Carna Health

AI is claimed throughout and the company's own license agreement says it is not there yet. The home and products pages call Carna an AI driven platform with AI predictive analytics that identify which screened patients will progress to advanced chronic kidney disease, AI clinical decision support, and AI guided workflows for nurses and primary care providers. Section 7 of the end user license agreement, headed Future AI Features, says Carna may in the future integrate AI features, which will be clearly labeled, optional and subject to ethical review before deployment. No model, method or validation is described on the home, products, license or privacy pages, and the founder has described the predictive algorithms as something the company's screening data will be used to build.

What runs today is screening logistics, staging, care pathway routing and data aggregation. The one learned model identifiable on the platform is a partner's: the Renalytix kidney risk test, brought onto the platform in May 2026, carries its own algorithm and its own FDA authorization. This is the AI claimed and absent kind of D. Screening infrastructure in places that have none is worth building whether or not a model sits inside it.

Human in the loop throughout, with one design choice that deserves to be named precisely rather than scored against the vendor. The stated purpose of the guided workflows is to let nurses, pharmacists and primary care providers manage complex cardio kidney metabolic cases without specialist referral, in settings where the specialist does not exist.

That is deliberate task shifting, it is a recognized and appropriate strategy where nephrologists are scarce, and it is a very different oversight posture from a tool that assists a specialist. The software's guidance substitutes for expertise that is absent rather than supplementing expertise that is present, which raises the consequence of a wrong recommendation and lowers the chance anyone in the room catches it. No published material describes escalation thresholds, competency requirements for the staff following the workflows, or how the programs audit the decisions made under them.

Nothing published about what produces the outputs marketed as AI. The products page describes how data moves (ingestion from devices, laboratories and record systems through FHIR and HL7, an enterprise master patient index, AWS hosting) but not how risk is identified, how progression is predicted or where the specialist grade recommendations come from. The license agreement's section 7 says AI features may be integrated in future, which leaves a buyer unable to tell whether today's risk and progression outputs come from established staging criteria, clinical rules or a model.

The one model identifiable on the platform belongs to Renalytix, and its transparency is that company's to answer for. The gap is sharpened by Carna's own thesis: its stated reason for building its own models is that existing kidney disease guidance was developed on North American and European populations, which is a serious argument and one that only means something if the replacement is published and can be checked.

The architecture is described and the host is named; no model provider is named, and the license agreement says the AI features are not yet built. The products page describes a cloud platform on AWS that ingests from point of care devices, laboratories, record systems and exchanges through FHIR and HL7, resolves identity with an enterprise master patient index, and serves ministry, provider and patient modules. Named partners sit in the chain: Siemens Healthineers for point of care testing systems, Renalytix for its kidney risk test, NeoDocs for instant diagnostics, and NVIDIA's Inception program. The license agreement says third party subprocessors are used where required, and the privacy policy says details of smaller third party recipients are available on request.

No subprocessor list is published. The data supply matters here: the company has described using the screening data it gathers across several countries to build its own predictive models, so the patients screened are part of the supply chain for a future modeling asset, and nothing published says what they are told or whether screening and model development are separable choices.

Real operational results at population scale, with a methodological caveat that changes what the headline means. In Bermuda the program reported that more than 49 percent of those screened were identified with chronic kidney disease, that 94 percent of them were unaware, and that around 20 percent needed nephrology referral, and the Ministry of Health went on to establish a national integrated care pathway in 2023, which is institutional adoption confirmed on the government side rather than a vendor claim. Cameroon has enrolled 35,000 with a further 75,000 patient program announced.

The catch is that chronic kidney disease is defined by abnormality persisting beyond three months, so a single point of care measurement cannot establish chronicity. Those figures are screen positive rates awaiting confirmation, not diagnosis rates, and a share of single abnormal results do not persist on retest. The company cites no peer reviewed publication of its own program results. The strong outcome figures quoted in partnership announcements, on risk prediction and prescribing changes, belong to the Renalytix test, not to Carna.

General assurances that do not answer the questions a modeling program raises. The privacy policy describes encryption, access limited to authorized staff, background checks, retention for the period the law requires and deletion on request, and the license agreement asks users to consent to the processing of health related data, the use of subprocessors and cross border transfers. None of that addresses what the stated plan raises: the company has said it is gathering screening data at global scale in order to build predictive algorithms.

Patients screened in a national program are therefore contributing to a commercial modeling asset, and nothing on the home, products, license or privacy pages says what they are told, what they agree to, whether screening and model development are separable choices, or how long screening records are kept for that purpose. A person offered kidney screening in a public program has every reason to accept it, and declining the modeling contribution should not require declining the screening.

A status is stated and not supported by a privacy document that reaches patient data. The products page describes the suite as HIPAA and SOC 2 ready, with end to end encryption, audit logging and role based access controls, and section 5 of the end user license agreement says Carna supports compliance with HIPAA, GDPR, PIPEDA and other national health privacy regulations. The privacy policy linked from the footer is written to GDPR, names a data protection officer, and describes hosting in countries with GDPR equivalent protection, standard contractual clauses for other transfers, staff background checks and retention for the period the law requires. It does not mention HIPAA, protected health information or business associate terms, and it carries unfilled template text: a company registration number of 123456, a data protection authority of the United States of America, and several paragraphs reading Not Applicable.

No business associate agreement or subcontractor position is published. The company holds screening records across Bermuda, Cameroon, the Philippines, the Dominican Republic and Turkey while entering the United States, and nothing published says which regime governs which record.

Controls are asserted with nothing independent behind them. The products page describes the suite as HIPAA and SOC 2 ready, with end to end encryption, audit logging and role based access controls, and the privacy policy describes access controls, staff background checks and security training. Ready is a statement of preparation, not an attestation: no SOC 2 report, ISO 27001 certificate, HITRUST certification, trust center or vulnerability disclosure route appears on the home, products, license or privacy pages.

Scale of held data sets the expectation here, not size of company. The platform holds screening records for tens of thousands of people across several countries and plans to screen far more, a concentration of population health data in places where the people affected have little practical recourse if it is mishandled.

The marketing makes clinical claims and no regulatory position is stated anywhere. The products page offers AI clinical decision support giving specialist grade recommendations on next steps, drug interactions and evidence based interventions at the point of care, lets providers update treatment plans and adjust medications from the app, and promises that nurses and primary care providers can manage complex cardio kidney metabolic cases without a nephrologist. The home page markets AI that identifies which screened patients will progress to advanced kidney disease and routes them to care, and the patient app shows patients their own risk score. Those are recommendations to change treatment and a prognostic prediction about a named person, clinical on both counts, and the home, products, license and privacy pages state no position on device status. The license agreement's only relevant line says future AI features will not replace professional medical judgment.

The regulated components on the platform belong to others: the Siemens Healthineers point of care testing systems carry their own clearances and the Renalytix kidney risk test its own authorization, and neither transfers to the software that directs their use.

The company publishes nothing on how model behavior is governed or tested, but it states one sound instinct. The founder's stated reason for building Carna's own models is that existing chronic kidney disease guidance was developed largely on North American and European populations and should not be transplanted wholesale, a critique well documented in the literature on kidney function estimation. The license agreement adds that future AI features will be subject to ethical review before deployment, with no reviewing body or process named.

Against that, the program screens tens of thousands of people in low and middle income countries with the stated purpose of building predictive algorithms, and the site says nothing about ethical review of the data collection, consent for research use, data ownership, benefit sharing with the programs that supply the data, or publication commitments. There is no bias testing, subgroup performance or model card, which is less pointed while no model is published than the governance of the collection itself.

Having named the problem with other people's models, the company has not yet shown how its own will avoid it.

Nothing published on what happens when the system is wrong, and the license agreement disclaims what the marketing promises. The end user license agreement provides the platform as is, disclaims all warranties including fitness for a particular purpose, and caps Carna's total liability at the fees paid in the preceding twelve months. No accuracy commitment, remediation obligation or route for a patient or clinician to challenge an output appears on the home, products, license or privacy pages.

The exposure is clinical. The products page promises specialist grade recommendations on drug interactions and interventions so that nurses and primary care providers can manage complex kidney and cardiometabolic cases without a nephrologist. In that model the software's guidance substitutes for expertise that is absent, so a wrong recommendation is less likely to be caught, and the license places the consequence entirely on the user.

The part of the product that is real and difficult. The products page describes FHIR and HL7 native, two way integration with record systems, exchanges and laboratory systems, an enterprise master patient index giving deduplicated longitudinal records, and exclusive direct connectivity with Siemens Healthineers point of care testing devices, which return kidney function results in under fifteen minutes without a laboratory. The platform demonstrably runs across five national or regional health systems with very different infrastructure, from laboratory networks to community screening with intermittent connectivity, and the provider app works offline.

The Siemens device connection is a named integration. Beyond it, the site names no record system, and the two way claim rests on the company's own description rather than on published implementation detail or a marketplace listing.

A single hosted option on a named cloud, with a residency rule stated and no location committed. The products page says the platform runs on AWS. The privacy policy says data is, as a rule, hosted in countries that give protection substantially similar to the GDPR, with standard contractual clauses and supplementary measures where it is not, and the license agreement asks users to consent to cross border transfers where necessary to provide the service.

Residency is a first order question for this vendor. Screening records generated in Cameroon, the Philippines, the Dominican Republic, Bermuda and Turkey are aggregated by a company headquartered in the United States with a stated intention to pool them for model development, several of those countries are still developing data protection law, and where the records physically sit decides which law applies. No region, tenancy model or continuity commitment is published.

Every commercial term waits for a sales conversation. The site publishes no price, unit of charge, contracting model or implementation fee, and the route in is a demo request. The buyers vary widely (health ministries, regional governments, health systems and laboratory partners), and nothing indicates whether they buy on per person screened, per program, per device or platform license terms.

The commercial facts that are public concern continuity. The company raised $8 million in January 2026 against a stated ambition of screening millions of people, and a government that builds a national screening pathway on the platform takes on a dependency it cannot easily unwind.

Narrow clinically and broad geographically, and the second half is the distinctive part. The clinical scope is chronic kidney disease with expansion across the cardio kidney metabolic cluster including diabetes, delivered through community screening, primary care, and workflows designed for nurses and pharmacists rather than nephrologists. The geographic scope covers national or regional programs in Bermuda, Cameroon, the Philippines, the Dominican Republic and Turkey, with United States entry underway, and a population and ministry of health module for monitoring disease hot spots and cohort risk.

Part of that is validated from outside: Bermuda's Ministry of Health established a national integrated care pathway in 2023 after the program, which is adoption confirmed on the government side. A tool designed to work where specialists and laboratory infrastructure are scarce is solving a different problem from one designed for a well resourced health system.

Depth outside the named programs is not shown, and single point screening results stay unconfirmed.