Certifications and compliance.
CE-marked Class IIa medical device software with ISO 13485, GDPR and EU-regulatory documentation.
Regulatory status
Built to medical-device standards. Documented. Audited.
Cardiolyse is not a research prototype. It is a documented medical device operating under EU Regulations, with an ISO 13485 quality management system and ISO 27001-aligned information-security controls.
CE-marked · Class IIa
Cardiolyse is CE-marked as Class IIa medical device software under EU Regulations. The technical file and clinical evaluation are available to partners under NDA.
ISO 13485 · GDPR
A certified quality management system for medical devices, and GDPR-compliant processing of health data with EU-hosted infrastructure and signed DPAs.
NHS Digital DSP Toolkit
Certified by NHS Digital for Data Security and Protection compliance, meeting the standards required to handle patient data within the UK National Health Service.
Scope of certification
What the CE certificate covers — and what it does not.
Procurement and regulatory teams need the boundary stated plainly, so here it is. A certificate covers a defined intended purpose, not everything a platform can do.
Certified medical-device software
- Automated analysis of digital ECG recordings
- Detection and measurement of ECG findings in the recording supplied
- Presentation of results to a qualified healthcare professional
- Outputs intended to support — not replace — clinical judgement
- Clinician sign-off remains part of the diagnostic workflow
Analytics outside the certified purpose
- HRV and wellness analytics, which are not a diagnostic claim
- Research and retrospective dataset work, run under study agreements
- Investigational features, kept clearly separated from certified output
- Any deployment requiring approval outside the EEA and UK
Information security
How patient data is handled.
Our controls follow ISO 27001 principles.
Data protection
GDPR and EU residency
- Processing under a signed Data Processing Agreement
- Hosted in EU data centres
- Defined retention and deletion on request
- Pseudonymisation supported for research work
Technical controls
Encryption and access
- TLS in transit, encrypted at rest
- Role-based access control
- Full audit trail per recording and per user action
- Segregated environments for production and research
Quality system
ISO 13485 processes
- Controlled design and development records
- Risk management across the software lifecycle
- Change control and release documentation
- Post-market surveillance and complaint handling
Documentation
What we can share with your compliance team.
Most of this is available under NDA. Tell us who is reviewing and what they need to sign off, and we will send the relevant set rather than a generic pack.
Is Cardiolyse certified as a medical device?
Yes. Cardiolyse is CE-marked as Class IIa medical device software under EU Regulations and operates under an ISO 13485 quality management system. Data handling is GDPR-compliant with EU-hosted infrastructure and ISO 27001-aligned controls, and Cardiolyse is certified by NHS Digital for Data Security and Protection compliance.
Which documents are available for a procurement review?
Under NDA we can provide the declaration of conformity, intended-purpose statement, clinical evaluation summary, ISO 13485 certificate, security and data-protection documentation, and the DPA we would sign with you.
Can Cardiolyse run inside our own cloud or an air-gapped environment?
Yes. Alongside the hosted EU deployment, the analytics engine can be deployed into your own cloud tenancy or an isolated environment where data residency or network policy requires it. These deployments are scoped with your IT and compliance teams.
Do the outputs replace a cardiologist?
No. The certified intended purpose is to support a qualified healthcare professional. Findings are presented for review, and clinician sign-off remains part of the workflow for diagnostic use.
Who do we contact about compliance questions?
Write to [email protected] and describe the review you are running. Our team will get back to you, and it helps if you tell us up front which documents your reviewer needs.
For everything else, see the full FAQ.
Need the documentation pack for a review?
Tell us which standards your team is assessing against and who is signing off. We will send the relevant documents under NDA.