Caristo Diagnostics

The AI is the flagship; the portfolio carries value without it. CaRi-Heart uses AI to measure inflammation-related change in the fat around the coronary arteries (the FAI-Score) and to produce the CaRi-Heart Risk score, a 10 year estimate of cardiac mortality risk, which cannot be read from a scan by eye.

Beside it, CaRi-Plaque quantifies plaque and stenosis, and its 510(k) summary (K242240) says it uses threshold-based segmentation, with trained operators defining and correcting vessels, rather than machine learning. Caristo also sells imaging core lab work for drug trials. AI is central to a broader offering that would still carry value without it.

The limits, the human step and the correction path are all published. Caristo's openly posted Instructions for Use (version 2.10) say CaRi-Heart reports are not a primary means of diagnosis, do not replace the standard CCTA report or cover incidental findings, and must be interpreted by a healthcare professional who keeps responsibility for the diagnosis; reports should not be requested for unstable coronary syndromes or urgent workups, and incorrect patient details sent to Caristo will change risk scores.

Inflammation evaluation is limited to patients aged 30 to 80 and to named imaging conditions, and deep learning image reconstruction is not supported by default. Trained operators, who may work remotely, review anatomy and define and correct vessels before the report is generated, and the healthcare professional can repeat or request a repeat of the analysis (K242240). What the system may and may not do, the person in the loop and the correction path are published.

The method is published and version changes are announced; the models' training data is not described. The mechanism behind the FAI-Score is set out in peer reviewed work by the company's founders: inflammation inhibits lipid accumulation in the fat around the coronary arteries, creating an attenuation gradient that CT can measure.

The Instructions for Use name the device version (2.10), tell users that versions from 2.6 use an updated reference cohort for FAI-Score percentiles that may affect comparison with earlier results, and name sources of measurement uncertainty (tube voltage, reconstruction kernel, iodine concentration). The CaRi-Plaque 510(k) summary states that its segmentation is threshold-based rather than machine learning. The company publishes nothing on the models behind the CaRi-Heart Risk score, the data they were trained on, or the composition of the reference cohort.

An in house, authorized product with people and one named class of supplier in the chain. Caristo developed CaRi-Heart and CaRi-Plaque itself and holds their authorizations, so no outside model provider sits between a scan and a score. Trained operators, who may work remotely, handle each study, and the privacy policy lists third party de-identification services among the providers Caristo relies on.

The cloud host, a subprocessor list, where operators work, and what happens to studies and the clinical risk factors sent with them after analysis are not published. An in house, authorized chain with the other parties unnamed.

Multicenter outcome evidence for the prognostic claim, published in leading journals and led by the company's academic founders. ORFAN, a multicenter longitudinal cohort of patients undergoing CCTA in routine NHS care (The Lancet, 2024), reports that inflammation measured by the FAI-Score predicts cardiac events in patients without obstructive disease and validates the AI-Risk algorithm in a population separate from the one it was developed in; among patients with no or minimal plaque, those with the highest inflammation had several times the cardiac mortality risk of those with the lowest.

CRISP-CT (The Lancet, 2018) is a post-hoc analysis of prospective outcome data showing prognostic value beyond traditional risk factors, and the Instructions for Use cite these and further studies as the device's performance evidence. The research comes from the Oxford group that founded Caristo, so it is multicenter and peer reviewed rather than independent of the company. What is not yet shown is that acting on the score improves outcomes.

The privacy policy explicitly excludes patient data, placing it under the customer's own instrument, so no retention period, deletion commitment or model training term is published for the material the analysis actually consumes. That material is broader than images alone: the instructions for use confirm that clinical risk factors and patient demographics are sent to Caristo alongside the scan, so identified clinical data leaves the site. The surrounding safeguards are well documented.

A Data Protection Officer is appointed and named, international transfer safeguards are set out in real detail including adequacy decisions and standard contractual clauses, ISO 27001 certification backs the technical controls, and third party deidentification services are disclosed among the providers relied upon. Nothing published says what is deidentified or at what point, how long analyzed studies and the accompanying clinical data are held, or whether either informs model development.

Privacy terms are written for UK and EU law and carve out patient data; HIPAA and business associate status are not addressed. Caristo's privacy policy names UK and EU GDPR with the Information Commissioner's Office as regulator, describes the company as controller or processor depending on the service, and states that it does not apply to patient personal data customers share, which stays under the customer's own policies.

With CaRi-Heart authorized in the US from July 2026 and a US commercial launch under way, US hospitals will send identifiable scans, clinical risk factors and demographics, but neither HIPAA nor a business associate agreement is mentioned. A substantive privacy document that does not reach US patient data or state a status.

ISO/IEC 27001 certification is stated in the privacy policy and displayed as a BSI certification mark, alongside ISO 13485 for medical device quality management and ISO 9001. Access to personal data is limited to those with a business need, bound by confidentiality and processing only on instruction, and breach procedures including regulator notification are described.

A Data Protection Officer is appointed and named with a dedicated contact address, with a separate European representative. The privacy policy specifies ISO/IEC 27001:2013, a version superseded by the 2022 revision whose transition period has now closed, and the current certificate scope and date are not published. Nothing on the site shows SOC 2, a trust center, a penetration testing statement or a subprocessor list.

Both products are now authorized in the US, and the company names both authorizations in its site footer. CaRi-Heart, which measures coronary inflammation (FAI-Score) and estimates 10 year cardiac mortality risk, received FDA De Novo marketing authorization in July 2026 (DEN250042), and the company says US commercial launch begins in the third quarter of 2026.

CaRi-Plaque, for plaque and stenosis quantification, was cleared on 20 February 2025 (K242240; 21 CFR 892.2050, Class II, LLZ) as web-based image processing for trained operators. CaRi-Heart carries CE and UKCA marks and is available in Europe, Switzerland, the UK and Australia, and the Instructions for Use are posted openly. The footer's earlier statement that CaRi-Heart is limited to investigational use in the US has been withdrawn.

Groups and counts are disclosed for the plaque product with only a conclusion; the inflammation score is calibrated by age and sex, not reported by group. The CaRi-Plaque 510(k) summary (K242240) describes a validation set of 117 patients (85 men, 32 women, aged 27 to 85) from two US and two non-US sites on four scanner makers, with ethnicity collected or estimated by site, and states that analysis by vessel, sex and age showed no bias in performance, without figures by group.

For CaRi-Heart, FAI-Score percentiles are normalized against an age and sex matched reference cohort that changed in version 2.6, and the Instructions for Use bound inflammation evaluation to ages 30 to 80 and name the imaging conditions that add uncertainty. ORFAN validated the risk algorithm in a UK NHS population, which does not establish performance in US populations. No AI governance framework is published. Groups and counts disclosed with only a conclusion.

Mechanisms to check and repeat the output are published; no error rate for the AI output is, and nothing stands behind it. Trained operators review anatomy and correct vessels, clinicians can repeat or request a repeat of the analysis, the Instructions for Use tell clinicians the report is not a primary means of diagnosis and that incorrect patient details change the risk score, and serious incidents are to be reported to the manufacturer and regulator.

For the inflammation score and risk score, the Instructions for Use give a list of publications as the performance evidence rather than an error rate. The published agreement figures belong to CaRi-Plaque (K242240: correlations with independent expert readers of 0.93 to 0.999 across 117 patients), whose segmentation the summary describes as threshold-based rather than machine learning. No warranty, indemnity or remediation commitment is published. Mechanisms to challenge the output, nothing behind the AI's own performance.

Images come in by standard transfer; reports go out as a service, with no named system on either side. CaRi-Plaque receives CT images from the hospital's PACS by secure transmittal (DICOM), and Caristo returns a report to the healthcare professional, with an optional primary care summary report; turnaround is set by contract and can be delayed.

The Instructions for Use set imaging prerequisites precisely (scanner generation, tube voltage, extent, reconstruction matrix), so a site can check compatibility before contracting; deep learning reconstruction, standard on many current scanners, is not supported by default for inflammation evaluation. No record system, results interface or PACS vendor is named. A standards based intake with no named integration.

A cloud service, with no location committed for patient studies. CaRi-Heart is a cloud based analysis of routine CCTA scans, needing no extra imaging or protocol change; CaRi-Plaque receives images by secure transmittal from the hospital's PACS to a web-based application, and the trained operators who work on each study may be remote.

The privacy policy sets out international transfer safeguards for personal data, but it excludes the patient data customers share, and no hosting location, region or tenancy is stated for studies. With products now authorized in the US and available in Europe, the UK and Australia, that leaves the processing location for scans open in every market. It is a single hosted option, and the location is only implied.

No price is published; the billing codes are. The AMA assigned Category III CPT codes 0992T and 0993T for CaRi-Heart from January 2026; Category III codes track emerging technology and carry no set national payment, so coverage is decided payer by payer. CaRi-Plaque falls under the Category I code for AI plaque analysis. The company says US commercial launch of CaRi-Heart begins in the third quarter of 2026. No per study price, license structure or volume terms are published, and the route in is a conversation. No price, with how the products are billed discoverable.

Coverage and its limits are named for coronary CT; some marketed uses go beyond the validation. The Instructions for Use indicate CaRi-Heart for adults referred for CCTA, with inflammation evaluation limited to ages 30 to 80, and set out imaging prerequisites in detail (64-slice or better scanners, named tube voltages, scan extent, reconstruction limits, no deep learning reconstruction by default); the stated clinical benefit is in symptomatic patients referred for CCTA, which is where ORFAN validated it.

The site also markets preventive screening, drug trial endpoints and intervention planning, which that validation does not cover. The narrow disease focus is not the limit. Named coverage with validation behind the core use.