Carna Health

The company describes itself as artificial intelligence driven in nearly every piece of material it publishes, and two retrieval passes located no description of a model, a method or a validation behind that phrase. The clearest evidence is the founder's own account, given in an interview and stated in the future tense: the company will be the first to gather real world data globally at this scale in order to build the predictive algorithms it needs, and should not simply copy existing models.

That is a statement that the models are the intended product of the data collection rather than a component of the current one. What does run on the platform today is screening logistics, staging against established criteria, and care pathway routing, plus a partner's model, since the Renalytix kidney risk test brought onto the platform in May 2026 carries its own machine learning algorithm and belongs to Renalytix. This grade describes the mechanism and not the value: large scale screening infrastructure in places that have none is worth building whether or not a model sits inside it.

Human in the loop throughout, with one design choice that deserves to be named precisely rather than scored against the vendor. The stated purpose of the guided workflows is to let nurses, pharmacists and primary care providers manage complex cardio kidney metabolic cases without specialist referral, in settings where the specialist does not exist.

That is deliberate task shifting, it is a recognised and appropriate strategy where nephrologists are scarce, and it is a very different oversight posture from a tool that assists a specialist. The software's guidance substitutes for expertise that is absent rather than supplementing expertise that is present, which raises the consequence of a wrong recommendation and lowers the chance anyone in the room catches it. No published material describes escalation thresholds, competency requirements for the staff following the workflows, or how the programmes audit the decisions made under them.

Nothing to inspect. Two passes located no architecture, no feature description, no validation methodology, no performance figures and no published account of how risk scoring works. There is no regulatory record to substitute for the absence either, since no device submission was located, so neither of the two routes to transparency this index recognises is available.

The one machine learning component identifiable on the platform belongs to a partner, and its transparency is Renalytix's to answer for rather than Carna's. A company whose entire stated strategy is that existing models were built on the wrong populations has a strong reason to publish how its own will be built and evaluated, and that publication is the single thing that would change most of this grid.

The platform aggregates point of care results, laboratory diagnostics, record system data and social determinants into what the company calls a secure patient view, and that is the extent of what is published: two passes located no retention position, no minimisation statement, no consent framework, and no model, hosting arrangement or sub processor list. The gap is more consequential than the usual version because secondary use is not a hypothetical risk here but the stated plan.

The company has said publicly that it is gathering data at global scale in order to build predictive algorithms, so patients screened in a national programme are contributing to a commercial modelling asset by design rather than incidentally. No published material describes what they are told, what they agree to, or whether participation in screening and participation in model development are separable choices.

That separability question is the one this index has credited elsewhere where a vendor got it right, and it matters most exactly here, because a person offered kidney screening in a public programme is being offered a health service and has every reason to accept it, and declining the modelling contribution should not require declining the screening. The setting compounds it, since a national programme reaches people with the least practical ability to opt out of anything. Ask what the consent covers, whether the two participations are separable, retention, and who else receives the aggregated view.

Real operational results at genuine population scale, with a methodological caveat that changes how the headline should be read. In Bermuda the programme reported that more than 49 percent of those screened were identified with chronic kidney disease, that 94 percent of them were unaware, and that around 20 percent needed nephrology referral, and the Ministry of Health went on to establish a national integrated care pathway in 2023, which is institutional adoption confirmed on the government side rather than a vendor claim.

Cameroon has enrolled 35,000 with a further 75,000 patient programme announced. The caveat: chronic kidney disease is defined by abnormality persisting beyond three months, so a single point of care measurement cannot establish chronicity by definition. Those figures are properly read as screen positive rates awaiting confirmation, not diagnosis rates, and a share of single abnormal results do not persist on retest.

No peer reviewed publication of the company's own programme results was located. The strong outcome figures quoted in partnership announcements, covering risk prediction improvement and prescribing changes, belong to the Renalytix test and should not be attributed here.

The platform aggregates point of care results, laboratory diagnostics, record system data and social determinants into what the company calls a secure patient view, and that is the extent of what is published. Two passes located no retention position, no minimisation statement and no consent framework.

The gap is more consequential here than the usual version of it, because secondary use is not a hypothetical risk but the stated plan: the company has said publicly that it is gathering data at global scale in order to build predictive algorithms.

Patients screened in a national programme are therefore contributing to a commercial modelling asset, and no published material describes what they are told, what they agree to, or whether participation in screening and participation in model development are separable choices.

Two retrieval passes located no HIPAA statement, no Business Associate Agreement terms and no privacy or legal page. Graded on published posture. The company is entering the United States market, where a Business Associate Agreement will be required, and simultaneously operates across Bermuda, Cameroon, the Philippines, the Dominican Republic and Turkey, each with its own health data regime and several with regimes still developing. A vendor holding identifiable health data across that many sovereign jurisdictions has a harder compliance story to tell than most, which is a reason to publish it rather than a reason not to.

Two passes located no SOC 2, no ISO 27001, no HITRUST, no trust centre and no vulnerability disclosure policy. The company holds screening records for tens of thousands of people across several countries and projects screening between one and one and a half million more, which makes it a concentration of population health data in jurisdictions where the affected individuals have limited practical recourse if it is mishandled. Scale of held data, not size of company, is what should set expectations on this axis.

No FDA clearance, authorisation or submission was located for Carna's own software, and none is claimed. The distinction a buyer must draw is the one this index has recorded four times already under certification non transfer, and this is a clean fifth instance: the regulated components on the platform are other companies' products.

The point of care testing systems are supplied through the Siemens Healthineers agreement and carry their own approvals, and the Renalytix kidney risk test carries its own regulatory status. Neither transfers to the platform that orchestrates them.

Software that stages patients and routes referrals may well sit outside device regulation, which is an ordinary position, but a purchaser should not read the presence of cleared instruments and an authorised laboratory test as evidence that the software directing their use has been reviewed by anyone.

The instinct is better than most of this index and the disclosure is thinner than almost all of it, and both halves belong on the record. The company's stated reason for building its own models is that existing chronic kidney disease guidance was developed largely on North American and European populations and should not be transplanted wholesale, which is a correct critique, well documented in the literature on kidney function estimation, and a more sophisticated position than most vendors articulate.

Against that, this is a programme screening tens of thousands of people in low and middle income countries with the explicit purpose of building predictive algorithms, and two passes located nothing on ethical review, consent for research use, data ownership, benefit sharing, publication commitments, or who will hold the resulting models.

There is also no bias testing methodology, no subgroup performance and no model card, though with no model yet published those are less pointed than the governance of the data collection itself. Naming the problem with other people's models creates an obligation to show how yours will avoid it.

There is nothing to inspect. Two passes located no architecture, no feature description, no validation methodology, no performance figures, no published account of how risk scoring works, and no warranty, indemnity or remediation commitment.

There is no regulatory record to substitute for the absence either, since no device submission was located, so neither of the two routes to transparency this index recognises is available: the vendor has published nothing and no external reviewer has published anything about it.

The one machine learning component identifiable on the platform belongs to a partner, and its transparency is that partner's to answer for rather than this company's, which means a buyer tracing the analytics ends up assessing a different organisation. The gap is made pointed by the company's own thesis rather than by any external standard.

Its stated strategy is that existing models were built on the wrong populations and perform badly outside them, which is a serious and probably correct argument, and a company making it has a stronger obligation than most to publish how its own models will be built and evaluated, because the claim only means something if the replacement can be checked.

A model asserted to be better calibrated for an under represented population, with no published evaluation in that population, is the same asserted authority it set out to displace. Ask for the development cohort composition, evaluation in the target population, and how performance is monitored after deployment.

The strongest axis on this record and the part of the product that is real and difficult. The platform is built to ingest from health systems, clinical laboratories, point of care testing devices, record systems, health information exchanges, wearables and social determinants sources, using FHIR, HL7 and application interfaces, and it demonstrably does so across five national or regional health systems with very different infrastructure levels.

Making one platform work against both a well resourced laboratory network and a community screening programme with intermittent connectivity is genuine engineering, and the Siemens Healthineers agreement supplies a hardware integration path in the markets where that matters most. Held at B because no named record system integration was located and the interoperability claim rests on the company's own description rather than on any published implementation detail.

A vendor hosted platform with no published architecture, named hosting region or residency commitment located in two passes. Residency is a first order question for this vendor rather than a formality, because the data crosses more borders than for almost anything else in this index: screening records generated in Cameroon, the Philippines, the Dominican Republic, Bermuda and Turkey, aggregated by a company headquartered in the United States, with a stated intention to use that pooled data to build models. Several of those jurisdictions are actively developing data protection law, and the answer to where the records physically sit determines which of those laws applies. Nothing published addresses it.

No pricing, pricing mechanism, contracting model or basis of charge located, and the buyer picture is unusually opaque because the customers vary so widely: health ministries, regional governments, health systems and laboratory partners are not buying on the same terms. The visible commercial facts are an eight million dollar raise in January 2026, the Siemens Healthineers agreement and the Renalytix partnership.

That funding is modest against a stated ambition of screening 25 million people by 2030 and one to one and a half million within the year, and a government committing to a national screening pathway takes on a dependency it cannot easily unwind, so supplier continuity deserves the same attention the Behold.ai precedent established.

Narrow clinically and unusually broad geographically, and the second half is the distinctive part. The clinical scope is chronic kidney disease with stated expansion across the cardio kidney metabolic cluster including diabetes, delivered through community screening events, primary care, and workflows designed for nurses and pharmacists rather than nephrologists.

The geographic scope covers Bermuda, Cameroon, the Philippines, the Dominican Republic and Turkey with United States entry underway, which is a footprint almost nothing else in this index has: the overwhelming majority of vendors here operate in North America and Western Europe only.

A tool designed to work where specialists and laboratory infrastructure are scarce is solving a materially different problem from one designed for a well resourced health system, and that difference is worth recording as a strength rather than flattening into a coverage count.