Visiopharm

The APPs are the product. Each is a deep learning algorithm performing a specific scoring or detection task on whole slide images, sold individually or as a diagnostic package. No scanner or assay hardware is manufactured; the alliance with Agilent validates the algorithms against Agilent's assays and instruments rather than bundling Visiopharm hardware. Remove the models and nothing remains.

The vendor is unusually explicit about where the machine stops. The APPs run fully automated with no manual interaction up to the point of pathologist review, and the company describes the output as objective decision support delivered for review rather than a diagnosis.

The PD-L1 validation study is notable for testing both stand alone algorithm analysis and algorithm assisted interpretation as distinct conditions, which is a more honest framing of the autonomy question than most vendors offer. Automation is deep but terminates before sign out.

Individual APPs are described with real specificity, including what each measures and how output is ordered, for example metastasis detection ranking by largest diameter or total area depending on tumor type. Validation designs are disclosed at a useful level: the PD-L1 study compared manual assessment against stand alone and assisted analysis across three European sites with a multi reader reference score. Training data scale, model architecture, and head to head comparison against competing pathology AI are not published, so transparency is strong on validation design and lighter on model internals.

The published policy does not cover patient data and, unusually, it makes that explicit rather than leaving it ambiguous. The categories of personal data it processes are enumerated and they are entirely business contact data, with the stated scope covering website visitors, newsletter and event registrants and customers, so a laboratory evaluating what happens to the tissue images the software analyses has no published document describing retention, deletion, access or use for model development.

Two things are credited and they matter. The policy is otherwise competent and specific for what it does cover, setting out legal bases provision by provision, confirming that transfers outside the European Economic Area run on standard contractual clauses with a transfer impact assessment completed, and enumerating data subject rights including the right not to be subject to a decision based solely on automated processing.

A vendor that has done that work on its marketing data has the capability to do it on clinical data. And the company acknowledges that a processing agreement is required where it processes personal data on a customer's behalf, which correctly identifies the right instrument for clinical images even though no template or terms are published.

So a buyer knows what to ask for and cannot read it before asking, which is a better position than not knowing and a worse one than being able to check. Ask for the processing agreement, a retention and deletion schedule covering analysed images, and a written statement on model training.

Better than vendor assertion, short of an outcomes literature, and the shape of the evidence is what holds the grade rather than its quantity. The PD-L1 application rests on a clinical study across three European sites reporting substantial to near perfect agreement with a multi reader reference and high concordance with expert manual assessment. Metastasis detection was verified on breast and colorectal data from three clinical sites for certification.

The strongest single item is a named reference deployment at UMC Utrecht, integrated into the laboratory's existing Sectra system, where a study reported increased metastasis detection sensitivity together with roughly 35 percent time saved and reduced immunohistochemistry cost, and that work was published in the peer reviewed literature in Nature Cancer.

Publishing a health economic result in a journal of that standing is unusual in this category and is credited: most vendors making efficiency claims publish them as case studies rather than submitting them to review. Held at B for the reason that has not changed. The evidence is concordance and efficiency focused rather than patient outcome focused.

Agreement with expert readers establishes that the software reproduces existing practice, and a positive business case establishes that it is cheaper to run, but neither establishes that a patient is diagnosed more accurately or treated differently as a result.

That distinction is typical for biomarker scoring and is not a criticism of the work, but it is the difference between this position and the prognostic evidence held elsewhere in this lane, and a buyer should understand which of the two they are being shown.

The published privacy instrument does not cover patient data, and unusually it makes that explicit rather than leaving it ambiguous. The policy enumerates the categories of personal data it processes and they are entirely business contact data: name, address, telephone number, email, IP address, job function, job title and company name. Its stated scope is website visitors, newsletter and event registrants, and customers. Patient material and slide images are not addressed anywhere in it.

A laboratory evaluating what happens to the tissue images the software analyses therefore has no published document describing retention, deletion, access, or any use for model development. Two things are credited. The policy is otherwise competent and specific for what it does cover, setting out legal bases article by article, confirming that transfers outside the European Economic Area including to the United States run on standard contractual clauses with a transfer impact assessment completed, and enumerating data subject rights including the right not to be subject to a decision based solely on automated processing.

And the company acknowledges that a data processing agreement is required where it processes personal data on a customer's behalf, which is the correct instrument for clinical images, even though no template or terms are published. A buyer should ask for that data processing agreement, for a retention and deletion schedule covering analysed images, and for a written statement on whether customer images inform model development.

No HIPAA position was located. There is no HIPAA notice, no statement of business associate status, no reference to a business associate agreement, and no mention of the HIPAA Security or Privacy Rules in the footer legal section, in the privacy policy, or in retrieved materials. The published privacy instrument is scoped entirely to the General Data Protection Regulation and says so expressly.

For a Danish company selling primarily into European laboratories that is a defensible position, and it should not be read as a compliance failure, since the European obligations are addressed at length. It does mean a United States laboratory has nothing published to work from. The contrast inside this lane is the useful part.

Aiforia is also a European company selling the same category of product into the same laboratories, and it had an independent audit firm test its controls against the HIPAA Security Rule specifically because certain United States pathology laboratories required it before they would work with the company. The difference between the two is commercial intent in the United States market rather than nationality. A US buyer should ask directly whether Visiopharm will sign a business associate agreement, and what position it takes under the Security Rule.

No information security certification of any kind was located. No ISO 27001, no SOC 2 of either type, no HITRUST, no trust centre, no penetration testing statement and no vulnerability reporting route. The site footer carries a legal section listing a legal notice, a cookie policy, a privacy policy and an ESG policy, and nothing on information security.

There is a real disclosure habit here worth crediting even though it does not count on this axis: the EN ISO 13485:2016 quality system certificate is published as a downloadable document with its validity date stated, which is better practice than several vendors in this index that name certifications they never show. But ISO 13485 is a medical device quality management standard rather than an information security one, and it is not treated as security here.

The comparison inside this lane is unusually clean and worth stating plainly: Aiforia holds more assurance and publishes less of it, while Visiopharm publishes what it holds more openly and holds considerably less. A buyer should ask whether an information security management system certification exists or is planned, for the penetration testing position, and for a description of the controls protecting slide images while they are being analysed.

Substantial European authorisation, no United States clinical clearance. The company describes the PD-L1 application as its ninth IVDR clearance and states it holds a full portfolio of clinical applications certified under IVDR, which is a meaningful accumulation given the stricter evidence requirements that regulation imposes. Its distribution partner has stated publicly that the company is committed to pursuing FDA clearance, but no FDA clearance was located as of this review.

One portfolio caveat a buyer should catch: the prostate application is supplied by a third party and carries the older IVDD mark rather than IVDR. Graded C on the standard applied throughout this index, namely strong non United States authorisation without US clinical clearance.

Multi site validation across three clinical sites for both the PD-L1 and metastasis applications tests generalization beyond a single institution, which is a partial answer to the generalization question. No formal governance framework, ongoing monitoring commitment, or demographic subgroup analysis was located.

The validation design is disclosed at a level that lets a reader judge it, which is what this axis rewards when a commercial commitment is absent. One study compared manual assessment against standalone and assisted analysis across three European sites with a multi reader reference score, and every element of that does work.

The three arm structure isolates the software's contribution, because comparing manual against assisted alone confounds the tool with the workflow change, while including the standalone arm shows what the algorithm does on its own. Three sites addresses the transferability problem that breaks pathology models between laboratories.

And a multi reader reference score acknowledges that the ground truth in this field is itself contested, since pathologists disagree with each other on exactly the assessments these tools automate, so a single expert reference would flatter or penalise arbitrarily.

Individual applications are also described with real specificity, including how output is ordered, for instance ranking detected metastases by largest diameter or total area depending on tumour type, which tells a pathologist what the screen will present first. Held below the top grade because training data scale, model architecture and any head to head comparison against competing products are unpublished, and no warranty, indemnity or remediation commitment attaches. Ask for per application sensitivity, the reference score's inter reader agreement, and performance on your own scanner and stain protocol.

Integration into the pathology software environment is an explicit selling point rather than an afterthought. The company markets full integration into various image management and laboratory information systems with automated workflow requiring no manual interaction before review, and a named customer deployment runs inside a Sectra system. The Agilent alliance further embeds the APPs alongside Agilent assays and the Omnis platform. This is laboratory ecosystem integration; no EHR integration is claimed or applicable.

The most specific deployment evidence in this lane so far, and it is demonstrated rather than asserted. Visiopharm publishes named integrations into the systems a digital pathology laboratory already runs, identifying Sectra IDS7 and Proscia Concentric AP by name, with analysis triggered automatically from laboratory information system metadata.

A named reference deployment is described end to end at UMC Utrecht: a slide is scanned, analysis runs in the background, and results are waiting in the Sectra viewer when the pathologist opens the case. The company states that setup uses Sectra standards with no custom changes required, and points to a published paper reporting a positive business case from that site, which is a materially stronger form of deployment evidence than a customer logo.

Scanner compatibility is documented separately, and the Sectra integration additionally uploads on slide controls for continuous internal quality testing of immunohistochemistry staining. Held at B for one specific reason a buyer should press on. The workflow is described completely except for where the computation happens.

Nothing retrieved states whether analysis runs on the laboratory's own infrastructure or on vendor hosted infrastructure, and therefore whether slide images leave the institution at all. There is also no data residency commitment. For a product whose input is a whole slide image of patient tissue, that is the question this otherwise well documented workflow leaves open.

No pricing is published. The per APP packaging does imply a modular purchasing model, and availability through Agilent as the Visiopharm Diagnostic Package gives a second procurement route, but no rates, bundle structure, or per case economics are disclosed. Buyers should establish whether they are licensing individual APPs or a portfolio, since narrow clearances mean coverage depends on exactly which algorithms are included.

Focused on anatomic pathology biomarker assessment, with clinical coverage across breast, lung, prostate, and colorectal cancer spanning HER2, Ki67, PD-L1, metastasis detection, and invasive tumor detection. Breadth comes from accumulating separately certified narrow algorithms, which means real coverage depends on the specific tumor type, antibody clone, and assay in use at a given laboratory rather than on the vendor name.