Caristo Diagnostics

The measurement is the product. Perivascular Fat Attenuation Index cannot be read off a scan by eye; it requires the algorithm to quantify an attenuation gradient in tissue surrounding the artery. The company describes CaRi-Heart as the only commercially available technology able to detect and measure coronary inflammation on routine cardiac CT. No hardware line, no services business, no platform that merely hosts other people's models.

Prognostic decision support rather than autonomous action. The system produces a CaRi-Heart Risk Score with colour coded visualisation and quantitative metrics for clinician interpretation, and the registered CARE-CCTA trial is explicitly designed to evaluate impact on clinical decision-making rather than to remove the clinician.

Graded B rather than A because the extent of any technical or human quality control step in the cloud analysis pipeline is not disclosed, which is the same gap flagged on Elucid's analyst segmentation.

The underlying biology and the measurement mechanism are published in the peer reviewed literature rather than asserted as proprietary accuracy. Inflammation inhibits lipid accumulation in perivascular adipocytes, creating a three dimensional gradient in the aqueous versus lipid content of the surrounding fat, which is quantified as a perivascular attenuation gradient from the CCTA derived Fat Attenuation Index.

The AI-Risk prognostic algorithm and its classification system are described and externally validated in published work. A reader can follow the causal chain from biology to measurement to risk score, which very few imaging vendors permit.

Several elements here are creditable and uncommon, and one exclusion undercuts them for the material that matters. On the credit side a data protection officer is appointed and named, international transfer safeguards are set out in real detail including adequacy decisions and standard contractual clauses, a security certification backs the technical controls, and third party de identification services are disclosed among the providers relied upon.

That last is unusual and useful, because a de identification supplier is a party most vendors never mention and its involvement tells a reader that de identification is a discrete step performed by someone rather than an assumed property. The exclusion is the problem: the privacy policy explicitly excludes patient data, placing it under the customer's own instrument, so no retention period, deletion commitment or training term is published for the material the analysis actually consumes.

And that material is broader than images alone, since the instructions for use confirm that clinical risk factors and patient demographics are sent alongside the scan, so identified clinical data leaves the site rather than pixels alone. A policy that documents its transfer safeguards in detail and then excludes the category being transferred has answered the easier half. Ask what is de identified and at what point in the pipeline, how long analysed studies and accompanying clinical data are held, and whether either informs model development.

Among the strongest evidence bases in the imaging lane, and independent rather than vendor generated. ORFAN is a multicentre longitudinal cohort study published in The Lancet, conducted through the UK NHS in routine clinical care, which externally validated a previously trained AI-Risk algorithm in a new population, the specific test most imaging AI never faces.

Its headline finding is clinically consequential: among patients with no or minimal plaque and zero calcium, the highest inflammation group showed roughly 9.5 to 11 times cardiac mortality risk and around 5 times MACE risk, meaning the tool finds risk that current plaque and calcium based assessment declares absent.

CRISP-CT established incremental prognostic value beyond traditional risk factors, an ESC Congress 2025 late breaking session reported FAI-Score predicting cardiac death beyond hsCRP with post-mortem CT linked to histology, and CARE-CCTA (NCT07220304) is a registered prospective study. Research is Oxford led and published in independent venues.

The privacy policy explicitly excludes patient data, placing it under the customer's own instrument, so no retention period, deletion commitment or model training term is published for the material the analysis actually consumes. That material is broader than images alone: the instructions for use confirm that clinical risk factors and patient demographics are sent to Caristo alongside the scan, so identified clinical data leaves the site. Several elements are creditable and uncommon here.

A Data Protection Officer is appointed and named, international transfer safeguards are set out in real detail including adequacy decisions and standard contractual clauses, ISO 27001 certification backs the technical controls, and third party de identification services are disclosed among the providers relied upon. Worth asking what is de identified and at what point, how long analysed studies and the accompanying clinical data are held, and whether either informs model development.

Neither HIPAA nor a business associate agreement appears in the published materials. The governing regimes named are UK GDPR and EU GDPR, with the Information Commissioner's Office as supervisory authority, and the company describes itself as acting variously as controller or as processor under another organisation's authorisation.

Patient data is carved out cleanly: the privacy policy states it does not apply to patient personal data that customers share, which remains subject to the customer's own policies. That is a coherent position, but it is drafted for a European buyer while a US entity exists and the plaque product is FDA cleared for US sale. A US buyer should treat HIPAA coverage and the BAA as contract questions, because nothing published addresses either.

ISO/IEC 27001 certification is stated in the privacy policy and displayed as a BSI certification mark, alongside ISO 13485 for medical device quality management and ISO 9001. Access to personal data is limited to those with a business need, bound by confidentiality and processing only on instruction, and breach procedures including regulator notification are described.

A Data Protection Officer is appointed and named with a dedicated contact address, with a separate European representative. One point a buyer should close: the privacy policy specifies ISO/IEC 27001:2013, a version superseded by the 2022 revision whose transition period has now closed, so the current certificate scope and date are worth requesting. Held below the top of the band with no SOC 2, no trust center, no penetration testing statement and no subprocessor list.

Caristo holds a split US position and states it plainly rather than blurring it, with the precision that carries the grade. The sitewide footer makes two claims a buyer can act on directly: CaRi-Plaque has been cleared by the FDA under 510(k) K242240, and CaRi-Heart is limited to investigational use in the United States.

Naming the clearance number and using the precise regulatory term for what is not cleared, in a footer that travels with every page including marketing pages, matches the disclosure discipline of Elucid and Artrya in this lane. The company separately states that CaRi-Heart is available for clinical use in the UK, Europe and Australia, and publishes the healthcare professional Instructions for Use openly rather than behind a login, which is uncommon for software as a medical device.

The substance a US buyer must get right is which half is which. CaRi-Heart FAI-Score, the coronary inflammation measurement that is the company's actual differentiator, is the part not cleared here, so a US purchaser buying for the inflammation capability specifically is buying something available only for investigational use. A reimbursement trap sits alongside it.

Two 2025 milestones are sometimes reported together in a way that implies more than they do: the CaRi-Plaque clearance, and an AMA CPT Panel approved Category III code for CaRi-Heart. Category III is an emerging technology tracking code with no established payment, and it must not be confused with the Category I code carrying roughly $950 per assessment that applies to automated plaque analysis from January 2026.

Better than the imaging lane norm on two counts, neither of which is a fairness disclosure. First, the ORFAN validation was conducted across the UK NHS in routine clinical care rather than in a curated cohort, which is a genuine test of generalisation to an unselected population.

Second, and uncommonly for software as a medical device, Caristo publishes its healthcare professional Instructions for Use openly rather than behind a login, and that document names the limits of the device rather than only its capabilities.

It discloses that versions from 2.6 use an updated reference cohort for calculating FAI-Score percentiles and that this may affect comparison with earlier versions of the device, a version change notice of a kind almost nothing else in this index publishes. It states that interpolation used in image rendering does not guarantee the absence of plaque at or below the resolution of the input data.

It names the sources of measurement uncertainty beyond operator variability, specifically scanner tube voltage, reconstruction kernel and iodine concentration. It publishes an operating envelope covering scanner class, reconstruction resolution and matrix limits, including a statement that deep learning or AI based image reconstruction is not supported by default for inflammation evaluation. It also bounds the indicated population for inflammation assessment to patients aged 30 to 80.

Graded B rather than A because none of this is subgroup performance. FAI-Score percentiles are normalised against an age and sex matched population, which is a calibration method rather than a report of how the device performs in women compared with men or across ethnic groups. No demographic performance breakdown was located, and a UK NHS validation population does not establish performance in a US population with different demographics and different CCTA practice patterns. A buyer should ask for performance stratified by sex, age band and ethnicity, and for the composition of the reference cohort the percentiles are drawn from.

The causal chain from biology to measurement to risk score is published in the peer reviewed literature rather than compressed into a claim of proprietary accuracy, and that is rarer in imaging than any accuracy figure. The mechanism is stated: inflammation inhibits lipid accumulation in perivascular adipocytes, creating a three dimensional gradient in the aqueous versus lipid content of the surrounding fat, which is quantified as an attenuation gradient derived from the scan.

A reader can therefore interrogate the product at three separate points rather than one, asking whether the biology holds, whether the imaging measure captures it, and whether the risk score derived from the measure predicts outcomes, and a failure at any of those is locatable. Almost every competitor offers only the third link, which means a disagreement about the output has nowhere to go.

The prognostic algorithm and its classification system are also described and externally validated in published work, so the final link has been tested by people other than the company. Held below the top grade because no warranty, indemnity or remediation commitment attaches, and because the published validation establishes prognostic association rather than showing that acting on the score improves outcomes, which is the next question and a harder one. Ask what changes in management the score is intended to trigger, whether any trial has tested acting on it, and performance in populations outside the validation cohorts.

The delivery model is a report service rather than an integration. Healthcare professionals receive a report produced by Caristo, with turnaround contractually defined and explicitly subject to delay, and the instructions for use caution against requesting reports for patients where urgent workup is critical. No EHR or PACS integration is described, and there is no mention of DICOM delivery, FHIR or HL7 result routing.

Two published details do real work for a buyer and are rare in this category. Imaging prerequisites are specified precisely, covering scanner generation, tube voltage, slice thickness, reconstruction matrix and bit depth, so a site can establish compatibility before contracting. Among them is a constraint worth checking early: deep learning or AI based reconstruction is not supported by default for inflammation evaluations, and many current scanners apply it as standard. An optional primary care summary report is also offered for onward distribution. Worth asking how reports reach the patient record and what turnaround is actually contracted.

Explicitly a non-invasive cloud based solution analysing routine CCTA scans, requiring no additional imaging or change to acquisition protocol, which is a genuine adoption advantage since it works on scans hospitals already perform. Graded B rather than A because cloud-only implies scans leave the institution and no data residency terms were published, which matters given UK and US operations under different data regimes.

No pricing published and the reimbursement position is genuinely ambiguous for a US buyer. CaRi-Plaque qualifies for the established Category I automated plaque analysis pathway, but CaRi-Heart holds only a Category III code, which is a tracking code without established payment, so the revenue path for the differentiating product is unresolved in the US. Contrast Cleerly and Elucid, both indexed, where the plaque analysis reimbursement position is concrete.

Narrow by design: coronary artery disease risk assessment from CCTA, serving cardiology and cardiac imaging. Two products against one disease area. Graded on the same scale as index peers spanning multiple body systems, the same way Elucid was.