Historical clinical datasets were used to validate the AI/ML algorithm performance (View Classification, Live Guidance, and Auto Record) following the integration of new ultrasound probe compatibility.
Historical reference datasets; AI/ML validation; Retrospective clinical data
80 patients (40 US and 40 non-US); subgroup analyses by BMI, age, and sex; Sample Size: 80 patients (~270,000 frames)
Not applicable for this study
View Classification (Cohen's kappa), Live Guidance (PPV), Auto Record (PPV)
AI Performance
Output
Algorithm
Acceptance
Observed
Dev DS
Dev Readers
Test DS
Test Readers
Cardiac ultrasound view classification
Machine learning model
Cohen's kappa lower bound 95% CI > 0.6
Cohen's kappa 0.640–0.929
—
—
AI/ML Performance Testing: ~270,000 frames from 40 US patients and 40 non-US patients
—
Cardiac ultrasound live guidance
Machine learning model
PPV lower bound 95% CI > 0.8
Combined PPV 0.872–1.000
—
—
AI/ML Performance Testing: ~270,000 frames from 40 US patients and 40 non-US patients
—
Cardiac ultrasound auto-record
Machine learning model
PPV lower bound 95% CI > 0.6 and point estimate > 0.8
PPV 0.871–1.000
—
—
AI/ML Performance Testing: ~270,000 frames from 40 US patients and 40 non-US patients
—
Indications for Use
The HeartFocus software is intended to assist and guide medical professionals in the acquisition of cardiac ultrasound images. HeartFocus software is an accessory to compatible general-purpose diagnostic ultrasound systems. Heartfocus guides the acquisition of two-dimensional transthoracic echocardiography (2D-TTE). Specifically, in the acquisition of the following standard views: Parasternal Long-Axis (PLAX), Parasternal Short-Axis at the Aortic Valve (PSAX-AV), Parasternal Short-Axis at the Mitral Valve (PSAX-MV), Parasternal Short-Axis at the Papillary Muscle (PSAX-PM), Apical 4-Chamber (A4C), Apical 5-Chamber (A5C), Apical 2-Chamber (A2C), Apical 3-Chamber (A3C), Subcostal 4-Chamber (SC-4C), and Subcostal Inferior Vena Cava (SC-IVC). HeartFocus software is indicated for use in adult patients who require a cardiac ultrasound exam.
Device Story
HeartFocus is an AI-driven software accessory for general-purpose ultrasound systems; assists medical professionals in acquiring 10 standard 2D-TTE views. Input: real-time ultrasound image stream from compatible probes (e.g., Butterfly iQ+/iQ3). Operation: ML models analyze probe position and image quality; provides real-time visual guidance cues; detects diagnostic-quality frames; triggers automatic recording or enables retrospective 'best-effort' recording. Used in clinical settings by trained professionals; operates offline on mobile devices (iPhone/iPad); stores data locally. Output: diagnostic-quality ultrasound clips for clinical review. Benefits: standardizes image acquisition quality; assists users in achieving anatomically correct views; improves workflow efficiency. Clinical decision-making is supported by the high-quality images acquired via this guidance.
Clinical Evidence
No clinical investigations conducted. Non-clinical testing included: 1) Summative usability evaluation (N=8) showing 100% task success for iPhone UI/UX. 2) AI/ML performance testing (~270,000 frames) confirming view classification (kappa 0.640–0.929), Auto Record PPV (0.871–1.000), and Live Guidance PPV (0.872–1.000). 3) Software/cybersecurity testing (static analysis, penetration testing) confirming 0 critical security hotspots and 100% system-level test pass rate.
Technological Characteristics
Software-based guidance system; operates on iOS/iPadOS mobile platforms. AI/ML-driven image analysis; offline processing; local data storage. Connectivity: DICOM protocol for image transfer. Cybersecurity: application-level patient data encryption (HEAF-1578). Standards: IEC 62366-1 (usability), IEC 62304 (software lifecycle), IEC 81001-5-1 (cybersecurity).
Indications for Use
Indicated for adult patients (22+ years) requiring a cardiac ultrasound exam for the acquisition of 10 standard 2D-TTE views.
Regulatory Classification
Identification
A radiological acquisition and/or optimization guidance system is a device that is intended to aid in the acquisition and/or optimization of images and/or diagnostic signals. The device interfaces with the acquisition system, analyzes its output, and provides guidance and/or feedback to the operator for improving image and/or signal quality.
Special Controls
*Classification.* Class II (special controls). The special controls for this device are:(1) Design verification and validation must include:
(i) A detailed, technical device description, including a detailed description of the impact of any software and hardware on the device's functions, the associated capabilities and limitations of each part, and the associated inputs and outputs.
(ii) A detailed, technical report on the non-clinical performance testing of the subject device in the intended use environments, using relevant consensus standards when applicable.
(iii) A detailed report on the clinical performance testing, obtained from either clinical testing, accepted virtual/physical systems designed to capture clinical variability, comparison to a closely-related device with established clinical performance, or other sources that are justified appropriately. The choice of the method must be justified given the risk of the device and the general acceptance of the test methods. The report must include the following:
(A) A thorough description of the testing protocol(s).
(B) A thorough, quantitative evaluation of the diagnostic utility and quality of images/data acquired, or optimized, using the device.
(C) A thorough, quantitative evaluation of the performance in a representative user population and patient population, under anticipated conditions and environments of use.
(D) A thorough discussion on the generalizability of the clinical performance testing results.
(E) A thorough discussion on use-related risk analysis/human factors data.
(iv) A detailed protocol that describes, in the event of a future change, the level of change in the device technical specifications or indications for use at which the change or changes could significantly affect the safety or effectiveness of the device and the risks posed by these changes. The assessment metrics, acceptance criteria, and analytical methods used for the performance testing of changes that are within the scope of the protocol must be included.
(v) Documentation of an appropriate training program, including instructions on how to acquire and process quality images and video clips, and a report on usability testing demonstrating the effectiveness of that training program on user performance, including acquiring and processing quality images.
(2) The labeling required under § 801.109(c) of this chapter must include:
(i) A detailed description of the device, including information on all required and/or compatible parts.
(ii) A detailed description of the patient population for which the device is indicated for use.
(iii) A detailed description of the intended user population, and the recommended user training.
(iv) Detailed instructions for use, including the information provided in the training program used to meet the requirements of paragraph (b)(1)(iv) of this section.
(v) A warning that the images and data acquired using the device are to be interpreted only by qualified medical professionals.
(vi) A detailed summary of the reports required under paragraphs (b)(1)(ii) and (iii) of this section.
(vii) A statement on upholding the As Low As Reasonably Achievable (ALARA) principle with a discussion on the associated device controls/options.
{0}
**FDA** **U.S. FOOD & DRUG**
ADMINISTRATION
DESKI
Kelly Porfirio
Head of QARA
2 Pl. De La Bourse
Bordeaux, 33000
France
June 3, 2026
Re: K260780
Trade/Device Name: HeartFocus
Regulation Number: 21 CFR 892.2100
Regulation Name: Radiological Acquisition And/Or Optimization Guidance System
Regulatory Class: Class II
Product Code: QJU
Dated: May 28, 2026
Received: May 28, 2026
Dear Kelly Porfirio:
We have reviewed your section 510(k) premarket notification of intent to market the device referenced above and have determined the device is substantially equivalent (for the indications for use stated in the enclosure) to legally marketed predicate devices marketed in interstate commerce prior to May 28, 1976, the enactment date of the Medical Device Amendments, or to devices that have been reclassified in accordance with the provisions of the Federal Food, Drug, and Cosmetic Act (the Act) that do not require approval of a premarket approval application (PMA). You may, therefore, market the device, subject to the general controls provisions of the Act. Although this letter refers to your product as a device, please be aware that some cleared products may instead be combination products. The 510(k) Premarket Notification Database available at https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm identifies combination product submissions. The general controls provisions of the Act include requirements for annual registration, listing of devices, good manufacturing practice, labeling, and prohibitions against misbranding and adulteration. Please note: CDRH does not evaluate information related to contract liability warranties. We remind you, however, that device labeling must be truthful and not misleading.
If your device is classified (see above) into either class II (Special Controls) or class III (PMA), it may be subject to additional controls. Existing major regulations affecting your device can be found in the Code of Federal Regulations, Title 21, Parts 800 to 898. In addition, FDA may publish further announcements concerning your device in the Federal Register.
{1}
K260780 - Kelly Porfirio
Page 2
Additional information about changes that may require a new premarket notification are provided in the FDA guidance documents entitled "Deciding When to Submit a 510(k) for a Change to an Existing Device" (https://www.fda.gov/media/99812/download) and "Deciding When to Submit a 510(k) for a Software Change to an Existing Device" (https://www.fda.gov/media/99785/download).
Your device is also subject to, among other requirements, the Quality Management System Regulation (QMSR) (21 CFR Part 820), which includes, but is not limited to, ISO 13485 clause 7.3 (Design controls), ISO 13485 clause 8.3 (Nonconforming product), ISO 13485 clause 8.5.2 (Corrective action), and ISO 13485 clause 8.5.3 (Preventative action). Please note that regardless of whether a change requires premarket review, the QMSR requires device manufacturers to review and approve changes to device design and production (ISO 13485 clause 7.3 and ISO 13485 clause 7.5) and document changes and approvals in the Medical Device File (ISO 13485 clause 4.2.3).
Please be advised that FDA's issuance of a substantial equivalence determination does not mean that FDA has made a determination that your device complies with other requirements of the Act or any Federal statutes and regulations administered by other Federal agencies. You must comply with all the Act's requirements, including, but not limited to: registration and listing (21 CFR Part 807); labeling (21 CFR Part 801); medical device reporting (reporting of medical device-related adverse events) (21 CFR Part 803) for devices or postmarketing safety reporting (21 CFR Part 4, Subpart B) for combination products (see https://www.fda.gov/combination-products/guidance-regulatory-information/postmarketing-safety-reporting-combination-products); good manufacturing practice requirements as set forth in the Quality Management System Regulation (QMSR) (21 CFR Part 820) for devices or current good manufacturing practices (21 CFR Part 4, Subpart A) for combination products; and, if applicable, the electronic product radiation control provisions (Sections 531-542 of the Act); 21 CFR Parts 1000-1050.
All medical devices, including Class I and unclassified devices and combination product device constituent parts are required to be in compliance with the final Unique Device Identification System rule ("UDI Rule"). The UDI Rule requires, among other things, that a device bear a unique device identifier (UDI) on its label and package (21 CFR 801.20(a)) unless an exception or alternative applies (21 CFR 801.20(b)) and that the dates on the device label be formatted in accordance with 21 CFR 801.18. The UDI Rule (21 CFR 830.300(a) and 830.320(b)) also requires that certain information be submitted to the Global Unique Device Identification Database (GUDID) (21 CFR Part 830 Subpart E). For additional information on these requirements, please see the UDI System webpage at https://www.fda.gov/medical-devices/device-advice-comprehensive-regulatory-assistance/unique-device-identification-system-udi-system.
Also, please note the regulation entitled, "Misbranding by reference to premarket notification" (21 CFR 807.97). For questions regarding the reporting of adverse events under the MDR regulation (21 CFR Part 803), please go to https://www.fda.gov/medical-devices/medical-device-safety/medical-device-reporting-mdr-how-report-medical-device-problems.
For comprehensive regulatory information about medical devices and radiation-emitting products, including information about labeling regulations, please see Device Advice (https://www.fda.gov/medical-devices/device-advice-comprehensive-regulatory-assistance) and CDRH Learn (https://www.fda.gov/training-and-continuing-education/cdrh-learn). Additionally, you may contact the Division of Industry and Consumer Education (DICE) to ask a question about a specific regulatory topic. See the DICE website (https://www.fda.gov/medical-devices/device-advice-comprehensive-regulatory-
{2}
K260780 - Kelly Porfirio
Page 3
assistance/contact-us-division-industry-and-consumer-education-dice) for more information or contact DICE by email (DICE@fda.hhs.gov) or phone (1-800-638-2041 or 301-796-7100).
Sincerely,
Digitally signed by Michael D.
O'hara -S
Date: 2026.06.03 13:47:20 -04'00'
For
Yanna Kang, Ph.D.
Assistant Director
Mammography and Ultrasound Team
DHT8C: Division of Radiological
Imaging and Radiation Therapy Devices
OHT8: Office of Radiological Health
Office of Product Evaluation and Quality
Center for Devices and Radiological Health
Enclosure
{3}
# Indications for Use
| Please type in the marketing application/submission number, if it is known. This textbox will be left blank for original applications/submissions. | K260780 | ? |
| --- | --- | --- |
| Please provide the device trade name(s). | | ? |
| HeartFocus | | |
| Please provide your Indications for Use below. | | ? |
| INTENDED USE/INDICATIONS FOR USE | | |
| The HeartFocus software is intended to assist and guide medical professionals in the acquisition of cardiac ultrasound images. HeartFocus software is an accessory to compatible general-purpose diagnostic ultrasound systems. Heartfocus guides the acquisition of two-dimensional transthoracic echocardiography (2D-TTE). Specifically, in the acquisition of the following standard views: Parasternal Long-Axis (PLAX), Parasternal Short-Axis at the Aortic Valve (PSAX-AV), Parasternal Short-Axis at the Mitral Valve (PSAX-MV), Parasternal Short-Axis at the Papillary Muscle (PSAX-PM), Apical 4-Chamber (A4C), Apical 5-Chamber (A5C), Apical 2-Chamber (A2C), Apical 3-Chamber (A3C), Subcostal 4-Chamber (SC-4C), and Subcostal Inferior Vena Cava (SC-IVC). | | |
| HeartFocus software is indicated for use in adult patients who require a cardiac ultrasound exam. | | |
| Please select the types of uses (select one or both, as applicable). | ☑ Prescription Use (21 CFR 801 Subpart D) ☐ Over-The-Counter Use (21 CFR 801 Subpart C) | ? |
| Please select the age group(s) for which the device(s) is to be used. | ☐ Neonates/Newborns (Birth to < 29 days old) ☐ Infants (29 days old to < 2 years old) ☐ Children (2 years old to < 12 years old) ☐ Adolescents (12 years old to < 22 years old) ☑ Adults (22 years old and greater) | ? |
{4}
510(k) #: K260780
# 510(k) Summary
Prepared on: 2026-04-21
# Contact Details
21 CFR 807.92(a)(1)
| Applicant Name | DESKi |
| --- | --- |
| Applicant Address | 2 Place de la Bourse Bordeaux 33000 France |
| Applicant Contact Telephone | +34658318060 |
| Applicant Contact | Ms. Kelly Porfirio |
| Applicant Contact Email | kelly.porfirio@deski.ai |
# Device Name
21 CFR 807.92(a)(2)
| Device Trade Name | HeartFocus |
| --- | --- |
| Common Name | Radiological acquisition and/or optimization guidance system |
| Classification Name | Image Acquisition And/Or Optimization Guided By Artificial Intelligence |
| Regulation Number | 892.2100 |
| Product Code(s) | QJU |
# Legally Marketed Predicate Devices
21 CFR 807.92(a)(3)
| Predicate # | Predicate Trade Name (Primary Predicate is listed first) | Product Code |
| --- | --- | --- |
| K242807 | HeartFocus | QJU |
# Device Description Summary
21 CFR 807.92(a)(4)
# DEVICE DESCRIPTION SUMMARY
The HeartFocus software is a radiological computer-assisted acquisition guidance system that provides real-time user guidance during echocardiography to assist the user in acquiring anatomically standard diagnostic-quality 2D echocardiographic views. HeartFocus software is an accessory to compatible general-purpose diagnostic ultrasound systems.
HeartFocus is intended to be used by medical professionals who have received appropriate training on ultrasound basics and training on using the HeartFocus software, provided by either DESKi or by a trained medical professional while using approved training materials.
It supports the acquisitions of 10 echocardiographic views: Parasternal Long-Axis (PLAX), Parasternal Short-Axis at the Aortic Valve (PSAX-AV), Parasternal Short-Axis at the Mitral Valve (PSAX-MV), Parasternal Short-Axis at the Papillary Muscle (PSAX-PM), Apical 4-Chamber (A4C), Apical 5-Chamber (A5C), Apical 2-Chamber (A2C), Apical 3-Chamber (A3C), Subcostal 4-Chamber (SC-4C), and Subcostal Inferior Vena Cava (SC-IVC).
To allow the acquisition of these views, HeartFocus can connect to an ultrasound system, allowing it to receive a stream of ultrasound images.
The standard views acquired with HeartFocus may be assessed by qualified medical professionals to support their decision-making regarding patient care. The collected exams can be transferred notably using DICOM protocols.
HeartFocus is an application that operates entirely offline, without requiring a cloud server to provide its functionalities. All collected medical data is stored locally on the mobile device. This data is never transferred to a server controlled by DESKi.
HeartFocus uses artificial intelligence (AI) to emulate the expertise of sonographers in positioning the probe on the patient's chest and in identifying and recording diagnostic-quality clips.
{5}
It proposes 4 major functionalities to assist healthcare professionals in the acquisition of cardiac ultrasound images: Live guidance, Diagnostic-quality view detection, Auto record, and Best-effort record.
#### Live Guidance
This feature provides real-time cues to the user on how to move the probe on the patient's chest to obtain diagnostic-quality images. The guidance UI is generated by a machine learning model that infers the probe's position relative to the target position, i.e. that would provide diagnostic-quality images. It emulates how a sonographer would manipulate the ultrasound probe to acquire a diagnostic-quality clip.
#### Diagnostic-Quality View Detection
This feature detects real-time diagnostic-quality images and informs the user to hold the position and perform automatic recording. This detection is performed by a machine learning model that also allows the grading of the recorded clips. When the probe is well positioned and the image is of diagnostic quality, a triangle surrounding the ultrasound image appears in color shifting from blue (lower quality) to green (higher quality). The user shall hold the position so that an automated recording can be performed.
#### Auto Record
This feature triggers an automatic recording of a clip when the quality is predicted to be of diagnostic quality for a sufficient amount of time.
When the ultrasound frames are consecutively classified as diagnostic quality for a preset period, the 'auto record' feature automatically captures a clip.
The auto-record user interface (UI) element fills itself to encourage the user to hold its position.
When the entire auto-record UI element is full, the record is saved and the UI indicates it to the user.
This feature emulates how a sonographer would identify diagnostic-quality clips and record them.
#### Best-Effort Record (BER)
This feature continually assesses clip quality while the user is scanning and, if the user cannot obtain a clip sufficient for an Auto-Record, the software allows the user to record the highest quality clip obtained so far retrospectively.
Once recorded, the clip is available for a visual review where the user can either save the clip or cancel his action and go back to the acquisition. It emulates how a sonographer would identify the best diagnostic-quality clips retrospectively.
## Intended Use/Indications for Use
21 CFR 807.92(a)(5)
### INTENDED USE/INDICATIONS FOR USE
The HeartFocus software is intended to assist and guide medical professionals in the acquisition of cardiac ultrasound images. HeartFocus software is an accessory to compatible general-purpose diagnostic ultrasound systems. HeartFocus guides the acquisition of two-dimensional transthoracic echocardiography (2D-TTE). Specifically, in the acquisition of the following standard views: Parasternal Long-Axis (PLAX), Parasternal Short-Axis at the Aortic Valve (PSAX-AV), Parasternal Short-Axis at the Mitral Valve (PSAX-MV), Parasternal Short-Axis at the Papillary Muscle (PSAX-PM), Apical 4-Chamber (A4C), Apical 5-Chamber (A5C), Apical 2-Chamber (A2C), Apical 3-Chamber (A3C), Subcostal 4-Chamber (SC-4C), and Subcostal Inferior Vena Cava (SC-IVC).
HeartFocus software is indicated for use in adult patients who require a cardiac ultrasound exam.
## Indications for Use Comparison
21 CFR 807.92(a)(5)
The Indications for Use of the subject device (HeartFocus v1.3.0) are identical to those of the legally marketed predicate device (HeartFocus v1.1.1, K242807). Both devices are intended to assist and guide medical professionals in the acquisition of cardiac ultrasound images, as an accessory to compatible general-purpose diagnostic ultrasound systems, guiding the acquisition of two-dimensional transthoracic echocardiography (2D-TTE) in the 10 standard views (PLAX, PSAX-AV, PSAX-MV, PSAX-PM, A4C, A5C, A2C, A3C, SC-4C, SC-IVC) in adult patients who require a cardiac ultrasound exam. This is explicitly confirmed in the Special 510(k) Summary, Section V [21 CFR 807.92(a)(5)] of this submission.
## Technological Comparison
21 CFR 807.92(a)(6)
The subject device (HeartFocus v1.3.0) has the same intended use, indications for use, and fundamental scientific technology as the legally marketed predicate device (HeartFocus v1.1.1, K242807). The core AI/ML-driven clinical features (Live Guidance, Diagnostic-Quality View Detection, Auto Record, and Best-Effort Record) remain unchanged in their intended clinical performance and offline operational logic.
The modifications introduced in the subject device, which prompted this Special 510(k) submission, are as follows:
1. Hardware Platform Expansion (Primary Change): Adaptation of the graphical user interface (GUI) and user experience (UX) to support Apple iPhone devices (iOS 17+) operating in portrait mode, scaling down from the originally cleared iPad (tablet) format. All core functional elements and clinical workflows remain unchanged. Minimum iPhone hardware requirements: iOS 17; Apple A12 Bionic CPU;
{6}
4.7-inch display (16:9 ratio).
2. Software Maintenance and Security (Minor Updates): Routine Software of Unknown Provenance (SOUP) updates (Qt Framework 6.8.5 and Butterfly SDK 2.0.2), and a security patch (HEAF-1578) adding an application-level patient data encryption mechanism to mitigate data extraction risks on compromised devices.
The following intermediate changes were implemented strictly in accordance with the device's FDA-cleared Predetermined Change Control Plan (PCCP, K242807) and do not constitute new modifications requiring additional 510(k) review beyond what was already authorized:
PCCP M1 + M2, Ultrasound Probe Compatibility: Expansion of hardware compatibility to include the Butterfly Network iQ+ and iQ3 ultrasound probes, with corresponding AI/ML algorithm retraining and validation.
PCCP M3, Operating System Compatibility: Extension of HeartFocus software compatibility to Apple iPadOS (tablet platform).
These differences do not raise new questions of safety or effectiveness. The modifications do not alter the device's principle of operation, its AI/ML scientific basis, its clinical features, its intended use, or it indications for use. Performance testing, including summative usability evaluation (IEC 62366-1:2015), AI/ML algorithm validation, software verification and validation (IEC 62304), and cybersecurity assessment, was conducted to confirm that the modifications do not adversely affect the safety or effectiveness of the device. Full details are provided in the attached Summary of Verification and Validation Activities.
## Non-Clinical and/or Clinical Tests Summary & Conclusions 21 CFR 807.92(b)
HeartFocus v1.3.0 was evaluated through three categories of non-clinical testing. No clinical investigations under 21 CFR Part 812 were conducted or are required for this submission.
TEST 1 - SUMMATIVE USABILITY EVALUATION (Primary Change: iPhone UI/UX Adaptation)
Standard: IEC 62366-1:2015+AMD1:2020
Protocol: N=8 representative novice participants (medical professionals with basic ultrasound training); simulated clinical environment; iPhone with HeartFocus v1.3.0
and Butterfly iQ3 probe; healthy volunteer subject. Tasks evaluated: SCN-HF-3 (Understand AI guidance and Diagnostic-quality view detection) and SCN-HF-4 (Record a clip using manual record).
Acceptance Criteria: No unmitigated critical use errors; no hazardous situations with unacceptable residual risk.
Protocol Deviations: None.
Results: PASS - 100% task success (8/8 participants); 0 use errors; 0 close calls; positive System Usability Scale (SUS) and AttrakDiff scores.
Conclusion: The iPhone portrait-mode UI/UX adaptation does not introduce new usability risks. All acceptance criteria were met.
TEST 2 - AI/ML PERFORMANCE TESTING (Intermediate Change: Butterfly Probe Compatibility)
Protocol: ~270,000 frames; 40 US patients + 40 non-US patients; historical reference datasets; subgroup analyses by BMI, age, and sex.
Protocol identical to the FDA-cleared PCCP (K242807, Modifications M1, M2, M3).
Acceptance Criteria:
- View Classification: Cohen's kappa lower bound 95% CI > 0.6
- Live Guidance: PPV lower bound 95% CI > 0.8
- Auto Record: PPV lower bound 95% CI > 0.6 and point estimate > 0.8
Protocol Deviations: None.
Results: PASS - View Classification kappa: 0.640–0.929; Auto Record PPV: 0.871–1.000; Live Guidance Combined PPV: 0.872–1.000. All PCCP success criteria met on first iteration.
Conclusion: AI/ML performance with Butterfly iQ+ and iQ3 probes meets all pre-specified acceptance criteria and is substantially equivalent to the cleared predicate.
TEST 3 - SOFTWARE AND CYBERSECURITY TESTING (Maintenance Patches: Qt 6.8.5, Butterfly SDK 2.0.2, Security Patch HEAF-1578)
Methods: Static Application Security Testing (SonarQube v2025.1.5); automated unit and integration testing; system-level functional testing; independent penetration testing per OSSTMM, OWASP Mobile Top 10, and IEC 81001-5-1:2021.
Standards: IEC 62304:2006/A1:2015; IEC 81001-5-1:2021; FDA General Principles of Software Validation.
Acceptance Criteria: Line coverage > 60%; 0 critical security hotspots; all predefined test runs pass.
Protocol Deviations: None.
Results: PASS - 0 security hotspots; 76.19% line coverage; 82.24% function coverage; 100% system-level tests passed. Security patch HEAF-1578 confirmed effective by penetration test. One non-clinical anomaly deferred (HFTD-1097: App Store page validation - no safety or cybersecurity impact).
Conclusion: Software and cybersecurity testing confirms that maintenance patches do not introduce software regressions or security vulnerabilities. All acceptance criteria were met.
OVERALL CONCLUSION:
All non-clinical testing for HeartFocus v1.3.0 passed all pre-specified acceptance criteria. The modifications do not adversely affect the safety or effectiveness of the device. HeartFocus v1.3.0 is substantially equivalent to HeartFocus v1.1.1 (K242807).
