Circle Cardiovascular Imaging

Deliberate B on the platform-not-algorithm principle, applied in its partial form. cvi42 is an established multi-vendor cardiovascular imaging reading platform spanning cardiac MRI and CT, and Plaque is an AI-enabled module added to it. The AI is real and separately cleared, quantifying total, calcified and non-calcified plaque, so this is not a C alongside ModMed or Indica Labs where the clearance belongs purely to the platform.

But the company's franchise, install base and moat are the reading platform, not the plaque model. Same treatment as aetherAI, graded B as the partial case: a substantive algorithm inside a business whose centre of gravity is the platform.

Analysis tool under direct clinician control rather than an autonomous reporting system, and the on-premise design reinforces that: a Johns Hopkins user describes having immediate and interactive control over the coronary CCTA analysis, meaning the clinician drives the tool rather than receiving a finished report from a service.

Graded B rather than A because no explicit statement of the human oversight model or the boundary of the tool's role was located, and the interactivity claim comes from a customer quotation rather than a stated design principle.

The weakest axis on this record. Located materials describe the AI as delivering fast, accurate and reproducible results for quantifying total, calcified and non-calcified plaque, but no accuracy figures, validation methodology, training data provenance or model description were retrieved.

Against Elucid, which publishes its histology co-registration mechanism, and Artrya, which describes its Hounsfield Unit voxel approach and training data sources, this is materially less technical disclosure. Reproducibility in particular is asserted without a supporting figure, and reproducibility across readers and sites is precisely the open question the peer reviewed literature raises about this whole category.

The transfer does not occur, and in this lane that is decisive. On premise deployment means patient imaging never leaves the institution for analysis, which the company states explicitly as evaluation without the need to send patient data to an external reading service.

That is not a policy commitment about how data will be handled after transfer; it is an architecture in which no transfer happens, so there is no retention schedule to negotiate, no sub processor chain to enumerate, no residency question, and no secondary use to exclude.

The lane context is what raises this above a strong B. Every other indexed vendor in cardiovascular imaging analysis moves studies outside the enterprise, several of them to a reading service, so the comparison is not against an abstract standard but against four named alternatives that all require a hospital to send complete cardiac studies somewhere. A department choosing this one is choosing a different risk category rather than a better set of promises.

Two residuals should still be established rather than assumed, and neither is a reason to discount the position. Nothing published states what the software retains locally between studies, which is the department's own question rather than the vendor's. And if a cloud or hosted option exists or is introduced, none of the above applies to it, so the commitment should be tied to the deployment in the agreement rather than to the product name.

No validation study specific to cvi42 Plaque was located. The company cites external context supporting the category rather than its own product, including expert recommendations that adding quantitative coronary plaque analysis may be useful for risk assessment and guiding preventive therapy in patients with visible plaque on coronary CTA. Category-level endorsement is not product-level evidence.

Note the broader cvi42 platform has a long research presence in cardiac MRI, but that does not validate the plaque module cleared in October 2025. Contrast Heartflow with 600+ publications and Caristo with a Lancet cohort in the same lane.

The strongest position in the cardiovascular CT lane and the reason this record matters. On-premise deployment means patient imaging never leaves the institution for analysis, which the company states explicitly as evaluation without the need to send patient data to an external reading service. That is not a policy commitment about how data will be handled after transfer; it is an architecture in which the transfer does not occur.

Every other indexed vendor in this lane, Heartflow, Elucid, Caristo and Artrya, moves imaging outside the enterprise. Compare Mendel, which earned similar credit for hosting inside the customer environment.

An architectural answer to a contractual question, and the most complete one in this category. All image data and derived results are stated to be managed locally, on a hospital workstation or a customer managed server, with no data ever transmitted outside the institution and no patient data stored or sent externally by the software.

Where a vendor never receives protected health information, the business associate relationship a BAA exists to govern may not arise for the licensed product at all. That is a structurally stronger position than any competitor which sends studies out for processing, and it is worth recognising as such rather than treating the absence of a BAA discussion as a gap.

Held below the top of the band because HIPAA is nowhere addressed by name, no business associate position is stated either way, and the no transmission claim appears in a company blog rather than a formal instrument. It also does not describe remote support access to a customer installation, or whether browser based viewer components fall under the same guarantee. Worth confirming both and getting the architecture reflected in contract.

No SOC 2, ISO 27001, HITRUST or trust center was located, and no penetration testing or software bill of materials statement was found. What is published is technical rather than certified: client server connections secured with TLS, centralized user management using encrypted LDAP or Active Directory authentication, and AI models locked and encrypted at integration.

The architecture carries real weight here, because analysis runs entirely inside the customer environment and the vendor does not receive imaging data, so the customer's own controls govern the data at rest. That reduces vendor side exposure substantially, but it does not replace assurance over software installed inside a hospital network. Worth asking for independent security testing results, a bill of materials for the installed software, and how remote support access to a customer installation is controlled.

The most comprehensively documented regulatory position in this lane, and the distinction is that the clearances are published rather than merely claimed. Circle maintains a public regulatory register listing eight FDA 510(k) clearances for cvi42, most recently K251027 and K242781, with prior clearances under K241038, K232661, K213998, K141480, K111373 and K082628, plus two for StrokeSENS under K250221 and K212261.

Each is posted as a downloadable clearance document rather than a number a buyer must look up independently. The register extends to roughly twenty further jurisdictions with named registration numbers and certificates attached, covering Canada, the European Union under MDR, Australia, Japan, South Korea, Taiwan, Singapore, Malaysia, India, China, Brazil, Mexico, Colombia, Argentina, El Salvador, Saudi Arabia, the United Arab Emirates, Thailand, Indonesia, South Africa and Israel.

Quality system evidence is published to the same standard: ISO 13485:2016 and MDSAP certificates from BSI with certificate numbers and effective dates, stated alignment to EU MDR 2017/745 and the US FDA Quality Management System Regulation, and named development and risk standards including IEC 62304, IEC 62366-1, IEC 82304-1 and ISO 14971. A named regulatory affairs contact is given. Two limits a buyer should note.

The register does not map each clearance to a named module, so confirming coverage for a specific capability such as coronary plaque means reading the posted documents rather than the summary list. And this position carries no clinical guideline recognition of the kind supporting FFRCT in the ACC/AHA chest pain guideline, which remains the one credential in this lane that breadth of clearance does not substitute for.

Among the more substantive AI disclosures in this category, and specific rather than aspirational. Models are trained on expert annotated data using supervised learning inside the company's own research environment, then locked, frozen and encrypted at integration, so behaviour is fixed once deployed and results are reproducible across installations.

A dedicated statement confirms the system does not learn from data processed at the customer site, does not modify its internal model based on what it sees or on whether a user edits its outputs, and treats each analysis in isolation. The engine is described at a technical level as convolutional neural networks performing pixel and voxel level classification of cardiac structures, and clinicians review, adjust and approve generated contours. Held below the top of the band on the bias half.

Training data is characterised only as diverse and representational, with no composition figures and no performance broken down by patient subgroup, and there is no external AI governance credential. The disclosure also sits in a company blog rather than a governance policy. Worth asking for the demographic composition of the training and validation sets, and for performance by subgroup.

Two passes located no accuracy figures, no validation methodology, no training data provenance, no model description and no warranty, indemnity or remediation commitment. Materials describe the system as delivering fast, accurate and reproducible results for quantifying total, calcified and non calcified plaque.

The reproducibility claim is the one to press, because it asserts precisely the property the peer reviewed literature raises as the open question about this whole category: quantitative plaque analysis varies with scanner, reconstruction kernel, contrast timing and reader, and whether any given tool produces the same number twice on the same patient across sites is exactly what the field does not yet consider settled.

Asserting it without a figure claims the contested ground and offers nothing to check. The comparison within this lane is unusually direct and belongs on the record, because two competitors do publish mechanism: one describes ground truth derived from histopathology of removed tissue, another describes its voxel level approach and names its training data sources across three countries.

Against those, this is materially less technical disclosure for a product making the same class of measurement. Ask for scan rescan reproducibility on the same patient, inter site variability, accuracy against a reference standard, and whether the numbers are comparable across scanner vendors.

Genuine multi-vendor interoperability is the platform's heritage rather than a retrofit. cvi42 Plaque is stated to integrate into existing CT workflows and to be compatible with all major vendor systems, reflecting the platform's long standing as vendor-neutral cardiovascular reading software across MRI and CT.

Being scanner-agnostic matters more here than in most categories, because the alternative in cardiovascular imaging is often an analysis package tied to one manufacturer's scanner, and the Nature Reviews Cardiology benchmarking of this field included exactly such manufacturer-bound options from Siemens and Canon. Same reasoning that earned Indica Labs an A for multi-vendor hardware support in pathology.

The defining strength of this vendor and the clearest data residency position in the lane. Fully on-premise: analysis runs inside the institution, so imaging data never crosses the boundary. This resolves residency, sovereignty and cross-border transfer questions structurally rather than contractually, and it removes the queue dependency inherent in send-out models, which the company frames as improved study processing times.

For institutions in jurisdictions with data localisation requirements, or those unwilling to send imaging to a US or foreign cloud, this is effectively the only option among indexed cardiovascular CT vendors.

No licence price published, but the reimbursement position is described more precisely and more accurately than by most vendors in this lane, including the distinction others blur. The company states that Medicare covers AI-enabled coronary plaque analysis under Category III code 0625T with national payment set at $950, and separately that a permanent Category I code takes effect January 2026 replacing the previous Category III codes, noting this enables national pricing and physician reimbursement and signals that plaque quantification is now recognised as standard clinical care.

It also notes higher base payments for the underlying CCTA exam. Getting the Category III to Category I transition right is exactly the distinction Caristo's split position makes consequential. Graded B rather than A because no vendor pricing basis is disclosed, unlike Artrya's published per-scan model.

Broader than the single-purpose plaque vendors because cvi42 is an established cardiovascular imaging platform spanning cardiac MRI and CT rather than a coronary-only product, serving cardiology departments and imaging centres, with reported use extending to specialised settings including adult congenital heart disease at Johns Hopkins. Graded B rather than A because coverage remains within cardiovascular imaging, and the specific breadth of cleared modules beyond Plaque was not enumerated in retrieved materials.