Medea
Medea is the clinical compliance module of the Swiss HubMed platform. It automates Clinical Evaluation Reports under EU MDR and IVDR, machine-reading PubMed and Embase through the PICO framework to cut literature work by 70%.
What is Medea?
Medea is the clinical compliance module of HubMed, a platform built by Hubmed Technologies GmbH in Lugano, Switzerland, and launched commercially on 21 June 2026. It runs as a cloud service reached through a browser, with nothing to install, and the launch release states that a free trial is included. HubMed's second module, Adam, covers preclinical molecule discovery and is still in development, so Medea is the part of the platform a buyer can actually use today.
The problem it attacks is what the vendor calls the fragmentation gap: clinical evidence scattered across documents, spreadsheets and shared folders, a literature review nobody can reproduce, and a technical file that only comes together under audit pressure. Medea replaces that with a single workflow built around one deliverable, the Clinical Evaluation Report required under EU MDR 2017/745 and IVDR.
Its method is named rather than hidden. Searches are framed as PICO questions, for Population, Intervention, Comparison and Outcome, so that criteria are fixed in advance and the search can be repeated by anyone, an auditor included. The engine machine-reads PubMed, Embase, MEDLINE and specialised databases following PRISMA and Cochrane protocols, then scores and weights what it retrieves. From there it produces the State of the Art analysis, maps evidence onto the Annex I General Safety and Performance Requirements, runs a completeness check against Annexes II and III, and maintains a traceability matrix, a locked version history and electronic signatures so any claim can be traced back to its source, its version and its appraisal criteria.
Regulatory coverage is unusually specific: Annex XIV equivalence arguments, the mandatory EUDAMED rollout, the supply interruption obligations of MDCG 2024-16, and legacy device transitions running to 2027 and 2029. The stated audience is Contract Research Organisations and manufacturers of Class IIa, IIb and III devices, extending to nutraceutical and cosmetic claim substantiation. HubMed puts the gain at 70% off the research phase of a CER, roughly 42 hours down to 12, and takes care to say that Medea amplifies regulatory expertise rather than replacing it.
What it does
- Automate the systematic literature review and State of the Art analysis behind a Clinical Evaluation Report
- Machine-read PubMed, Embase and MEDLINE through structured PICO queries
- Score and weight scientific evidence instead of merely summarising it
- Map clinical evidence onto the Annex I General Safety and Performance Requirements
- Run a pre-submission completeness check against Annex II and Annex III requirements
- Generate and export structured technical documentation ready for Notified Body review
- Watch new publications continuously and raise alerts when a CER needs updating
When to use Medea / When not to
A quick filter to help you decide if Medea is the right fit.
When to use Medea
- Contract Research Organisations turning out clinical evaluation reports at volume, from two CERs a month upwards
- Medical device manufacturers certifying Class IIa, IIb and III products under EU MDR
- Regulatory Affairs and Quality Assurance teams that own a technical file from literature search to submission
- Organisations managing legacy device transitions and the mandatory EUDAMED rollout
- Nutraceutical and cosmetic companies substantiating health claims with systematic literature evidence
When not to use Medea
- Pharmaceutical teams working to FDA pathways, since the product is built around EU MDR and IVDR
- Engineering teams hoping to embed clinical evidence workflows through an API, as none is documented
- Anyone who wants to sign up, see a price and start the same day, because every route runs through a sales conversation
- Teams looking for preclinical molecule discovery, which belongs to Adam, HubMed's other module and still in development
- Organisations with no in-house regulatory expertise, since Medea is positioned to amplify that expertise rather than supply it
How to use Medea
A typical end-to-end flow, from setup to results.
- Try the free two-minute CER maintenance calculator to size your current regulatory overhead
- Fill in the contact form, the only entry point, giving your sector among nutraceuticals, cosmetics, medical devices, CRO or other
- Take the free initial consultation, typically scheduled within 24 to 48 hours
- Discuss trial access to the Medea module and agree on commercial terms, since no price is published
- Go through scoping in the first two weeks, where your existing CER workflow is mapped and its bottlenecks identified
- Onboard your team, which the vendor puts at around two weeks
- Set up your PICO questions for the device or ingredient under evaluation
- Launch continuous literature surveillance across PubMed, Embase and MEDLINE, then appraise and weight the retrieved evidence
- Map the retained evidence onto the Annex I GSPRs and run the completeness check before submitting
- Generate and export the CER, then work the alerts as new publications land so the report stays current
Pros & Cons
Pros
- The methodology is named and checkable, PICO plus PRISMA and Cochrane, rather than an opaque summarisation engine
- Every claim in the report stays linked to its source, version and appraisal criteria, which is exactly what an auditor asks for
- Regulatory coverage is current and detailed, from Annex XIV equivalence to EUDAMED, MDCG 2024-16 and the 2027 and 2029 legacy transitions
- The savings claim is published with its full calculation, assumptions included, instead of a bare percentage
- Swiss jurisdiction and governance, with GDPR and the Swiss FADP claimed and encryption at rest and in transit
- A free trial is announced and the initial consultation costs nothing
- Short stated onboarding, around two weeks, with dedicated implementation support for Early Adopters
Cons
- No price is published anywhere: no pricing page, and the monthly subscription amount is never stated
- No terms and conditions at all, so data ownership, service levels, exit and termination are unknown before contracting
- No self-service and no online sign-up: everything starts with a sales conversation
- A very young product, launched commercially in June 2026 on a domain registered in December 2025, with no Wayback Machine history
- No API, no developer documentation and no named integration with an eQMS or document management system
- No external certification is claimed, neither SOC 2 nor ISO 27001 nor ISO 13485, and no DPA or subprocessor list is offered
- The site contradicts itself on the Early Adopter closing date and on the cost of a month of certification delay, so figures need written confirmation
Pricing & Plans
No price is public. There is no pricing page on the site, and the Explore Pricing button on the product page opens the same contact form as every other call to action. The vendor describes a monthly subscription and refers to a software licence in its ROI model, but never states the amount. A free trial is announced in the launch release and the initial consultation is free of charge; no permanent free plan is advertised. Early Adopters are promised permanent founding-partner pricing, again without a figure.
Data, GDPR & hosting
A consolidated view of how Medea handles your data.
GDPR overview
GDPR compliance is claimed in plain words, alongside the Swiss Federal Act on Data Protection. The privacy policy, version 1.0 last updated on 24 April 2026, names a Data Protection Officer reachable at privacy@hubmed.ch, sets out the legal bases relied on (contract, legitimate interest, and consent for functional and marketing cookies), and lists the full set of data subject rights, including the right to complain to a supervisory authority and to have a person review any solely automated decision. Transfers to countries without an adequate level of protection rely on Standard Contractual Clauses recognised by the Swiss FDPIC, or on the EU-U.S. Data Privacy Framework. Three concrete gaps remain: no Article 27 EU representative is designated although the company is Swiss, no Data Processing Agreement is mentioned, and no subprocessor list is published.
Who owns the data?
No terms and conditions are published anywhere on the site, so the question of who owns the clinical evidence and the reports you put into Medea is not settled by any contract you can read before signing. The privacy policy covers personal data only. It names Hubmed Technologies GmbH as controller, states that only authorised personnel have access, and allows disclosure to processors and service providers such as IT and cloud suppliers, to business partners such as lawyers and auditors, and to public authorities where the law requires it. Processors act solely on documented instructions and are bound by confidentiality. Everything else said about intellectual property, including the recurring secure vault wording, is product messaging rather than a contractual commitment.
Reuse rights
With no terms and conditions published, nothing tells you in advance what you may do with the material Medea produces, whether you may reuse it without asking, or what becomes of it once a subscription ends. On the product side the vendor is at least explicit that outputs leave the platform: the FAQ confirms that audit-ready documents can be exported directly, as structured documentation built to pass a Notified Body completeness check, alongside a traceability matrix, a locked version history and electronic signatures. Whether customer content is ever used to train models is never addressed, in either direction, and no opt-out is documented.
Data retention & training
Hosting summary
The privacy policy states that personal data is processed primarily in the European Economic Area or in Switzerland. Where data has to go to a country without an adequate level of protection, HubMed says it relies on Standard Contractual Clauses recognised by the Swiss Federal Data Protection and Information Commissioner, or on the EU-U.S. Data Privacy Framework. The controller is Hubmed Technologies GmbH, with a registered office at Via Lucino 28 in Breganzona and operations in Lugano. The security page adds that data sits in a vault environment meeting Swiss privacy standards on secure, high-performance infrastructure, with encryption at rest and in transit, access restrictions, pseudonymisation and logging. What is missing is specificity: no hosting provider, no data centre and no hosting country are named, no subprocessor list is published and no Data Processing Agreement is offered. One detail worth separating out: the hubmed.ch website itself resolves to an address in Belgium, which says nothing about where the application hosts customer data.
Things to keep in mind
Risks and trade-offs to weigh before adopting Medea.
- Treating an automated literature review as final: HubMed itself warns that in the life sciences an AI hallucination is a regulatory failure
- Skill fade in the review team, as the appraisal reflex weakens once screening and scoring are handled by the machine
- No terms and conditions are published, so ownership of the deliverables, service levels and reversibility remain unknown until a contract is signed
- No Data Processing Agreement and no subprocessor list, which makes documenting your own processing chain for an audit harder
- Highly sensitive intellectual property, clinical evidence and technical files, entrusted to a company launched in 2026
- The published savings rest on stated assumptions of 120 hours per CER, 40 euros an hour and two CERs a month, which will not match every organisation
- Potential lock-in: regulatory documentation produced in a tool with no API and no documented export format is hard to move elsewhere
Setup & Integrations
Technical difficulty
Technically undemanding. Medea is a cloud service reached through a browser with nothing to install, no API to wire up and no local deployment, and HubMed states that most teams are fully onboarded within two weeks, with dedicated implementation specialists for Early Adopters. The real effort is methodological rather than technical: framing sound PICO questions and calibrating the AI outputs to what your own Notified Body expects, which the Early Adopter programme handles as a distinct validation stage. There is no self-service access, so the work starts with a sales conversation.
Deployment
Integrations
Behind Medea
Social
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
What does Medea actually do?
Who is it built for?
How much time does it claim to save?
Which literature sources does it read?
How does it hold up in an audit?
What does it cost?
How long before a team is up and running?
Where is the data processed?
Is there an API or a mobile app?
How does Medea differ from Adam?
Should you pick Medea?
Medea is a narrow tool, and that is its strength. It does not promise to reinvent research; it takes one regulatory deliverable, the European Clinical Evaluation Report, and industrialises the part of it that eats the most hours. The method is stated openly rather than hidden behind an AI claim: PICO questions, PRISMA and Cochrane protocols, evidence scored and weighted, every conclusion traceable to a source and an appraisal criterion. For a Regulatory Affairs team that will have to defend its file in front of a Notified Body, that auditability matters more than raw automation. The regulatory coverage is genuinely current, down to EUDAMED, MDCG 2024-16 and the legacy transitions running to 2029. HubMed also does something rare by publishing its return-on-investment model in full, assumptions included, so the 16,344 euros of annual savings can be checked against your own volumes and hourly rates rather than taken on trust. The reservations are commercial rather than technical. There is no published price, no terms and conditions, no Data Processing Agreement, no subprocessor list and no external security certification: an unusual combination for a purchase in a regulated environment, where a compliance team is normally asked to document its own supply chain. The company is young, the domain was registered in December 2025, and the site contradicts itself on several dates and figures. None of that disqualifies the product, but it does mean the diligence has to happen in the sales conversation instead of on the website. Ask for the licence cost in writing, for a DPA, and for the export formats of your own technical file before you commit.
- Choosing a selection results in a full page refresh.
- Opens in a new window.