Clinical safety

What this software must never be allowed to do

A platform that automates most of the work around a radiation-oncology case has to be explicit about the small number of things it must never do, and about how those limits are enforced rather than merely intended.

Permanently prohibited

Creating a diagnosis from imaging alone and presenting it as confirmed.
Selecting or changing a prescription without a radiation oncologist.
Writing to a live clinical plan.
Bypassing planning-system permissions, approval states, machine interlocks or record-and-verify controls.
Sending patient data to an unapproved external service.
Learning from live clinical feedback and silently changing production behaviour.
Hiding disagreement, uncertainty, missing data, unsupported claims or failed checks.

Intended use, as currently drafted

This statement is under regulatory review and will change. It is published because a clinic cannot evaluate a claim it cannot see.

VerityRT Copilot is a clinician-facing software platform that retrieves and summarises treatment-planning data, applies institution-approved deterministic checks, highlights potentially inconsistent or unusual findings, retrieves supporting evidence, and generates draft documentation for review by qualified radiation-oncology professionals. It does not independently diagnose disease, prescribe radiation, approve contours or plans, calculate the clinically authoritative dose, or authorise treatment delivery.

Software that analyses medical images, or that supplies outputs a clinician cannot independently review, is especially likely to require device analysis. VerityRT has not completed that pathway. No claim of clearance, authorisation or clinical validation is made anywhere on this site or in the application.

Why a whole-body scan is not a diagnosis

The most tempting claim in this category is the one we refuse to make.

In most cases a biopsy is needed to be certain that cancer is present, and pathology may also supply tumour type, grade, biomarkers and treatment-relevant information. Imaging AI can detect and segment a suspicious finding, propose a differential, identify missing workup and assemble evidence. It cannot convert an unconfirmed finding into a confirmed diagnosis, and this platform will not present one as though it had.

The platform may say: imaging contains a suspicious lesion and pathology confirmation is not present. It will not say: the patient has cancer X, when the record does not support that conclusion.

Stop conditions

The orchestrator halts or escalates, rather than continuing on partial information, when any of these is true.

Patient identity or laterality conflicts across records.
Required pathology, diagnosis or prescription is missing.
Image orientation, registration or structure reference is inconsistent.
A model input falls outside the validated modality, scanner, acquisition, anatomy or population.
A knowledge source is expired, unapproved or contradictory.
A critical deterministic check fails.
A required human approval is missing.
A model or service version differs from the commissioned version.
The planning-system interface was upgraded without regression testing.
Audit logging or time synchronisation fails.
A security or patient-data policy is violated.

Design choices that resist automation bias

Never colour alone: Every severity carries an icon and a word as well as a colour. A clinician with a colour-vision difference, or a poor monitor, reads the same state.
Separate observation from inference: Each finding states what was observed, what was inferred from it, and what is recommended, as three distinct lines. Blurring them is how a suggestion becomes a fact.
Critical findings resist bulk action: A bundle is offered only for low-risk open findings with no unresolved disagreement. Anything withheld is listed with the reason.
Show disagreement: Where the generating agent and the independent checker differ, both positions and both methods are shown. Averaging two clinical conclusions would be the worst possible answer.
Abstention is a result: An agent that cannot answer says so and stops. Returning a plausible answer to an unanswerable question is treated as a failure, not a fallback.
Measure the alert burden: Acceptance rate is reported alongside edit and rejection rates. A high acceptance rate on its own may be a sign of automation bias rather than quality.

Verification programme

Deterministic layers: Unit tests for every rule and calculation. Property and boundary tests for units, coordinate systems, dose scaling, orientation and laterality.
Interchange: DICOM conformance and malformed-input tests. Version-upgrade regression tests against the planning-system interface.
Golden cases: Synthetic and de-identified cases with known expected results, run on every change.
Cross-implementation: Critical metrics recomputed by a separate implementation, with any difference surfaced rather than reconciled.
Model evaluation: Locked test sets, subgroup thresholds, external-institution evaluation, then a prospective silent-mode pilot that influences no care.
Human factors: Workflow simulation and usability testing, because a correct finding presented badly is still a hazard.