A European blood testing company tends to hit the same wall between its first thousand samples and its first enterprise contract. The product works and customers renew, but the operating meeting is now mostly about suppliers. A company whose product is blood testing has quietly become a systems integrator.
Each piece arrived for a good reason at a different moment, and none were designed to be one system. The integration cost never goes away, and it grows with every new market and panel.
The honest answer is that no single structure is correct. Building your own back end is right when the analysis is your intellectual property, when volume justifies a laboratory, or when your regulatory position depends on controlling the assay. Otherwise the choice is between contracting laboratories directly and buying the back end as one contract, and the deciding factor is rarely unit price. It is who carries the failure when a sample arrives haemolysed in a city where nobody on the payroll lives. Clinics adding bloodwork to an existing practice face a different question, covered in the guide to Diagnostics as a Service for clinics.
Which vendors does a blood testing company end up managing?
Vendor sprawl is easier to argue about once the components have names. Six turn up in almost every testing business.
- Accredited laboratory capacity. Somebody has to run the analysis under a recognised quality system. This piece cannot be improvised, and it is where the accreditation lives.
- Collection kits. Tubes, lancets, barcoded labels, stabilisers and instructions in every language you sell in. The laboratory validated its methods against specific collection materials, so changing a tube supplier is a laboratory question.
- Courier and cold chain. Samples degrade at different rates by analyte, so pickup windows, transport temperature and journey time shape the result even though none of them happen in a laboratory.
- Requisition and ordering. The order that ties a named person to a defined panel, generates the requisition and carries the barcode the laboratory matches to the tube.
- Result delivery and reporting. A PDF is a document. A structured payload with values, units, methods, ranges and flags is something a product can be built on.
- The data processing paperwork underneath it. Health data is a special category under Article 9 of the GDPR, so each component above needs a lawful basis, a processing agreement and a place on a sub-processor list.
Five suppliers means five renewal dates and five support queues, and the harder problem is geography, because a second market usually adds its own laboratory, courier and collection network.
Should you build the back end, contract laboratories directly or buy it?
Three structures are realistic, and the choice turns on where defensibility sits. If the assay is the product, own the laboratory. If the interpretation and the customer relationship are the product, a laboratory buys fixed costs in exchange for something you were never going to differentiate on.
Three ways to run a diagnostics back end| Model | What you own | What you carry | Where the risk sits |
|---|
| Build your own back end | The analysis itself, the assay menu, the instruments and the accreditation, because the accreditation follows the laboratory that runs the sample. | Capital equipment, qualified laboratory staff, an accreditation process, internal and external quality assurance, and a supply chain for reagents and consumables. | Entirely with you, and it is concentrated. A failed proficiency round, a key departure or a reagent shortage lands on the product directly, with no second source. |
|---|
| Contract laboratories directly | The commercial relationship with each laboratory and full visibility of unit prices per assay, which is the strongest reason operators choose this route. | One integration, one courier arrangement and one processing agreement per laboratory, multiplied by every specialty and every country you sell in. | Split across parties with no single owner. When a sample fails in transit, the laboratory, the courier and your own ordering step each have a defensible account of it. |
|---|
| Diagnostics back end partner | The customer, the brand, the pricing and the product surface. The partner is meant to be invisible to the person who bought the test. | One contract, one integration and one processing agreement, plus the discipline of reading a sub-processor list rather than negotiating with each supplier yourself. | Concentrated in one counterparty, which is easier to manage and harder to replace. Exit terms and data portability matter more here than unit price does. |
|---|
Two things the table cannot show. Direct contracts break down fastest on specialty modalities, because the laboratory running your routine chemistry rarely runs your sequencing, proteomics and microbiome work, so one contract becomes four. And a back end partner concentrates counterparty risk by design, priced in through exit terms and data portability rather than avoided.
Building is also right more often than vendors admit. Where the assay is proprietary, where no contract laboratory validates the panel, or where a regulator expects you to control the analytical process end to end, the fixed cost is the price of entry. The companion piece on diagnostics for digital health companies covers the engineering view.
What do IVDR and MDR change about what your software may say?
Two instruments govern this. Regulation (EU) 2017/745 covers medical devices generally, and Regulation (EU) 2017/746 covers in vitro diagnostic medical devices, meaning devices providing information by in vitro examination of specimens from the human body. Both definitions name software explicitly.
The commercial line is where a display layer becomes a device. Guidance MDCG 2019-11 sets out decision steps, and the third is the useful one: software performing an action on data beyond storage, archival, communication, simple search or lossless compression may be medical device software. The European association of notified bodies restated the point in 2025, saying software whose main purpose is collecting results from in vitro diagnostic devices and transmitting them without modification to a database or to healthcare providers is not itself an in vitro diagnostic medical device.
In practice, a portal rendering a validated result alongside the reference range the laboratory supplied is normally a display layer. A layer that combines markers into a score, infers a risk or tells the customer what to do next is doing something else. Document that boundary in the contract rather than assume it: name the manufacturer of any qualifying component, say who holds the technical documentation and post-market surveillance, and agree change control for features that approach the line.
The timeline is worth knowing precisely, because it has been amended twice. The IVDR has applied since 26 May 2022. Regulation (EU) 2022/112 staggered the transition for legacy devices and Regulation (EU) 2024/1860 of 13 June 2024 extended it again. Under the amended Article 110, legacy class D devices may be placed on the market until 31 December 2027, class C until 31 December 2028, and class B and class A sterile until 31 December 2029, conditional on an IVDR compliant quality management system by 26 May 2025 and a notified body application by 26 May 2025, 2026 or 2027 by class. The same regulation phased in Eudamed and added a duty to give notice when supply is interrupted, so oblige your laboratory to pass that notice on.
One more point belongs in any procurement conversation held in 2026. On 16 December 2025 the European Commission proposed targeted amendments to both regulations, intended to simplify the framework and ease the notified body bottleneck. That proposal is in the ordinary legislative procedure and adoption is not expected before 2027, so the rules described above are the ones in force today. A contract signed now should say plainly who carries the work if the classification rules move underneath it.
What does GDPR require once health data crosses a vendor boundary?
Article 9(1) makes data concerning health a special category and prohibits processing unless an exception in Article 9(2) applies. Article 9(4) then lets Member States add further conditions on health data, so a company selling in three European markets should not expect one answer.
Article 28 carries the operational load. A controller may use only processors offering sufficient guarantees, and processing must be governed by a written contract setting out the subject matter and duration, the nature and purpose, the type of personal data, the categories of data subjects, and the controller's obligations and rights. It must also stipulate documented instructions, confidentiality, the security measures required by Article 32, assistance with data subject requests, deletion or return of the data, and audit rights.
Sub-processors are where diligence usually stops too early. Article 28(2) bars a processor from engaging another without prior specific or general written authorisation, and under a general authorisation it must notify intended additions and allow an objection. Article 28(4) imposes the same obligations on the sub-processor, and the first processor stays fully liable if it fails. Any transfer outside the EEA falls under Chapter V, on the basis of adequacy under Article 45, safeguards under Article 46 or a derogation under Article 49. Onward transfers count, so a European hosting claim means little if a sub-processor in the support path sits elsewhere. Article 28(10) then treats a processor that determines the purposes and means of processing as a controller, so a partner using your customers' results for its own benchmarking is not processing on your instructions.
Who actually holds the laboratory accreditation?
Accreditation belongs to the laboratory that analyses the sample. It does not belong to the orchestration layer, the software or the brand on the report, and a partner implying otherwise is describing something that does not exist.
ISO 15189, titled Medical laboratories, requirements for quality and competence, is the international standard. The fourth edition was published in December 2022, replacing the 2012 edition and ISO 22870 on point of care testing, and it is applicable for recognising laboratory competence by users, regulators and accreditation bodies. In Germany, accreditation to DIN EN ISO 15189 is granted by DAkkS, the national accreditation body, which publishes a searchable database, so the claim is checkable.
RiliBÄK is the domestic layer. The Bundesärztekammer guideline sets basic quality management requirements in Part A and requirements for the quality of results in Part B. The version in force is RiliBÄK 2019 as last amended on 14 April 2023, with a further amendment adopted on 3 July 2025. Part B 1 requires one proficiency testing round per quarter, at every site, for each measurand where criteria are defined. Where a laboratory passes work outside the guideline's territorial scope, the commissioning laboratory must satisfy itself that the necessary competence and a comparable quality system are in place.
Which questions should you ask a back end partner before signing?
These separate a partner you can build on from one you will work around.
- Which laboratory runs each assay, under which accreditation body, and within which accredited scope? Accreditation covers defined procedures rather than a building, so ask for the scope document.
- Who is the manufacturer of any component that qualifies as a device? If nothing qualifies, ask which analysis produced that conclusion and whether it survives your roadmap.
- What does the result payload look like field by field? Values, units, method, reference range, flags and the analysing laboratory.
- Which sub-processors touch customer data, and what notice do we get before the list changes? A general authorisation without a workable notice period is a weak right to object.
- What happens on a bad day? Ask who contacts the customer after a haemolysed sample, who pays for the redraw, and how you hear first.
- What changes when we open a second country, and can we keep a laboratory of our own alongside yours? The answer shows whether you are buying infrastructure or one market's arrangement.
- What is the exit, and what do you do with our data that is not for us? Export format, identifier portability, notice period, and whether benchmarking or model training happens at all.
Where Aniva fits
Aniva provides the diagnostics layer as one contract: laboratory orchestration, kits and logistics, ordering and an API, white labelled result delivery, and the compliance framework around them. Aniva is not itself a laboratory. It orchestrates accredited partner laboratories, so the accreditation stays with the laboratory that runs the analysis. Partner laboratories include ZOTZ|KLIMAS, which holds the RiliBÄK and ISO 15189 coverage for the work it performs. Processing is EU native, with EU data storage.
The diagnostics platform overview covers the partner side, and the developer track covers the API surface.
The bottom line
A white label diagnostics back end is neither a laboratory nor a piece of software. It is a decision about where the integration work lives and who is accountable when a sample fails between a customer's arm and an analyser. Running it yourself keeps unit pricing visible and your operations team reconciling couriers. Buying it concentrates risk in one counterparty and returns engineering time to the product.
Three things belong in the contract rather than in an assumption: who holds the accreditation for each assay, who is the manufacturer of anything that qualifies as a device, and who appears on the sub-processor list. Companion pieces cover the same ground for supplement brands and wellness creators.
Frequently asked questions
Is a result portal a medical device under IVDR?
It depends what the software is intended to do. Guidance MDCG 2019-11 treats software doing no more than storage, archival, communication, simple search or lossless compression as outside the definition. Software that scores, infers or recommends is a different question, and the boundary belongs in the contract.
What are the current IVDR transition deadlines for legacy devices?
The IVDR has applied since 26 May 2022, and Regulation (EU) 2024/1860 extended the transition for legacy devices. Class D devices may be placed on the market until 31 December 2027, class C until 31 December 2028, and class B and class A sterile until 31 December 2029, subject to conditions.
Who holds the laboratory accreditation in a white label setup?
The laboratory that analyses the sample. ISO 15189 accreditation and RiliBÄK coverage sit with that laboratory, never with the orchestration layer, the software or the brand on the report. In Germany, DAkkS grants accreditation to DIN EN ISO 15189 and publishes a searchable database.
What has to be in the processing agreement with a diagnostics partner?
Article 28 of the GDPR requires a written contract covering subject matter and duration, nature and purpose, type of personal data and categories of data subjects, plus documented instructions, confidentiality, security measures, assistance with data subject rights, deletion or return, and audit rights.
When does building your own diagnostics back end make sense?
When the analysis itself is the intellectual property, when volume justifies the fixed cost of instruments, qualified staff and accreditation, or when the panel is unusual enough that no contract laboratory validates it. Where the product is the interpretation, a laboratory adds fixed costs.
This article is general commercial and regulatory information for operators of blood testing and preventive health companies in Europe. It is not legal, medical or tax advice, and it does not describe any diagnosis or treatment. Laboratory accreditation and reference ranges are held by the analysing laboratory, and the interpretation of any individual result remains with the treating clinician.
