Vivalink

Vivalink sells capture and delivery, with an arrhythmia analysis service on top. The product is a family of wearable monitors (ECG patch, temperature, oxygen saturation, blood pressure cuff), an edge network, a cloud data service described as a Clinical Intelligence Platform, and a development kit, sold so that digital health companies, hospital at home programs and trial sponsors can build their own applications on standardized physiological data.

The analysis the company names is an arrhythmia detection service covering more than 15 arrhythmia types with reports, trends and configurable thresholds, which its page describes as an integrated FDA cleared arrhythmia algorithm without saying whose it is; none of Vivalink's own clearances covers arrhythmia detection. Where a customer builds the application, the clinical interpretation is often the customer's, and much of the customer base buys reliable measurement and a pipeline. AI is a feature layer on a product whose value stands without it.

Oversight usually belongs to the customer, and the platform's own boundary is not published. Vivalink delivers measurements and arrhythmia detections into applications that other organizations build, and its arrhythmia service offers configurable thresholds, reports and trends, so the customer decides what triggers an alert, who receives it and how fast.

Nothing describes what the platform requires of an integrating application before clinical use, what guidance accompanies threshold settings, or whether a clinical safety review is part of a deployment, and a cleared sensor inside an unvalidated application is a risk this model creates. No operating point, sensitivity or false alarm rate is published for the arrhythmia detections that clinicians act on. Retrospective data file download supports after the fact review and audit.

Hardware and architecture are specified in detail and the analysis layer is not. Sensors are listed individually (ECG patch, temperature monitor, oxygen saturation sensor, blood pressure cuff) with parameters, reusability and field driven changes to data cache, battery and connectivity, and the architecture is concrete: sensors, edge networking, cloud data services, a development kit, on premise routers, web services and file download.

The sensor substrate traces to a thin film technology developed with Google's advanced technology group and launched as a consumer product. The arrhythmia service is described by what it reports (more than 15 arrhythmia types, trends, configurable thresholds) and as an integrated FDA cleared algorithm, with no model, maker, version, accuracy or operating point stated.

Partners and lineage are named, and the technical chain is not. The platform ingests third party glucose monitors, pulse oximeters and sleep monitors, the home page names trial and care partners including Clario and Current Health, and the sensor substrate's origin in a collaboration with Google's advanced technology group is stated.

The arrhythmia detection is described as an integrated FDA cleared algorithm whose maker is not named, so a customer cannot tell which outside party analyzes its patients' ECG data. No cloud or hosting provider, subprocessor register or contract manufacturer is named, and the privacy policy names no service providers. Data flows under two consent regimes, clinical care and regulated research, and nothing states whether either informs algorithm development.

Named customers and research use, with the evidence attaching to customers' studies rather than to Vivalink's own claims. The home page names Lilly, Harvard, Clario, Massachusetts General Hospital, AstraZeneca, Current Health, Stanford, AbbVie, Medpace, Bristol Myers Squibb, UCSF and Novartis, and company material has claimed more than 400 customers across 116 countries.

Research use includes a longitudinal atrial fibrillation study of up to 3,000 subjects, a COPD progression study and sleep research, and the company's blog describes a Brigham and Women's study in which its ECG monitor detected atrial fibrillation missed after cardiac surgery. These show the sensors are trusted to capture research grade data; the scientific questions belong to the investigators, and no accuracy or outcome figure for Vivalink's own arrhythmia service is published.

General assurances are published and the AI questions are not answered. The privacy policy (VivaLink, Inc., updated 28 November 2023) covers the website and the company's applications and services, including temperature, ECG and oxygen saturation data, names VivaLink as data controller under GDPR, says data is deleted after processing unless a legal storage obligation applies and that the company works hard to protect personal information, and does not say whether data is used to develop algorithms, how it is de-identified or where it is stored.

The company cites HIPAA, GDPR and 21 CFR Part 11 compliance and information security and device software standards, and offers an on premise router mode that keeps multi patient monitoring inside a facility. Nothing states a retention schedule, a training use position or a de-identification method, and the research business matters here because trial data is collected under consent terms that do not automatically extend to commercial algorithm development. No safety engineering is published.

Compliance is claimed and the privacy document does not support it. Company material states compliance with HIPAA, GDPR and 21 CFR Part 11. The privacy policy (VivaLink, Inc., updated 28 November 2023) reaches the company's applications and services and the health data they collect, but describes the company as a GDPR data controller and does not mention HIPAA, business associate status or agreements. Part 11 governs electronic records in regulated research, not health privacy.

The enablement model makes the contracting position a real question: customers build their own applications and own the patient relationship, so whether Vivalink contracts with covered entities directly, sits as a subcontractor to an application developer, or handles only de-identified streams depends on architecture and contract, and nothing describes it.

An information security certification is named in the company's own material without the details that make it assessable. Company material lists ISO/IEC 27001 among the platform's compliance basis, alongside 21 CFR Part 11 for regulated research records and the medical device software life cycle and risk management standards.

No revision, certificate number, certification body, audit period or scope statement is published, and scope decides whether the certificate covers the product platform or only corporate systems. No trust center, security page, penetration testing statement or vulnerability disclosure route is published, and the privacy policy says only that the company works hard to protect personal information. The surface is broad: connected sensors, edge routers on customer networks and a cloud platform shared by hundreds of integrators.

Vivalink's own US clearances are identifiable, and the arrhythmia algorithm it sells is not matched to one. FDA's database lists three 510(k) clearances for VivaLNK, Inc.: the VV330 Continuous ECG Platform with adhesive patch (K191870, January 2020, product code DRG, a radiofrequency physiological signal transmitter and receiver, 21 CFR 870.2910) and the Fever Scout continuous thermometer (K162137, January 2017, and K181013, August 2018, product code FLL). None covers arrhythmia detection.

The arrhythmia page describes an "Integrated FDA Cleared Arrhythmia Algorithm" without naming its maker or clearance, which suggests a third party's cleared algorithm; the oxygen saturation and blood pressure devices are not in Vivalink's own clearance list. The site carries an EU electronic instructions for use page, and company material has claimed EU and Chinese clearances and 21 CFR Part 11 compliance for regulated research.

Nothing is published on how the arrhythmia analysis or any other derived output is governed or tested across patient groups: no fairness testing, subgroup performance, calibration, drift monitoring, governance framework or outside audit. The quality, software life cycle, risk management and information security standards the company cites govern development discipline and data protection, and none requires showing that a measurement or algorithm performs evenly across populations.

Two exposures apply directly. Oxygen saturation is measured optically, and optical oximetry can overestimate saturation in patients with darker skin. Electrocardiographic morphology and arrhythmia prevalence vary with sex, age, body habitus and ancestry, and patch placement and signal quality vary with chest size and body composition. Customers build these outputs into their own products for many populations, inheriting whatever performance differences exist with no published data to check them against.

Nothing is published on what happens when a detection is wrong. The company publishes a product warranty and an end user license agreement, which cover the hardware and the software license rather than clinical consequences, and no service level agreement, uptime commitment, indemnity, remediation position or accuracy figure for the arrhythmia service is published.

Allocation runs three deep in this model: a patient is monitored by a Vivalink sensor, through a Vivalink pipeline, inside an application a customer built, used by a clinician the customer's own customer may employ, so a missed cardiac event could originate in the sensor, the transmission, the algorithm, the integrating application's alert logic or the clinical response, and nothing describes how responsibility divides. For research customers, lost data is also a study integrity problem.

Integration is the product, with named device sources and trial partners and no named record system. The platform offers standardized, integration ready data formats for clinical, research and analytics platforms, a development kit for mobile and cloud integration, RESTful API access to arrhythmia results, machine to machine web services, file download and multi site consolidation with integrity checks, and ingests third party glucose monitors, pulse oximeters and sleep monitors alongside its own sensors.

Clario, a trial data provider, is among the named partners, and the company has described a partnership placing its technology inside global trial infrastructure. No electronic health record is named, no HL7 or FHIR conformance is stated, and no marketplace listing appears, so a clinical buyer cannot confirm compatibility with its record, and a trial sponsor cannot confirm which research data standard the outputs follow.

Three deployment modes are described, including one that keeps data inside the customer's facility. Cloud web services support direct machine to machine integration for remotely hosted applications; development kit enabled routers support multi patient monitoring on premise, consolidating and processing within a facility; and retrospective data file download serves pipelines that need no live stream.

The on premise mode gives a site with data location obligations a way to monitor without every stream reaching a vendor cloud. The hosted side is not described: no cloud provider, region, residency commitment or tenancy model for a platform serving hundreds of customers, and the privacy policy does not say where data is stored. Nothing states whether the on premise mode still depends on the cloud for management and updates.

Nothing a buyer can use to size the cost is published: no pricing page, unit of charge, range, tier, implementation fee or minimum commitment, and purchase routes end in a contact form. The site footer links a product warranty, an end user license agreement and separate license terms for developers and solution partners, which govern use rather than price.

The unit is inferable in principle and never stated: reusable sensors with a replacement cycle, consumable adhesives, a recurring data platform and a development kit, for customers ranging from a trial sponsor running a fixed study of thousands of subjects to a hospital at home program running continuously. Developers building on the platform need a cost of goods before committing engineering effort.

Coverage is named broadly, with validation behind part of it. Parameters span continuous ECG with heart rate variability, temperature, oxygen saturation, blood pressure, respiratory rate and activity, extended by third party glucose and sleep monitors; use cases span ambulatory cardiac monitoring and arrhythmia detection, cardiac rehabilitation, hospital at home, general remote monitoring and decentralized clinical trials, with company material claiming customers in 116 countries.

Validation stands behind the cleared ECG platform and thermometers and behind named research use (atrial fibrillation, COPD and sleep studies, and a Brigham and Women's post cardiac surgery study the company describes), not behind every parameter and setting. Nothing states how the customer base divides between clinical and research use or which deployments run at scale.