Heartflow

The analysis is the product. Heartflow takes a coronary CT angiogram a hospital has already acquired and returns analyses a clinician cannot get from the scan by eye: FFRCT, a physiological simulation of blood flow and pressure computed from a 3D model of the coronary arteries; Plaque Analysis and plaque staging; Roadmap Analysis for stenosis; and PCI Navigator for planning intervention.

The company describes the Heartflow Analysis as AI-based medical device software, with trained Heartflow Case Analysts resolving uncertain anatomy in the model. There is no hardware, reading service or workflow platform carrying value of its own underneath. Remove the modeling and nothing is left to sell.

What the analysis may and may not be used for is published in detail, including where it stops and where a person steps in. Heartflow's indications page says the analysis supports qualified clinicians and is to be used with the patient's history, symptoms, other tests and the original CT images, and warns of false positives and negatives.

It lists the populations in which safety and effectiveness have not been evaluated (suspected acute coronary syndrome, recent infarction, prior bypass surgery, BMI over 35, clinical instability, stents, pacemaker leads, prosthetic valves, uncontrolled arrhythmia, excessive calcification) and says the analysis should not be used where urgent workup is critical. It states where the output stops: vessels under 1.8 mm are grayed and FFRCT values withheld.

It names the human step: FFRCT values may depend on assumptions made by the physician or by Heartflow Case Analysts where anatomy is uncertain. Clinicians can interrogate values in an interactive model. Limits, stop conditions, the human role and the review path are all published.

The method and the versions are published; the models and training data are not. FFRCT is described as a coronary physiologic simulation: pressure, velocity and flow computed from a 3D model built from static CT images, with the method laid out in a large peer reviewed literature.

Versions appear in the regulatory record (FFRCT v1.4 in the original De Novo authorization, v2.0 in K161772, validated on a sequestered data set), and the indications page names the CT scanner makers the analysis was validated on (Siemens, Canon, GE, Philips).

The company calls the Heartflow Analysis AI-based and describes a large annotated image library behind it, but does not describe the models used for segmentation and plaque characterization, the training data's sources and population, or how updates reach customers. Heartflow Case Analysts are part of the process.

A short chain with the host named and people in it. Heartflow builds its own models and simulation, cleared in its own name, so no outside model provider sits between a CT study and an FFRCT value. The infrastructure provider is named as Amazon Web Services, and the trust center lists third party dependence as a category in its risk profile. The chain also includes people.

Heartflow Case Analysts work on the patient's coronary model and may make assumptions where anatomy is uncertain, yet nothing on the site says where they work or under what terms. There is no subprocessor list, and the AWS regions used are not given.

Prospective multicenter validation against the invasive reference, and randomized and registry evidence on how the test changes care. FFRCT was validated in HeartFlowNXT, a prospective, multicenter study using invasive FFR of 0.80 or less as the reference standard; the company's own 510(k) summary for FFRCT v2.0 (K161772) reports per vessel sensitivity of 84.2 percent and specificity of 84.9 percent, and per patient sensitivity of 87.8 and specificity of 76.4 percent against 93.2 and 32.9 percent for CT stenosis alone.

The company's indications page summarizes performance as 84 percent accurate, 82 percent sensitive and 85 percent specific. Beyond accuracy, the PRECISE randomized trial tested a diagnostic strategy using CCTA with selective FFRCT, the ADVANCE registry reports outcomes to seven years, and the DECIDE registry (about 22,000 patients at more than 30 US centers) measures changes in management; SMART-CT reports shorter read times with plaque reporting.

The company reports more than 600 publications. SCOT-HEART, often cited alongside, tested CT angiography as a strategy rather than Heartflow's analysis. The plaque and PCI planning functions rest on newer and thinner evidence than FFRCT.

Security controls are listed; what happens to submitted studies is not stated. Heartflow's trust center names encryption at rest, access monitoring, audit logging, role based access control and backups, names Amazon Web Services as its infrastructure provider, and lists AI training data and bias, AI security and AI monitoring as categories a customer can ask about, with the underlying documents released on request.

The CT studies a hospital sends are processed in Heartflow's cloud, and trained Case Analysts work on the resulting models. The company does not say how long submitted studies and models are kept, what is deleted when a contract ends, whether customer studies are deidentified or used to develop models, or what its large annotated image library was drawn from. Safety engineering, meaning how a wrong FFRCT value is handled as a safety event, is not published. The assurances stay general, and the AI questions go unanswered in public.

HIPAA compliance is claimed as a program, and business associate status is not stated in public material. Heartflow's trust center lists HIPAA, GDPR and CCPA programs alongside HITRUST certification, with the HIPAA documentation released on request. Hospitals send identifiable CT studies to Heartflow's cloud for analysis, so the company handles protected health information on their behalf, but no business associate agreement, tier or subcontractor term is named or described publicly. Compliance claimed without the status or agreement behind it. The company's privacy policy is the next place a status statement could appear.

A full stack of recognized certifications is named with type and version; the artifacts are released only on request. Heartflow's trust center, linked from its footer at security.heartflow.com, lists HITRUST, ISO/IEC 27001:2022, SOC 2 Type 2 and ISO 13485:2016, with HIPAA, GDPR and CCPA programs.

It enumerates controls including application and network penetration testing, a software bill of materials, secure development training, multi factor authentication, encryption at rest, intrusion detection and prevention, and mobile device management, and names Amazon Web Services as the infrastructure provider. The reports and certificates sit behind an access request, so a buyer cannot open them without asking, which is what separates B from A here.

The US position is identifiable and the indications are published with their limits. FFRCT was first authorized through the De Novo pathway (FFRCT v1.4, 2014) under the classification for coronary physiologic simulation software (21 CFR 870.1415), and later versions were cleared by 510(k), including FFRCT v2.0 (K161772, 2016), validated on the sequestered HeartFlowNXT data.

Plaque Analysis and Roadmap Analysis were cleared in October 2022 and further clearances were reported in May 2026; their numbers are not given on the company's pages. The indications page states the intended use of the combined Heartflow Analysis (adults 22 and over with suspected coronary artery disease) and of FFRCT alone (clinically stable symptomatic patients), with the populations and conditions it was not evaluated in.

Regional scope is stated too: all functions are cleared in the US and several Gulf states, while in Europe, the UK, Australia, Canada and Japan only FFRCT and planning are cleared. FFRCT is also supported by the ACC/AHA chest pain guideline, which is professional endorsement rather than a regulatory status.

A diversity claim, a gated governance category, and no results by patient group. The company says its models deliver reproducible insights across diverse patient populations, and its trust center lists AI training data and bias, AI security and AI monitoring as categories whose documents are released on request. No performance by sex, race, age or other group is published, although registries of 15,000 and 22,000 patients could produce it.

The FFRCT v2.0 510(k) summary says performance held across vessel size, location, territory and image quality without giving figures by group, and the indications page lists the populations the analysis was not evaluated in (including BMI over 35) and the four scanner makers it was validated on, which defines scope rather than showing results. Sex differences in coronary disease presentation and plaque make this a real gap. A diversity claim and scope statements with no results by group behind them.

Mechanisms let a clinician check the output, and the published error rate has no denominator. Clinicians review FFRCT values in an interactive 3D model alongside the original CT, vessels under 1.8 mm are grayed out rather than scored, and the company warns that values may depend on assumptions by the physician or its Case Analysts in uncertain anatomy.

Heartflow's own 510(k) summary for FFRCT v2.0 (K161772) reports per vessel sensitivity of 84.2 percent and specificity of 84.9 percent, and per patient sensitivity of 87.8 and specificity of 76.4 percent, from the prospective HeartFlowNXT study against invasive FFR, but does not state how many patients or vessels were tested, so a buyer has no denominator to hold the figure to; the indications page gives 84 percent accuracy, 82 percent sensitivity and 85 percent specificity, also without a count. No warranty, indemnity or remediation commitment is published.

Studies flow in automatically and results reach PACS and the medical record, without the systems named. Heartflow describes CT studies sent securely to it without manual export and results returned into both PACS and the electronic record, with a support team that deploys the software and integrates it with PACS, record and other hospital systems. Deployments are named, including The Valley Hospital as the first US site running PCI Navigator in routine use. No record or PACS vendor, interface standard or marketplace listing is published. Integration with named deployments behind it, systems unnamed.

A single cloud service, with the host named and the location not committed. Hospitals send CT studies to Heartflow, where they are processed on Amazon Web Services and worked on by trained Case Analysts, and results return to PACS and the record; no new scanner hardware is needed. Result turnaround is set by contract and can be delayed, which is why the analysis is not for urgent cases. The site names neither the AWS regions used for customers inside and outside the US nor whether studies cross borders for analysis or analyst review, and tenant isolation goes undescribed.

No price is published; the reimbursement side is documented. Heartflow publishes reimbursement resources and a market access value dossier. The dossier records a Category I CPT pathway for AI plaque analysis of coronary CT, CMS payment for plaque analysis as a separate outpatient hospital service, a July 2025 EviCore coverage recommendation for Plaque Analysis, and states frankly that current reimbursement does not adequately pay for FFRCT.

Those are what a hospital can recover from payers, not what Heartflow charges: no per analysis price, contract structure or volume terms are published, and the route in is a sales conversation. No price, with how the product is bought and paid for discoverable.

Where the analysis is validated to work, and where it is not, is named. The intended use covers adults 22 and over with suspected coronary artery disease (the combined analysis) and clinically stable symptomatic patients (FFRCT), and FFRCT's performance was validated in patients who were candidates for invasive angiography, with CT acquired within 60 days of invasive FFR.

The indications page names the populations not evaluated (acute coronary syndrome, recent infarction, prior bypass, BMI over 35, instability, stents, pacemaker leads, prosthetic valves, arrhythmia, heavy calcification), the CT scanner makers validated (Siemens, Canon, GE, Philips), and the acquisition conditions required (nitrates, no motion correction).

Coverage runs from diagnosis and plaque assessment to PCI planning, now in routine use at The Valley Hospital, and availability differs by country. Settings and specialties named and supported, with the limits stated.