Valar Labs

The AI is the test. Vesta extracts prognostic and predictive signal from routine hematoxylin and eosin slides using the Computational Histology AI foundation, and the company's own framing is that it surfaces signals not visible to the human eye. The laboratory the company operates exists to deliver the algorithm's result as a clinical test, not the other way round. Without the model there is no product.

Positioned as decision support at defined points in the care pathway, from initial risk assessment through treatment selection, with the clinician choosing therapy. The autonomy question here is different from a detection tool: the test returns a prediction about treatment response, and the concern is not missed findings but how heavily a urologist weights an algorithmic prediction when deciding whether to proceed with BCG or route a patient to an alternative. Clinician testimonials describe using it to redirect treatment, which indicates real influence on decisions and makes the evidence base the appropriate check rather than an oversight mechanism.

Unusually specific about how the model was grounded: board certified pathologists produced more than 500,000 annotations of tumors and their microenvironment to train the Computational Histology AI platform, which is a concrete and checkable claim about the supervision behind the model rather than a vague appeal to data scale.

Effect sizes are published plainly, including roughly twofold elevated risk of BCG non response for biomarker present patients and more than threefold elevated progression risk for high progression scores. Architecture details and full training cohort composition are not published.

Nothing identifies any party in the chain: no hosting arrangement, no sub processor list, no retention position, no de identification statement and no position on whether patient material contributes to model development was located. What exists instead is an inferred regulatory baseline.

Operating a certified and accredited laboratory brings mandatory quality system, proficiency testing and specimen handling obligations that an algorithm only vendor does not carry, and that is a genuine floor for operational rigour. It is also the wrong instrument for this axis, and the clarification this index recorded elsewhere applies directly: laboratory accreditations govern how a test is performed, not what becomes of the data afterwards.

A laboratory can be impeccably accredited and still hold specimens indefinitely, use derived data for model development and answer to nobody about either, because none of that is what the accreditation examines. The material makes the question weightier than it would be for an image only vendor, since a laboratory receives the specimen itself along with accompanying clinical documentation, and residual tissue is a durable asset in a way an image is not.

Ask for retention across specimen, image and derived data separately, whether patient material contributes to model development, who inside the company can reach an identified record, and the deletion path.

The strongest evidence base of the pathology AI vendors added in this sweep, and independent in the ways that count. Development and validation of the BCG response assay was published in the Journal of Urology from an international 12 center cohort, and a separate multi center validation in European Urology, the highest impact journal in the specialty, found the biomarkers stratify recurrence and progression independently and outperform current guideline based risk stratification.

Outperforming the existing guideline standard is a materially stronger claim than demonstrating concordance with it, and multi center design across academic collaborators addresses generalization. Cohorts exceed 1,000 patients across four continents.

Operating a CLIA certified and CAP accredited laboratory brings mandatory quality system, proficiency testing, and specimen handling obligations that an algorithm only vendor does not carry, which provides a baseline of operational rigor. No AI specific safety documentation, failure mode disclosure, or PHI framework beyond laboratory accreditation was located, so this is inferred regulatory baseline rather than published stewardship policy.

Like Artera in the same comparison, Valar runs its own CLIA certified and CAP accredited laboratory, which makes it a covered entity handling protected health information directly rather than a business associate working under somebody else's contract, and it publishes the instrument that position requires: a Notice of Privacy Practices effective January 2025. The two vendors reach the top of this axis for different reasons and the difference is worth reading.

Valar is the stronger on how its notice interacts with other law and on the mechanics of exercising rights. It commits to following the more stringent and protective law where other federal or state rules impose additional limits, naming information relating to mental health, HIV and AIDS, reproductive health, genetics and substance use disorders. That is a substantive undertaking rather than a recital, and it is directly relevant for a company analysing tumour tissue.

The right to request restrictions is stated precisely, including the provision that a restriction must be honoured where a patient has paid out of pocket in full and asks that the service not be disclosed to their health plan. The accounting of disclosures is set out in operational detail: six years, one per year without charge, and any fee notified before the accounting is processed.

Any use not described, expressly including marketing activities and the sale of PHI, requires written authorisation that the patient may revoke. Business associates are named as a category and required to maintain privacy and security. A named Privacy Officer is given with email, telephone and postal address, and the company undertakes not to retaliate against a complainant.

A separate consumer health data privacy policy is published alongside the notice, addressing the newer state health privacy regimes that most vendors in this index leave unaddressed. Two points where Artera is more specific, and closing them would put this beyond argument: no timeframe is committed for breach notification, and the notice refers a complainant to the Secretary of Health and Human Services without giving the contact route.

No security attestation of any kind was located. No SOC 2 of either type, no ISO 27001, no HITRUST, no trust centre, no penetration testing statement and no vulnerability reporting route. The site footer carries the privacy policy, the HIPAA notice and a consumer health data privacy policy, and nothing on security. That is a visible gap beside Artera in the same comparison, which maintains a public trust centre naming SOC 2 Type II and publishes a route for reporting vulnerabilities.

Two things are worth recording without counting them as security. The laboratory holds CLIA certification and CAP accreditation, which carry real specimen handling, records and quality obligations, but these are laboratory quality credentials rather than information security ones and should not be read as the latter. More interesting, the company publishes an engineering account of building its diagnostics on self hosted hardware rather than on cloud infrastructure.

That is an architectural choice with security consequences running both ways: patient material is not passing through a third party cloud or the subprocessor exposure that comes with one, but the physical, network and access security of the company's own hardware then constitutes the entire control environment, and nothing is published about how it is protected.

A buyer should ask for a SOC 2 report or equivalent independent assessment, for the penetration testing position, and specifically for how the self hosted environment holding identifiable specimen images is secured physically and logically. One scope limit worth stating: the privacy policy itself was not opened on this pass, so a security disclosure reachable only from inside that document would not have been caught.

A different regulatory route than most vendors indexed here, and the distinction matters. Vesta tests reach patients as laboratory developed tests offered from the company's own CLIA certified and CAP accredited laboratory, which means they are clinically orderable today without FDA clearance, because LDTs have historically been exercised under enforcement discretion rather than premarket review. That is real availability but a lower evidentiary bar than clearance.

Vesta Bladder Risk Stratify Dx received FDA Breakthrough Device Designation in May 2026, reported as a first for AI digital pathology prognostics in bladder cancer, but as applied consistently across this index a Breakthrough designation is a review pathway commitment, not a clearance or approval. Graded C: clinically available now, no cleared device, with a designation signaling intent to pursue one.

Multi center validation across an international 12 center cohort spanning four continents is a substantive answer to geographic and site generalization, better than most vendors here can show. What is absent is a formal governance framework, post market monitoring commitment, or subgroup performance analysis by race, age, or sex. For a test that redirects patients away from a standard therapy, undocumented subgroup performance is a fair question for a buyer to press.

Two disclosures here are better formed than the category norm. The first is about supervision rather than scale: board certified pathologists produced more than five hundred thousand annotations of tumours and their microenvironment to train the platform, which is a concrete and checkable claim about who taught the model and at what depth, rather than the vague appeal to data volume this index sees constantly.

Annotation by named credential is a stronger provenance statement than a corpus size, because a large weakly labelled corpus and a smaller expertly annotated one produce very different systems. The second is the form of the results.

Effect sizes are published plainly, including roughly twofold elevated risk of non response to first line therapy for biomarker present patients and more than threefold elevated progression risk at high scores, and an effect size is the form a clinician actually reasons in when deciding whether a test changes management, where an accuracy percentage is not. Held at C because the surrounding evidence is thin.

No architecture, full training cohort composition, calibration or independent replication was located, and no warranty, indemnity or remediation commitment. Effect sizes from a development cohort also tend to shrink on external validation, which is the specific thing to ask about. Ask for external validation in an independent cohort, calibration, and the cohort composition behind the published effect sizes.

The service model largely sidesteps integration: a practice sends existing tumor specimens and receives results in days, so there is no platform to deploy. Reach is extended through laboratory partnerships, including a digital pathology laboratory with established relationships across urology practices nationally, which functions as distribution rather than technical integration. No published EHR or laboratory information system connector list was located, so results delivery into the ordering clinician's systems is undocumented.

Structurally simple for the customer because there is no deployment. Specimens are sent to the company's own CLIA certified laboratory and results are returned, meaning the health system takes on no hosting, tenancy, or infrastructure decisions and no imaging data leaves through a software integration.

The tradeoff is that specimen and resulting patient data reside with the vendor's laboratory by design, which is a different risk profile rather than an absent one, and specific data handling terms are not published.

No pricing is published. The laboratory developed test model does imply per test economics familiar to any practice ordering send out diagnostics, and the relevant commercial question for a buyer is payer coverage rather than license cost, since LDT reimbursement determines whether the test is practically orderable. No coverage or reimbursement detail was located in this review, which is the gap worth pressing on given how directly it governs adoption.

Deepest in non muscle invasive bladder cancer, where two distinct products address different decisions, prognostic risk stratification and prediction of BCG response, with the same underlying platform extended to prostate and pancreatic cancer as laboratory developed tests.

Concentrating on a genuinely underserved population is the strategic point: the company positions bladder cancer patients as having previously had limited access to precision medicine, unlike breast and prostate where molecular assays are established. Narrow across oncology, deliberately deep within it.