How we grade evidence

The five classes.

Each class describes four links: how the data was captured, how the specimen identity was bound to it, where the result was computed, and how it was delivered.

CAPTUREIDENTITYCOMPUTEDELIVERY

Device-attested raw data, identifier bound at source, computed in the sealed runtime.The whole chain. Reproducible, recall-queryable, re-runnable bit-for-bit years later.

CAPTUREIDENTITYCOMPUTEDELIVERY

Raw data computed by us; identifier associated at capture by a named operator.Everything except the identifier binding, which is recorded as an attested human assertion rather than a machine fact.

CAPTUREIDENTITYCOMPUTEDELIVERY

Instrument-computed intermediates; the clinical determination computed in the sealed runtime.Custody, the identity binding and your determination — completely and reproducibly. Not how the instrument derived the values it handed us. Because the input is hashed and recorded, an upstream error is provably upstream.

CAPTUREIDENTITYCOMPUTEDELIVERY

Finished result computed on the instrument, transported under device attestation.Custody from the moment of capture — but not a claim about how the number was produced. We will not pretend otherwise.

CAPTUREIDENTITYCOMPUTEDELIVERY

Result transcribed by a human from a screen or a printout.Who typed what, when, and that it was unaltered afterwards. The weakest path, marked as such permanently.

Attested Attested in part Recorded, not attested

The class is a label, not the evidence. Every record stores two independent facts — how capture and identity were established, and where the result was computed. The class above is derived from that pair for readability. Your regulatory lead can query either field directly, and a configuration we have not met yet still records honestly rather than being forced into the nearest rung.

Why we publish this rather than bury it. A supplier who claims the same evidentiary strength for every configuration is telling you they have not thought about it. Grading the chain protects your regulatory position — we never assert that a number is correct, only how it arrived — and it gives your regulatory lead something they can write down per configuration when a notified body asks. It also makes the upgrade path concrete: moving from Class 3 to Class 1 means bringing the instrument itself under attestation, and we can tell you exactly what that takes.

What every result carries.

The traceability record, field by field. Every one of these is written for every result, retained, and queryable.

accession_tokenAn opaque string. We hold no identifiers and have no means to re-identify.
device_id · site_idWhich instrument, at which site, under which enrolment.
input_hashThe exact artefact that was computed on.
algorithm_digestThe container that ran, identified by digest, not by version string.
model_versionCoefficients and thresholds as a first-class versioned artefact.
calibration_id · versionWhich signed calibration was in force at the moment of the run.
environment_fingerprintCPU family, runtime, numeric configuration.
capture_attestationDevice-attested, operator-asserted or transcribed — and where asserted, by whom.
compute_attestationSealed from raw, sealed from instrument intermediates, or instrument-computed.
run_ts · receipt_tsInstrument time and server receipt, kept distinct.
release_pathAutomatic or reviewed; if reviewed, by whom, under which credential.
delivery_receiptWhat reached whom, when, and whether it was acknowledged.

Identity, and what we never hold.

Pseudonymous by architecture, not by policy. The file carries an opaque accession token — the identifier your site already assigns. We treat it as a meaningless string; your system resolves it back to a patient. Because we hold no identifiers and have no means to re-identify, the compliance surface stays small even where the confidentiality bar is higher than HIPAA — substance use disorder records under 42 CFR Part 2, for instance.

On joining a result to a specimen. We never infer the join. Where an instrument cannot carry the identifier, a named operator asserts it and the assertion is recorded as such. Matching on time alone risks attributing a result to the wrong patient, and we do not do it.

And what we will not take on. The clinical claim and intended use. Analytical and clinical validation — the science is yours. The calibration values themselves; we host and serve the records, but the numbers are yours to determine and sign. Your patient identity workflow, which is why we never see PHI. And our own supplier qualification — you audit us, we supply evidence and answer questions, nothing further. A vendor who offers to take everything is telling you something about how carefully they have thought about it.