.

Positioned as decision support at defined points in the care pathway, from initial risk assessment through treatment selection, with the clinician choosing therapy. The autonomy question here is different from a detection tool: the test returns a prediction about treatment response, and the concern is not missed findings but how heavily a urologist weights an algorithmic prediction when deciding whether to proceed with BCG or route a patient to an alternative. Clinician testimonials describe using it to redirect treatment, which indicates real influence on decisions and makes the evidence base the appropriate check rather than an oversight mechanism.

Unusually specific about how the model was grounded: board certified pathologists produced more than 500,000 annotations of tumors and their microenvironment to train the Computational Histology AI platform, which is a concrete and checkable claim about the supervision behind the model rather than a vague appeal to data scale.

Effect sizes are published plainly, including roughly twofold elevated risk of BCG non response for biomarker present patients and more than threefold elevated progression risk for high progression scores. Architecture details and full training cohort composition are not published.

A structurally short chain: Valar's own models in its own laboratory on its own hardware, with the business associates unnamed. The tests run on Valar's Computational Histology AI platform, trained on more than 500,000 pathologist annotations, so no outside model provider sits between a specimen and a result, and the specimen goes to Valar's own CLIA laboratory rather than through a partner's software. The company's engineering blog is headed "No Cloud: How We Build Cancer Diagnostics on Tinyboxes", describing self hosted computing rather than a cloud provider. The HIPAA notice says PHI may be shared with business associates such as consultants, subcontractors and auditors, who must maintain its privacy and security, and the website privacy policy lists hosting, IT and support service providers by category; none is named, and no retention period or training term for specimens, images or derived data is published.

A short chain with the model and compute in house, and the other parties unnamed.

Peer reviewed, multi center validation, including randomized trial cohorts. The bladder evidence the company cites includes development and validation of the BCG response assay in an international 12 center cohort (Lotan and colleagues, Journal of Urology), a study showing the predictive biomarker is associated with poor response to BCG but not to sequential gemcitabine and docetaxel, and a multicenter study in high-grade Ta disease comparing the risk scores with the EAU and AUA stratification schemes (European Urology). The company says its bladder models were developed and validated in more than 1,000 patients. In prostate cancer it cites a JCO Precision Oncology paper (July 2026) developing and validating a biomarker in metastatic hormone-sensitive disease on the ENZAMET and CHAARTED randomized phase 3 trials, and in August 2026 Valar and clinical partners published a muscle-invasive bladder cancer prognostic study in Urologic Oncology.

The headline claims (risk stratification better than guideline frameworks; prediction of BCG non-response) are what these studies test. The bladder cohorts are retrospective, and company staff coauthor the work.

Peer reviewed, multi center evidence with method readable, reaching randomized trial cohorts.

General HIPAA commitments, with retention and training use unstated. The Notice of Privacy Practices (effective 1 January 2025) says Valar may de-identify PHI by removing identifying features as the law determines, may use and disclose PHI for research where legally required protections are taken, and needs written authorization for marketing and any sale of PHI. The website privacy policy (29 April 2024) says personal information may be used for research and development, including to create de-identified data. The laboratory's CLIA certification and CAP accreditation impose specimen handling and quality obligations.

None of this says how long specimens, slide images or derived data are kept, or whether patient material and results train Valar's models, which is the question for a company whose platform was built on pathologist-annotated tissue. Safety engineering, meaning how a wrong result is handled as a safety event, is not published.

General assurances that leave retention and training use unanswered.

A covered entity's notice, published and substantive. Valar runs its own CLIA certified laboratory and receives specimens directly, so it handles protected health information as a covered entity rather than as a business associate under someone else's agreement. Its Notice of Privacy Practices (effective 1 January 2025) states its legal duties, including notifying affected individuals after a breach of unsecured PHI; says business associates such as consultants, subcontractors and auditors that receive PHI must maintain its privacy and security; requires written authorization for marketing and any sale of PHI; and sets out the rights to inspect, amend, restrict and receive an accounting of disclosures, with a privacy officer contact and a complaint route to the company and to the Secretary of Health and Human Services. A separate consumer health data privacy policy addresses state health privacy laws, and a website privacy policy (29 April 2024) covers the service.

The notice commits no breach notification timeframe and gives no contact route for the HHS complaint, and the business associate terms Valar imposes on its own vendors are not published.

A stated position under HIPAA supported by a substantive notice, short of published agreements with the parties it shares PHI with.

Nothing independent is published about the security of a laboratory that holds identifiable specimen images. The footer links a privacy policy, the HIPAA notice and a consumer health data privacy policy, and none of them, nor any other page, names an ISO 27001 certificate, SOC 2 report, HITRUST certification, trust center, penetration test or vulnerability reporting route. The laboratory's CLIA certification and CAP accreditation carry specimen handling, records and quality obligations, but they are laboratory quality credentials, not an audit of information security. The company's engineering blog is headed "5 Years, 7 Engineers, No Cloud: How We Build Cancer Diagnostics on Tinyboxes", which describes self hosted computing rather than a cloud provider: that avoids a cloud provider's exposure, and makes the physical and logical security of the company's own hardware the whole control environment, which nothing published describes.

Nothing independent published on security.

A laboratory test route stated, with a device pathway in progress. Vesta tests are performed in Valar's own CLIA certified, CAP accredited laboratory and ordered by treating physicians, which is the laboratory developed test route rather than a cleared device, and the company's May 2026 announcement reports that FDA granted Breakthrough Device Designation to Vesta Bladder Risk Stratify Dx, which it calls the first AI digital pathology prognostic test in bladder cancer to receive it. A Breakthrough designation is a pathway in progress, not a clearance or approval, and FDA's 510(k) database lists no clearance for Valar. The product pages sell clinical decisions, including routing patients predicted not to respond to BCG to an alternative therapy, and they name the CLIA laboratory but carry no plain statement that the tests are not FDA cleared or approved.

A pathway stated and in progress beside a named laboratory regime; no clearance.

Generalization across centers is tested, and nothing is published on performance across patient groups. The bladder assays were developed and validated in an international 12 center cohort and a separate multicenter cohort, and the prostate biomarker on two randomized phase 3 trials, which tests whether the models survive differences between institutions. The company's pages present no results by sex, age, race or center, no governance framework and no post market monitoring commitment. For a test that routes patients away from a standard therapy, per group performance is a fair question for a buyer to press.

Multicenter validation with no evaluation by group published.

The patient has a written right to have an incorrect result amended by the laboratory that produced it, and nothing further stands behind the output. Valar is a covered entity, and the Vesta result it issues is part of the record it keeps. Its Notice of Privacy Practices (effective 1 January 2025) gives the patient the right to request, in writing, that Valar amend PHI in its designated record set that the patient believes is incorrect or incomplete, and commits Valar to answer in writing whether it accepts or denies the request. Because the AI's output is itself the laboratory result that right covers, it is a route the affected person can exercise directly against the company that produced the output, ending in a written decision.

No calibration figure is published for the prognostic scores: the product pages give effect sizes (about twice the risk of BCG non-response when the biomarker is present; about twice the risk of high-grade recurrence over 24 months and almost four times the risk of progression within three years at high scores), which describe separation between groups, not how often a patient's result is wrong. No warranty, indemnity or remediation commitment attaches to a result.

A correction route against the vendor for its own output, short of a commitment that answers for it.

A send-out laboratory test with its result delivery undocumented. Practices send existing specimens to Valar's laboratory and receive results in about three days, so there is no platform to deploy, and a clinician quoted on the product page describes its integration into the practice's workflow. Reach is extended through laboratory partnerships with urology practices. The company's pages name no EHR, laboratory information system or results interface, and do not say whether results arrive by portal, fax or an electronic interface.

Integration claimed with no system named.

One service model, with processing at the company's own laboratory and on its own hardware. Physicians send existing tumor specimens to Valar's CLIA certified laboratory and results return in about three days, so the ordering practice runs no software and the specimen, images and results reside with Valar by design. The company's engineering blog describes building its diagnostics on self hosted hardware with no cloud, so processing stays on Valar's infrastructure rather than a cloud region. The site does not state where that hardware sits beyond the laboratory, or how access to it is separated and controlled.

A single service with its processing location stated as the company's own, and isolation and access left open.

No price is published, and the per test model is. Vesta tests are ordered by licensed physicians and performed in Valar's own laboratory, so the buyer is a practice ordering a send-out test per patient rather than a health system licensing software, and payer coverage decides whether the test is practically orderable. The company runs a Financial Access Program for patients with financial need. No list price, coverage policy, billing code or reimbursement status is published.

The sales posture is discoverable and no price is published.

Deepest in non muscle invasive bladder cancer, where two distinct products address different decisions, prognostic risk stratification and prediction of BCG response, with the same underlying platform extended to prostate and pancreatic cancer as laboratory developed tests.

Concentrating on an underserved population is the strategic point: the company positions bladder cancer patients as having previously had limited access to precision medicine, unlike breast and prostate where molecular assays are established. Narrow across oncology, deliberately deep within it.