Platform documentation.

Product library

Product documentation.

Explore product documentation, planned workflows, and current scope, alongside a brief introduction to AcuveriQ’s research direction.

01 Platform model

Compute and execution profile

NEXQ’s documented compute profile identifies NVIDIA GPUs and Pasqal quantum computing systems for model development, training, and benchmark orchestration. It describes workload routing by task profile, queue health, and validation requirements.

Confirm the resources and routing available to a specific deployment against its approved architecture and validation records. Third-party names do not imply endorsement, sponsorship, or partnership.

Website and workspace

The public website provides product, research, documentation, article, and contact pages. The protected workspace uses authenticated, role-gated access.

Web application

Next.js, React, and a Node.js runtime, with Vercel deployment tooling and a guarded release script.

Mobile tooling

Optional Capacitor shells and an Expo wrapper support workspace testing and packaging.

Reference: Original NEXQ platform description

Reference: Application overview

Reference: Mobile packaging guide

02 Program statement

Research scope and intended use

NEXQ’s program statement describes NEXQ and LuxLeaf AI developing a research-stage, PACS-oriented web and mobile workflow concept for imaging review, 3D segmentation research, and professional collaboration.

The scope includes review of patient imaging and relevant clinical context, discussion of diagnosis-support and care-pathway information, and authorized handoffs between professionals. Hospital evaluations must account for EHR and PACS integration, procurement, patient access, and coordination between care teams.

Outputs are review-support materials and require qualified professional review. Clinical use requires intended-use assessment, institutional governance, and any applicable regulatory authorization. Human review alone does not establish that software falls outside medical-device regulation.

Claims of a completed security review, world-first capability, full quantum encryption, FDA authorization, clinical validation, or production readiness require evidence specific to the release and intended use.

Public documentation excludes non-public architecture, cryptographic implementation details, model internals, and proprietary pipeline design.

Reference: Original NEXQ program statement

References: NEXQ program and deployment guidance; Healthtech Policy; FDA clinical decision support guidance.

03 Compliance

Compliance and legal requirements

Determine which privacy, healthcare, and contractual obligations apply to the proposed deployment. The requirements below must be addressed through technical controls, operating procedures, and accountable review.

HIPAA privacy and security

Where HIPAA applies, document role-based access, minimum-necessary handling where required, audit controls, and authorized use and disclosure of protected health information. Assess the safeguards required for the deployment.

GDPR data handling

Where GDPR applies, establish controller and processor responsibilities, a lawful basis and any required condition for processing health data, and procedures for access, correction, retention, and deletion requests. Rights and retention decisions remain subject to applicable conditions and exceptions.

Clinical and medical use

Outputs require qualified professional review. Assess the intended use of each function and obtain any required regulatory authorization before clinical reliance.

Contracts and governance

Production onboarding requires applicable contractual controls, security review, approved access scopes, and institution-specific legal acceptance.

Legal references: HHS Security Rule summary; HHS minimum-necessary guidance; GDPR Articles 5–6, 9, 15–17, 28, and 32.

04 Security controls

Access, transport, and audit controls

The application also includes request identifiers, response security headers, API rate-limit handling, and a minimal public health response with restricted detailed diagnostics. These features support application operations; they do not establish complete audit coverage or deployment approval.

Reference: Authentication and session handling

Reference: Monitoring documentation

Policy reference: Trust and Security Policy.

05 Deployment requirements

Production deployment controls

NEXQ’s documented deployment baseline includes the following controls. Technical choices such as TLS versions are NEXQ requirements to verify for the environment, rather than a statement of a universal legal minimum.

• TLS 1.3 where feasible; TLS 1.2 is the minimum for a documented, risk-accepted exception. Use approved cipher suites, HSTS, certificate lifecycle management, and strict origin controls.
• Authenticated, role-scoped access with session timeouts and forced re-authentication handling.
• Audit logging for sign-ins, protected-route and data access, access changes, sensitive workflow actions, and export activity.
• Documented data-retention periods, deletion responsibilities, and applicable legal holds.
• An incident response process with defined escalation contacts and notification responsibilities.
• Named owners for applicable HIPAA, GDPR, and institutional requirements, with governance sign-off.
• Ongoing monitoring of uptime, latency, and security configuration drift.

Keep credentials outside source control, separate development and production environments, and restrict privileged access. Complete the route, build, workspace, and authentication checks, then evaluate load, latency, TLS, and health results for the target environment before release.

Reference: NEXQ deployment requirements.

Reference: Environment setup and guarded release workflow

06 Governance

Clinical, legal, and disclosure responsibilities

Organizations evaluating NEXQ must establish responsibility for clinical governance, legal review, and policy adoption in their jurisdiction.

• Designate a compliance owner and incident commander before production release.
• Define approved use boundaries for diagnostics, oncology, cardiovascular, and optimization workflows.
• Establish retention and deletion controls that reflect legal and contractual requirements.
• Require qualified human review for medical and operational decisions affecting patient care.
• Publish accurate client-facing notices and obtain organization-level legal acceptance.

Policy references: Healthtech Policy; Incident Response Policy; Records Retention and Deletion Policy.

07 Legal controls

Agreements and operational controls

Where HIPAA requires a business associate agreement (BAA), have it in place before NEXQ handles protected health information as a business associate or subcontractor. This applies to evaluations and pilots involving that information as well as production use.

Where GDPR applies to processing on behalf of a controller, put the binding terms required by Article 28 in place, including the applicable authorization for subprocessors. A data processing agreement (DPA) and a BAA address different obligations; determine which is required for the relationship.

• Complete applicable order forms, security schedules, data-processing terms, and subprocessor approvals before regulated data is handled.
• Use least-privilege provisioning, review access roles, and document access recertification intervals.
• Document incident and breach escalation, including legal and compliance ownership of notification decisions and applicable deadlines.
• Maintain change-control records for security-impacting releases, including rollback plans and evidence-retention requirements.
• Provide notices and obtain required acknowledgements for forced logout, interruption risk, and human clinical review responsibilities.
• Confirm licensing permission before implementation, internal forks, or redistribution of protected materials.

Retention schedules and legal holds must be reconciled with applicable privacy rights. A deletion request does not override every legal retention obligation, and retaining data requires a documented basis.

Legal references: HHS business associate contracts; GDPR Articles 17 and 28. NEXQ references: Healthcare Privacy Policy; repository license.

08 Policy lifecycle

Policy review and publication

• Obtain legal, security, and operations owner review and the required sign-offs before publishing policy revisions.
• Use the eight-pass consistency and integration review specified in NEXQ’s documentation for major documentation and policy updates, recording findings and required approvals before publication. The bundle’s existing review log describes a simulated review, not a legal opinion or independent security audit.
• Exclude confidential cryptographic, model, and infrastructure details from public policy statements.
• Record effective dates and revision history, and update linked references across privacy notices, documentation, and workspace notices when material changes require it.

Reference: Documented publication requirements

Policy text must match actual data flows, controls, vendors, contracts, and operating practices. The bundle identifies its files as templates requiring factual validation and legal review before adoption.

• Legal Policy Center
• Bundle instructions
• Eight-pass review record
• Bundle verification report
• Checksums
• Date attestation

09 IP and licensing

Intellectual property and permitted use

TumorQ, LiMiQ, HeartQ, and related materials remain proprietary to NEXQ and/or their respective licensors unless specific written terms state otherwise. Third-party logos, names, trademarks, service marks, and brand assets remain the property of their owners.

Website, documentation, API, or workspace access does not itself grant an implied license or transfer ownership. Permitted use remains subject to written authorization, applicable law, executed agreements, and release controls.

The repository uses the NEXQ proprietary license, version 1.1, effective March 28, 2026. Copying, modification, internal forks, and redistribution require the permissions specified in the license and any controlling written agreement.

Reference: Full repository license

Related reference: Privacy Policy.

10 Operations

Operational requirements and support

Infrastructure

Identify approved compute resources in the deployment’s architecture records. Vendor and technology references do not establish endorsement or partnership.

Reliability

Define latency targets, behavior during service degradation, and guarded release checks. Verify monitoring, fallback procedures, and recovery expectations for the deployment.

Verification

Use the provided application checks, load and latency tools, and health endpoint to collect environment-specific evidence. A health response alone does not establish end-to-end readiness.

Reporting

Report security or privacy concerns through official NEXQ contact channels. Send security findings privately to hello@nexq.us.

Public documentation

Explain requirements and operating responsibilities without disclosing credentials, proprietary implementation details, or private operational procedures.

• Encryption program
• Contact NEXQ

Reference: Verification tooling and responsible disclosure