Certifications and compliance.

CE-marked Class IIa medical device software with ISO 13485, GDPR and EU-regulatory documentation.

A female doctor in a white coat with a stethoscope examines an electrocardiogram displayed on a tablet on a desk in a medical office with books and a heart model in the background.
CE Class IIa · ISO 13485 · GDPR

Built to medical-device standards. Documented. Audited.

Cardiolyse is not a research prototype. It is a documented medical device operating under EU Regulations, with an ISO 13485 quality management system and ISO 27001-aligned information-security controls.

CE

CE-marked · Class IIa

Cardiolyse is CE-marked as Class IIa medical device software under EU Regulations. Technical file and clinical evaluation available under NDA.

Jurisdiction
European Economic Area
Class
IIa
ISO

ISO 13485 · GDPR

Certified quality management system for medical devices and full GDPR compliance for the processing of health data across the EU.

Quality
ISO 13485:2016
Privacy
GDPR & HIPAA-aligned
NHS

NHS Digital DSP Toolkit

Certified by NHS Digital for Data Security and Protection compliance, meeting the standards required to handle patient data within the UK National Health Service.

Standard
Data Security &
Protection Toolkit
Jurisdiction
United Kingdom
(NHS)

What the CE certificate covers — and what it does not.

Procurement and regulatory teams need the boundary stated plainly, so here it is. A certificate covers a defined intended purpose, not everything a platform can do.

Within scope

Certified medical-device software

Automated analysis of digital ECG recordings
Detection and measurement of ECG findings in the recording supplied
Presentation of results to a qualified healthcare professional
Outputs intended to support — not replace — clinical judgement
Clinician sign-off remains part of the diagnostic workflow
Handled separately

Analytics outside the certified purpose

HRV and wellness analytics, which are not a diagnostic claim
Research and retrospective dataset work, run under study agreements
Investigational features, kept clearly separated from certified output
Any deployment requiring approval outside the EEA and UK

How patient data is handled.

Our controls follow ISO 27001 principles.

GDPR and EU residency
Processing under a signed Data Processing Agreement
Hosted in EU data centres
Defined retention and deletion on request
Pseudonymisation supported for research work
Encryption and access
TLS in transit, encrypted at rest
Role-based access control
Full audit trail per recording and per user action
Segregated environments for production and research
ISO 13485 processes
Controlled design and development records
Risk management across the software lifecycle
Change control and release documentation
Post-market surveillance and complaint handling

What we can share with your compliance team.

Most of this is available under NDA. Tell us who is reviewing and what they need to sign off, and we will send the relevant set rather than a generic pack.

Is Cardiolyse certified as a medical device?

Yes. Cardiolyse is CE-marked as Class IIa medical device software under EU Regulations and operates under an ISO 13485 quality management system. Data handling is GDPR-compliant with EU-hosted infrastructure and ISO 27001-aligned controls, and Cardiolyse is certified by NHS Digital for Data Security and Protection compliance.

Which documents are available for a procurement review?

Under NDA we can provide the declaration of conformity, intended-purpose statement, clinical evaluation summary, ISO 13485 certificate, security and data-protection documentation, and the DPA we would sign with you.

Can Cardiolyse run inside our own cloud or an air-gapped environment?

Yes. Alongside the hosted EU deployment, the analytics engine can be deployed into your own cloud tenancy or an isolated environment where data residency or network policy requires it. These deployments are scoped with your IT and compliance teams.

Do the outputs replace a cardiologist?

No. The certified intended purpose is to support a qualified healthcare professional. Findings are presented for review, and clinician sign-off remains part of the workflow for diagnostic use.

Who do we contact about compliance questions?

Write to info@cardiolyse.com and describe the review you are running. Our team will get back to you, and it helps if you tell us up front which documents your reviewer needs.The call topic, the project concept and the role you see for ECG. We reply with a proposed work package.