AliveCor

The hardware exists because the artificial intelligence works, which is a stronger dependency than most records granted this grade.

The design point is the reduced leadset. Kardia 12L uses a single cable and five electrodes to acquire eight diagnostic bandwidth leads, and KAI 12L interprets a full 12 lead study from that reduced input. A conventional 12 lead machine places ten electrodes and needs no model to produce its tracing. This device is pocket sized precisely because the model compensates for what the hardware does not capture, so remove the artificial intelligence and the physical product is not a lesser version of itself, it is a device that cannot produce the study it exists to produce.

The cleared scope confirms where the value sits. Thirty nine determinations across arrhythmias and morphologies, including acute myocardial infarction and common cardiac ischemia, are all model outputs, and the company obtained dual clearance in 2024 for the artificial intelligence and the device as separate items. Clearing the algorithm in its own right, and stating that it can integrate with other compatible devices, establishes the model as a product rather than a feature.

The company describes itself as transforming cardiology using medical grade artificial intelligence and its capability announcements are algorithm clearances rather than hardware releases, which is what a model business looks like from the outside.

Graded A.

The clinical product is correctly bounded and one specific determination raises an oversight question the company does not address.

The general framing is right. The system returns determinations to a clinician who interprets them alongside the tracing and the patient, and the company positions the technology as putting capability into the hands of clinicians rather than replacing their judgement. A 12 lead electrocardiogram is read by a physician as a matter of routine practice, so the human review step is built into how the artefact is used.

The question is myocardial infarction detection from a reduced leadset. This is the first cleared artificial intelligence to make that determination, the underlying input is eight acquired leads rather than twelve placed ones, and the clinical consequence of the output runs in both directions: a missed infarction delays reperfusion, and a false positive activates a catheterisation laboratory. In acute settings the determination may be acted on quickly and by staff who are not cardiologists, which is precisely the access gap the portability is designed to fill. Nothing published describes confidence reporting, what the system does with borderline cases, whether a conventional 12 lead confirmation is recommended before acting, or what guidance accompanies an infarction determination.

The consumer line carries a different version. Personal devices return determinations directly to patients with no clinician in the loop, and nothing describes what a patient is told to do with an abnormal result.

Graded C: a reasonable position in ordinary use, with the highest stakes determination undocumented on exactly the point that matters.

Architecture, training scale and cleared scope are all stated concretely, with performance figures absent.

The technical description is specific rather than promotional. Multiple deep neural network algorithms, not one model, trained and validated on more than 1.75 million electrocardiograms from leading United States medical centres. The acquisition design is described exactly: a single cable and five electrodes producing eight diagnostic bandwidth leads, from which a 12 lead interpretation is derived. Every cleared determination is enumerated rather than summarised, and the January 2026 additions are named individually down to short PR interval and the two axis deviations. A reader knows precisely what the system claims to detect.

Versioning is unusually visible for this index, because clearances mark generations. The company refers to the next generation of KAI 12L, so a clinician can in principle establish which version their system runs and what it was cleared to determine.

What is missing is performance. No sensitivity, specificity or predictive value figures were located for any of the 39 determinations, and for a diagnostic that identifies myocardial infarction those numbers are what a clinician needs in order to know how much weight to place on a negative result. The regulatory summaries will contain them and the company does not surface them.

Also absent is any description of how the model reconstructs or infers the leads not directly acquired, which is the central technical claim of the product.

Graded B.

Training scale and source category are stated, model composition is described, and the specifics behind both are not.

What is disclosed is better than most. The system is characterised as multiple deep neural network algorithms rather than a single model, which tells a reader the architecture is an ensemble and that different determinations may be produced by different components. Training and validation data is quantified at more than 1.75 million electrocardiograms and attributed to leading United States medical centres, so both scale and source type are on the record.

What is missing is provenance in the strict sense. No institutions are named, no data use agreements are described, and nothing states whether the corpus was licensed, collected through research collaborations or assembled another way. For a company whose competitive position rests on that corpus, its origin is a fair question.

On components nothing is acknowledged. No framework, no pretrained model, no third party signal processing library and no infrastructure provider is named for either the clinical or the consumer line, and no bill of materials exists for the device firmware.

One structural fact works in the company's favour and is worth crediting. The algorithm holds its own clearance separate from the device and is stated to integrate with other compatible hardware, so the boundary between model and instrument is drawn explicitly rather than left implicit, which makes the supply chain easier to reason about even where its contents are undisclosed.

Graded C.

Substantial regulatory validation and real deployment numbers, with a thinner independent literature than the neighbouring iRhythm record.

The regulatory evidence is the anchor and it is not trivial. Thirty nine cleared determinations means each was substantiated to the regulator, and clearance for detecting acute myocardial infarction from a reduced leadset required demonstrating that a model can identify a life threatening condition from incomplete input. The training and validation base is stated at more than 1.75 million electrocardiograms from leading United States medical centres, which is a specific and large number with its provenance category named.

The peer reviewed element is real but narrow. A study in Heart Rhythm O2 found the system reduced acquisition time by 29 percent, which is a workflow result rather than a diagnostic accuracy result, and it is the only independent publication located.

Deployment evidence is the strongest practical signal. More than 250 clinical practices in the United States since a June 2024 launch, expansion into India, Australia and New Zealand, use on tens of thousands of patients, and identification of more than 4,000 cases of myocardial infarction and ischemia. Medicare payment approval in hospital outpatient settings in 2025 is independent validation of a different kind, since a payer establishing reimbursement has made its own assessment of clinical value.

What is missing is published diagnostic performance. No sensitivity or specificity figures for any of the 39 determinations were located outside the regulatory record, and no independent accuracy study was found. The 4,000 identified cases figure is a count of detections rather than a measure of how many were missed.

Graded B.

The training corpus is quantified and sourced by category, which is more than most, and the terms under which it was assembled are not described.

What is stated: KAI 12L employs multiple deep neural network algorithms trained and validated on more than 1.75 million electrocardiograms from leading United States medical centres. Naming both the scale and the type of source institution is a meaningful disclosure, and specifying that the corpus served validation as well as training is a distinction many vendors blur.

What is absent is the governance. No source institutions are named, no data use agreements are described, no de identification standard is stated, and no consent or research authorisation basis is given for recordings that originated as clinical care at academic centres and became training material for a commercial model. That is the same gap identified on several records in this session and it is more visible here because the number is so precise.

The consumer product line raises a second and distinct question. Individuals recording their own electrocardiograms on personal devices generate data governed by consumer privacy law rather than health privacy law, and consumer health data is a category where secondary use and sharing practices vary widely. Nothing published states whether consumer recordings are retained, whether they inform model development, or whether users are told either way. Given the company has both a large consumer install base and an appetite for training data, that is the question a privacy conscious reader would ask first.

Graded C on the strength of the quantified training disclosure, with both governance questions open.

No published position was located, and this record has a data governance shape no other in the index shares.

The complication is that the company operates on both sides of the health privacy statute's boundary. Personal devices sold directly to consumers generate electrocardiograms that are not protected health information at all, because a patient recording their own rhythm outside a clinical relationship falls outside the statute and into general consumer privacy law. The same company's clinical products generate recordings inside a provider relationship that are unambiguously protected. So identical physiological data is governed differently depending on which product produced it, and nothing published explains how the company distinguishes, stores or handles the two classes.

That matters practically. A consumer who later shares recordings with a physician, or a practice that supplies personal devices to patients for home monitoring, moves data across that boundary, and nothing describes what happens when they do.

On the clinical side no business associate agreement is offered or described, no protected data handling summary exists and no retention position is stated. On the consumer side no privacy summary was located in what was examined.

The training corpus adds a further question. More than 1.75 million electrocardiograms from leading United States medical centres were used for training and validation, and nothing describes the agreements, de identification standard or consent basis under which recordings moved from those institutions to the company.

The international footprint across India, Australia, New Zealand and Europe brings further regimes with no position stated.

Graded D.

No published security posture was located. No trust centre, no service organisation control report, no information security management certification, no penetration testing statement, no vulnerability disclosure policy, no subprocessor list and no incident notification commitment were found.

The attack surface here is wider than for a clinic only vendor and includes a consumer element most records in this index do not have. Personal devices pair over wireless connections to patient owned smartphones running a consumer application, and connected consumer medical devices have a well documented history of pairing, firmware and companion application weaknesses. Regulators have issued specific guidance on exactly this class of product.

On the clinical side the system operates in acute settings, integrates with other compatible devices under the algorithm's separate clearance, and delivers determinations that inform urgent treatment decisions, all of which raise the consequence of compromise.

Regulatory clearance across multiple jurisdictions means premarket cybersecurity documentation exists in the technical files, since connected device cybersecurity is now a standing expectation in United States submissions and equivalent requirements apply elsewhere. That material is assessed by regulators and is not published for customers.

The pattern is by now familiar across this session and it is worth stating once more in the cardiac context: a company whose devices are deployed in more than 250 practices and sold to consumers at scale has satisfied a great many reviews and publishes none of the resulting assurance.

Graded D on published evidence rather than on any judgement about the underlying engineering.

The deepest single system clearance record in this index, built through repeated submissions rather than one authorisation stretched over time.

The scope is the substance. Thirty nine cleared cardiac determinations for one artificial intelligence system, comprising 14 arrhythmias and a wide morphology set, each substantiated to the regulator. The trajectory is documented: dual clearance in June 2024 covering both the KAI 12L algorithm and the Kardia 12L device with 35 determinations, then a further clearance in January 2026 adding short PR interval, atrial bigeminy, ventricular bigeminy, left axis deviation and right axis deviation to reach 39. A company returning to the regulator to add five specific determinations is doing regulatory work properly rather than marketing an existing clearance more broadly.

The myocardial infarction clearance is the notable first, described as the first cleared artificial intelligence capable of detecting a heart attack from a reduced leadset. Clearing a model to identify a life threatening condition from incomplete input is a materially harder submission than clearing rhythm classification.

Clearing the algorithm separately from the device is also worth noting, because it means the artificial intelligence is authorised as a product in its own right and can integrate with other compatible devices under that clearance.

The wider consumer line rests on its own cleared status, and international expansion into India, Australia and New Zealand implies further registrations, with European review stated as ongoing.

Graded A.

Nothing was located. No model card, no training population composition, no performance figures by subgroup and no bias statement.

The exposure has two specific mechanisms here and both matter more than the generic version.

The first is signal acquisition. This is a reduced leadset device using five electrodes and a single cable, and electrocardiographic signal quality depends on electrode contact, which varies with body habitus, chest hair, breast tissue and skin condition. A conventional twelve electrode placement has redundancy that a five electrode arrangement does not, so where signal quality degrades, the model has less to work with and more to infer. Nothing published examines whether determination accuracy varies across body types.

The second is the training population. More than 1.75 million electrocardiograms from leading United States medical centres is a large corpus and academic medical centre populations are not the populations this device is being deployed into. The company markets portability into restricted and unconventional settings, has expanded into India, Australia and New Zealand, and sells consumer devices used at home. Electrocardiographic normal ranges and morphology vary by sex, age and ancestry, and a model trained on United States academic centre data and deployed in India is generalising across exactly those variables with no published evidence that it holds.

The stakes make the silence harder. A model determining myocardial infarction that performs unevenly across sexes would replicate a documented and long standing failure in cardiac care, where infarction presentation in women is more often missed.

Graded D.

No published liability position, and the regulatory framework carries more weight here than on most records because of what the system is cleared to determine.

Clearance establishes an accountable manufacturer under device regulation with post market surveillance, adverse event reporting and recall powers attached, and 39 determinations means each cleared claim sits inside that framework. For a clinician, a cleared determination has a defined intended use and known regulatory oversight, which is a stronger position than a contractual warranty.

The exposure that regulation does not resolve is specific to the myocardial infarction claim. A false negative on an infarction determination in an acute setting can mean a patient is not escalated, and the harm is immediate and severe. A false positive activates resources and exposes a patient to unnecessary intervention. This is the highest consequence artificial intelligence output assessed in this session, and nothing published states accuracy commitments, indemnity, limitation, or what guidance accompanies reliance on a negative result in a symptomatic patient.

The consumer line raises a different and unaddressed question. Personal devices return determinations directly to patients with no clinician in the loop, so a patient may be reassured by a normal result or alarmed by an abnormal one and act accordingly, and nothing describes what responsibility attaches to that.

The reduced leadset design adds a further consideration a buyer should understand: the system infers what a conventional twelve electrode placement would have recorded, and nothing states how a clinician should weigh a determination when acquisition conditions were poor.

Graded C.

One genuine interoperability property is documented and the clinical systems integration is not described.

The documented property is device independence. The company states that KAI 12L can integrate with compatible devices beyond its own Kardia 12L system, and the algorithm holds its own clearance separate from the hardware, which makes that a regulatory reality rather than a marketing aspiration. An artificial intelligence cleared in its own right and able to run on other manufacturers' acquisition hardware is a meaningful form of openness and it is rare.

The reimbursement position implies a second kind of integration, since a service billed under Medicare in hospital outpatient settings must produce documentation that reaches the record and the claim.

What is absent is everything about clinical systems. No electronic health record is named, no interoperability standard is cited, no application programming interface is published, and nothing describes how a completed study and its determinations reach the patient chart, whether as a document, discrete coded results, or a standard electrocardiographic format. For a device whose selling point is deployment in unconventional settings, how the study gets back into the record from those settings is the practical question and it is unaddressed.

The consumer line raises the same gap from the other direction, with nothing describing how a patient's own recordings reach their physician.

Graded C.

Nothing published on hosting, region or residency, on a product line that spans consumer phones and clinical settings across four countries.

The architecture is partly inferable and nowhere confirmed. Personal devices pair with a patient's own smartphone, so recording and initial processing happen on consumer hardware the company does not control, and recordings are typically synchronised to a cloud account. The clinical system produces studies that must reach a clinician and a record, which implies vendor infrastructure between acquisition and delivery. Where the artificial intelligence executes, on the device, on the phone or in a cloud service, is not stated for either line, and it is the question that determines everything else.

No hosting provider, region, residency option, subprocessor list, retention position or export term was located.

The international footprint makes this concrete rather than theoretical. The clinical system is live in India, Australia and New Zealand with European review ongoing, and India's data protection law carries localisation expectations for health data while European transfer rules apply once that review completes. A company selling into four jurisdictions with no published residency position leaves each buyer to establish it separately.

The consumer line adds a further wrinkle. Personal health data held in consumer cloud accounts sits outside health privacy protection in most of these markets, so residency and retention are governed by consumer terms nobody has described here.

Availability deserves a brief note: for a device used to detect myocardial infarction in acute settings, any dependence on connectivity for analysis is operationally material, and nothing states whether determinations require it.

Graded D.

The most commercially legible cardiac record in this index, and the reason is that this company sells to consumers as well as to clinicians.

The personal electrocardiogram devices are retail products with published prices, bought directly by patients without a prescription, so a substantial part of the catalogue has a visible price in a way essentially nothing else in this index does. That establishes a baseline a buyer can reason from even for the clinical products.

The reimbursement position is also disclosed and it is the number that matters most for the professional line. The company states that the Centers for Medicare and Medicaid Services approved Medicare payment for Kardia 12L in hospital outpatient settings in 2025, following establishment of the underlying code. For a diagnostic device, published reimbursement is more useful than a list price, because it tells a practice what it will be paid rather than only what it will pay, and both sides of that calculation are needed to evaluate the purchase.

A purchasing route for the clinical system is published for healthcare providers, so the path to a quote exists rather than being buried behind a contact form.

What is not published is the professional side pricing itself: no device cost for Kardia 12L, no per study or software cost for the artificial intelligence, no service or subscription terms and no volume arrangements. Whether KAI 12L carries a separate licence when integrated with other compatible devices, which the company says it can be, is also unstated.

Graded B, the highest commercial transparency grade of this session.

Coverage runs from a patient's kitchen table to an acute clinical setting, which no other record in this index spans.

The consumer end is genuine rather than nominal. Personal electrocardiogram devices are cleared for individuals to record their own rhythm without a clinician present, which places the technology in homes, and the company describes its purpose as empowering patients as well as physicians.

The clinical end is where the current product sits and its portability is the coverage argument. A pocket sized 12 lead system with a single cable can be deployed, in the company's framing, in restricted or unconventional care settings where a conventional machine cannot go: ambulances, rural clinics, care homes, field settings and crowded departments. Conventional 12 lead machines are the standard of care and their availability is limited by size and complexity, which is precisely the access gap this addresses.

Clinical breadth is the largest of any single system here, with 39 determinations spanning 14 arrhythmias and a wide morphology set including acute myocardial infarction, cardiac ischemia, axis deviations and conduction intervals. That is close to the full range a general 12 lead interpretation would cover.

Geographic coverage is documented and expanding: United States clearance with more than 250 practices, live in India, Australia and New Zealand, European regulatory review ongoing, and a separate product launched in Europe in 2024.

Graded A.