Built to be checked.

Lävi Delta runs on-premise, inside the hospital network. Studies arrive over standard DICOM, are processed without operator interaction, and the results go back into the PACS workflow the department already has. In this intended deployment, no image data needs to leave the institution.

Fig. 1 — Deploymentschematic

The results are ordinary DICOM: SEG segmentation objects for candidate regions, secondary-capture overlay series, and a structured report. No proprietary viewer, no new workflow bolted onto the reading radiologist's day.

What ships is an integration and orchestration runtime for a clinical site's own infrastructure. It is not a sealed appliance, and we do not pretend deployment into a hospital is a one-command affair.

The pipeline picks out the series it needs from DICOM header evidence, vendor private tags included. When the evidence is not there, it stops with an explicit error instead of guessing — a wrong series accepted silently would be worse than no result, and the design treats it that way.

Processing covers longitudinal registration of the imaging pair, intra-session alignment of pre- and post-contrast series, and brain extraction with established, widely used tools.

Every run records what produced it: the registration method, the identity of the registration policy, hashes of the actual inputs, the transform, the execution environment. All of it is bound to the exported artefacts, so any result can be traced back — months later, by someone else — to exactly the run that made it.

Where determinism can be claimed, it is exact: the same input reproduces the same result, and changing any registration parameter changes the recorded policy identity. Where it is only bounded, we characterise it as bounded. There is no blanket "same input, same output" sentence in our documentation, and there will not be one here.

Above all of this sits one principle: anatomical correspondence is never inferred from a method name. A converged registration is a recorded fact, not proof that the anatomy corresponds. Where correspondence is unsupported, that lane abstains.

Each candidate region carries its location, its volume and its direction of change. New or growing change and resolving change run in separate ranked lanes — they mean different things at the reading station and deserve separate attention.

Candidates are ordered by review priority and put in front of the reading radiologist, who accepts or rejects each one. The software works at the level of image regions: it does not count lesions, does not match lesions between visits, does not classify disease, and makes no diagnostic decision.

Before anything is reported, the quality-control logic asks whether the longitudinal comparison meets its own prerequisites, and grades the answer: report, report with caution, or refuse to report the comparison at all. Abstention is a first-class output. When the comparison cannot be trusted, the reader gets that statement — not a number of unknown reliability.

To be precise about what this is and is not: it does not guarantee that every unreliable result is caught. It means the system's prerequisites are checked explicitly, and longitudinal output that fails them is withheld, with the refusal itself reported to the reader.

Lävi Delta is developed under a documented software lifecycle (IEC 62304, Class B), with an ISO 14971 risk file, a requirements specification, traceability from every requirement to its tests, a controlled-document set and a change log.

The part we actually trust is that the traceability is machine-checked. Automated guards fail the build when a requirement cites a test that does not exist or cannot be collected, when a controlled record is malformed, or when a controlled document has drifted away from the shipped code. We added those guards after our own audits turned up traceability rows that did not hold. Once was enough; now the build refuses.

Behind it runs a large automated test suite, executed continuously across multiple runtime versions.

The full producer-to-reader chain has been executed against a full production-form deployment of the pipeline, image store and reader workstation — not simulated, and not a routine clinical deployment at a hospital site. A committed pipeline run was exported as a hash-bound case package, delivered into the image store, ingested by the reader workstation, and presented to the reader from the authoritative package manifest and nothing else.

Fig. 2 — The verified chainexecuted in a production-form deployment

The negative path got the same treatment: cases the pipeline rejects are rejected by the whole chain, not silently passed through.

For the planned reader study there is a dedicated browser-based reader workstation, already deployed — a pinned open-source medical imaging viewer over a standard image store, behind a proxy that knows which study phase it is serving.

It carries role-based access with two-factor authentication, the blinding gate between study arms, washout enforcement, structured reader response capture, an audit trail and a results export. All of it implemented and tested today — because a reader study should not have to wait for its own furniture.

Lävi Delta is under development. It is not CE-marked, is not available for sale, and must not be used for clinical decision-making. Information on this site describes a product in development and its planned evaluation, not the performance of a marketed medical device.

There is no released partner-facing integration interface today, and we will not pretend otherwise. What is true: the analytical architecture is modular — components can be replaced or developed independently by design — and a formal partner-facing integration interface is development intent, not a current capability.

Conversations with research and technology partners about future model and component integration are welcome: write about research collaboration.