Heartflow, Inc. (HTFL) Business

Verbatim Item 1 Business section from Heartflow, Inc.'s latest 10-K. Filing date: 2026-03-18. Accession: 0001464521-26-000042.

This page reproduces the company's own Item 1 Business text from the linked SEC filing. It is filer text, not grepcent analysis, scoring, or investment advice.

Informational only - not investment advice. See Disclaimer.

Extracted from Item 1 Business to the first Item 1A/1B/1C/2 boundary after HTML sanitization. Confidence: high. Source form: 10-K. Character span: 33131-149350.

Back to HTFL company profile

Item 1. Business

Overview

We provide software and artificial intelligence (“AI”) designed to deliver a more accurate and clinically effective non-invasive solution for diagnosing and managing coronary artery disease (“CAD”), a leading cause of death worldwide. As of December 31, 2025, our Heartflow Platform has been used to assess CAD in more than 600,000 patients, including 219,000 in 2025 alone. We believe that we are the most widely adopted AI-powered test for CAD. Our novel platform leverages AI and advanced computational fluid dynamics to create a personalized 3D model of a patient’s heart from a single coronary computed tomography angiography (“CCTA”), a specialized type of scan that provides detailed images of the heart’s arteries. Our Heartflow Platform delivers actionable insights on blood flow, stenosis, plaque volume and plaque composition thereby overcoming the limitations of traditional non-invasive imaging tests which rely on indirect measures of coronary disease and lead to higher false negative and false positive rates, as demonstrated by our PRECISE trial. We believe the differentiated accuracy and clinical utility of our Heartflow Platform, along with its ability to enhance workflows, will continue to support our growth and advance the “CCTA + Heartflow” pathway as the definitive standard for the non-invasive diagnosis and management of CAD.

Cardiovascular disease is the leading cause of death worldwide, with CAD being the most lethal form. CAD occurs when plaque—a buildup of cholesterol, fat, calcium and other substances—accumulates on the walls of the coronary arteries, restricting blood flow and increasing the risk of heart attack or stroke. This condition is responsible for half of all cardiovascular-related deaths globally. In the United States alone, the Centers for Disease Control (“CDC”) estimates that approximately 805,000 people suffer a heart attack each year. Despite significant advancements in therapeutic and interventional treatments, CAD remains a leading cause of death globally because healthcare systems generally lack scalable methods to efficiently detect, diagnose and quantify CAD at a personalized level.

CCTA has emerged as a leading non-invasive imaging method for evaluating CAD, offering direct and detailed visualization of the coronary arteries. Unlike traditional stress-based non-invasive tests (“NITs”), CCTA enables physicians to identify the presence and extent of coronary blockage. As a result, CCTA has become the preferred first-line test for patients with suspected CAD, as evidenced by the AHA and ACC guidelines elevating CCTA to Class 1, Level A. However, while CCTA provides superior anatomical imaging, it does not independently quantify the severity of CAD, assess blood flow limitations, or characterize plaque composition—critical factors for determining the most appropriate, personalized course of treatment for a patient.

Our Heartflow Platform builds upon the well-established strengths of CCTA by going beyond its limitations and providing new quantified insights and compelling visualizations of data. By applying our advanced AI-powered technology to a single CCTA scan, we generate a precise, patient-specific analysis that quantifies blood flow, measures plaque burden, and characterizes plaque composition—at every point in the major coronary arteries.

Our Technology

Heartflow enhances CCTA, the most advanced non-invasive imaging modality for assessing CAD, with AI-powered analysis to deliver more accurate and clinically actionable insights for diagnosing and managing CAD. The Heartflow Platform applies deep learning, an advanced form of AI, and computational fluid dynamics to CCTA images to create a personalized 3D model of a patient’s heart based on a single CCTA image. This model provides actionable insights into blood flow, stenosis, plaque volume and plaque composition allowing precise diagnosis, risk stratification, and treatment planning – without the need for an invasive procedure.

We designed our AI-powered software platform to be highly scalable, seamlessly integrate into existing physician workflows for diagnosing CAD, and improve as we ingest more data over time. By leveraging AI to process massive volumes of cases and a “human-in-the loop” quality control process, where learnings are fed back into our algorithms to improve their performance and efficiency, we have scaled our platform to deliver accurate, timely results to benefit physicians and patients alike. Our cloud-based technology has enabled us to rapidly scale to an installed base of more than 1,465 accounts in the United States as of December 31, 2025. We have also built a substantial and growing data asset that has driven refinement of our algorithms for over 10 years and as of

December 31, 2025, we have analyzed and annotated more than 160 million annotated CCTA images. Additionally, through our bi-directional data sharing relationship with our customers we ensure platform enhancements, delivering immediate and tangible benefits through new features, workflow efficiencies, and improved performance.

The CCTA + Heartflow Pathway

When a patient presents with symptoms of CAD and their physician follows the AHA and ACC Class 1, Level A chest pain guidelines by referring the patient for a CCTA, the patient will undergo standard CCTA imaging at the relevant hospital or outpatient facility. At Heartflow-enabled accounts, CCTA images are securely transmitted directly to our cloud-based platform through our embedded software in the hospital or outpatient imaging center. Leveraging proprietary AI and advanced computational fluid dynamics, we create a personalized, 3D digital model of the patient’s coronary arteries, unlocking critical insights beyond what is visible on standard imaging.

Our Heartflow Platform seamlessly integrates into our customer workflows, providing clinically actionable insights directly to the account, which we believe is sufficient for the workflows of our customers. We deliver the Heartflow RoadMap Analysis automatically to the imaging cardiologist or radiologist for every acceptable CCTA patient at our accounts to help drive more efficient CCTA interpretation, workflows and revascularization strategies. In conjunction with the Heartflow RoadMap Analysis, we also provide physicians with a case list that catalogs all their CCTAs and identifies the cases where our Heartflow FFRCT Analysis, Heartflow Plaque Analysis or both would enable them to accurately diagnose clinically significant CAD and plan treatment. With a single click, Physicians can access these analyses on-demand, and we bill the account directly for each product selected. Because Heartflow FFRCT Analysis and Heartflow Plaque Analysis have distinct clinical indications and dedicated billing codes, our workflow helps ensure physicians can order the most appropriate analyses for each patient, supporting both high-quality care and efficient reimbursement processes.

The Heartflow Platform Portfolio

To date, we have developed three software products (with a fourth product expected to launch in the second quarter of 2026) under the Heartflow Platform that provide physicians with the critical insights needed to effectively diagnose and manage CAD:

Heartflow RoadMap Analysis: The Heartflow RoadMap Analysis provides a highly intuitive anatomic visualization of the patient’s coronary anatomy based on CCTA images. It rapidly orients the imaging physician to clinically relevant areas of the patient anatomy and provides a preview of what they will review in the native CCTA images to aid the physician in accurately, efficiently and consistently identifying stenosis in the coronary arteries. Heartflow RoadMap Analysis supports more efficient radiology workflow, improving CCTA read times by 25% and increasing consistency between reviewing physicians by approximately 40%, as demonstrated in our SMART-CT study. Physicians use Heartflow Roadmap Analysis as a first-line assessment tool along with CCTA interpretation to determine whether to order our more detailed Heartflow FFRCT Analysis or Heartflow Plaque Analysis reports. The Heartflow RoadMap Analysis was cleared by the FDA in October 2022, and we began providing it to our customers in the second quarter of 2023. We generally provide Heartflow RoadMap Analysis to accounts as an integrated feature to enhance the efficiency and consistency of their CCTA programs, and it is not a stand-alone product. We believe the efficiency that Heartflow RoadMap Analysis provides our customers has resulted in enhanced customer loyalty and retention.

Heartflow FFRCT Analysis: Our flagship product, Heartflow FFRCT Analysis, consists of a patient-specific, interactive, 3D anatomical reconstruction of the coronary anatomy that calculates blood flow and identifies clinically significant CAD to determine the need for intervention, which is CAD with a fractional flow reserve (“FFR”) value of 0.80 or below, at every point in the major coronary arteries. FFR measures the severity of blood flow restriction in the coronary arteries on a scale of 1.0 (no restriction) to 0.0 (complete blockage) by assessing pressure differences across a stenosis during induced stress, guiding decisions on whether a patient requires invasive revascularization.

The model is color-coded along vessel length, indicating Heartflow FFRCT Analysis values which assist the physician in rapidly and precisely assessing blood flow through the coronary arteries. Our Heartflow FFRCT Analysis has the highest diagnostic accuracy for a non-invasive CAD test and has demonstrated a high level of concordance to invasive FFR, as seen in our PRECISE, NXT and PACIFIC trials. Our product can measure the FFR value and determine whether a lesion is clinically significant – a “clinically significant lesion” means an FFR value of 0.80 or below. Because FFR values are the guideline directed measure to determine the need for invasive revascularization, this data offers a more clinically accurate, non-invasive basis for determining the need for interventional treatment.

Current AHA and ACC guidelines support CCTA + Heartflow FFRCT Analysis as a more efficient care pathway. The guidelines designate CCTA as a Class 1, Level A test for CAD in certain patients with stable or acute chest pain and no known CAD, with our Heartflow FFRCT Analysis given a Class 2a, Level B recognition to help physicians guide patient treatment decisions. This CCTA + Heartflow FFRCT Analysis pathway enables physicians to identify lesions that require revascularization in less than two hours, and guidelines recommend patients with positive Heartflow FFRCT Analysis findings be sent directly to the cardiac catheterization lab for possible treatment. Comparatively, AHA and ACC guidelines provide stress-based testing a Class 1, Level B recommendation, suggesting patients with suspected CAD and positive stress-based test findings first initiate guideline directed medical therapy. Only if symptoms are not resolved by medical therapy, which can last weeks or months, are patients then sent to the cardiac catheterization lab.

Our Heartflow FFRCT Analysis is indicated for patients with stenosis levels between 40% and 90% in any vessel because a physician’s review of a CCTA alone may not appropriately identify the need for treatment in these cases. For example, in the figure below, two patients with 70% stenosis based on CCTA alone would likely be referred for invasive coronary angiography (“ICA”). However, Heartflow FFRCT Analysis provides a more individualized response and reveals that Patient A has an FFRCT value 0.80—but indicating no need for intervention—while Patient B has an FFRCT value 0.80 and should be referred for revascularization. As of December 31, 2025, Heartflow FFRCT Analysis represented 98% of our total revenue.

Heartflow Plaque Analysis: Heartflow Plaque Analysis transforms coronary plaque assessment from a time-consuming and variable manual process, which is seldom clinically used, into a rapid, automated, and highly precise AI-driven solution. The Heartflow Plaque Analysis automatically provides a comprehensive 3D assessment of a patient’s coronary plaque, including a characterization of plaque types and quantification of plaque volumes at every point in the major coronary arteries, enabling optimized medical treatment strategies. The Heartflow Plaque Analysis has been validated against the reference standard of invasive IVUS and shown to have a 95% agreement with IVUS in quantifying total coronary plaque volume in our REVEALPLAQUE study. Moreover, our current findings from the DECIDE registry show the Heartflow Plaque Analysis led to medical management change in over half of patients beyond CCTA alone. Because coronary plaque volume is a strong predictor of a patient’s risk of having a heart attack regardless of ASCVD risk score, coronary artery calcium (“CAC”) score, or stenosis, this data offers incremental predictive power over risk factors and stenosis alone and can aid the physician in optimizing medical management. Furthermore, only quantified plaque analysis based on CCTA can assess non-calcified plaque, which has a higher risk for causing a heart attack as compared to calcified plaque. In contrast, while CAC scores also use a CT scan to measure plaque, they estimate CAD risk based solely on calcified plaque. We believe that our Heartflow Plaque Analysis is applicable to the approximately 60% of CCTA patients identified as having 1% to 69% stenosis and adds significant value over review of CCTA alone, which is unable to precisely quantify or characterize the type or volume of plaque that would impact a physician’s treatment plan.

In addition to its comprehensive plaque assessment capabilities, Heartflow Plaque Analysis incorporates a nomogram derived from an extensive international cohort of over 11,000 patients. This nomogram stratifies coronary atherosclerotic plaque volumes by age and sex, providing physicians with a valuable reference to contextualize individual patient data against population-based benchmarks. By leveraging this tool, clinicians can more precisely assess a patient’s CAD risk, facilitating personalized treatment strategies. This integration of large-scale data enhances the actionable insights delivered by Heartflow Plaque Analysis, supporting more informed clinical decision-making. Data from our DECIDE Registry showed Heartflow Plaque Analysis led to medical management change in over 51% of patients beyond coronary computed tomography angiography (CCTA) alone, regardless of traditional risk factors or CCTA findings. The DECIDE Registry is the largest prospective study of its kind, we recently completed enrollment of approximately 22,000 patients at 30 sites across the United States.

Our Heartflow Plaque Analysis was cleared by the FDA in October 2022. We began our limited market education efforts in the second half of 2023, and we expect to broaden our market education efforts as payor coverage for Heartflow Plaque Analysis increases. Our Heartflow Plaque Analysis is included in the most recent version of EviCore by Evernorth cardiac imaging guidelines, which provides coverage guidelines to leading commercial payers, such as United Healthcare, Cigna, and Highmark BCBS, effective October 1, 2025.

Heartflow PCI Navigator: Heartflow PCI Navigator, which we expect to launch in the second quarter of 2026, will enable pre-PCI assessment of coronary anatomy, lesion-specific physiology and plaque localization through an interactive 3D model, combined in a single interface. The tool will provide interventional cardiologists with advanced visualization and clinical insights to help answer critical questions for revascularization strategies, such as which lesions to treat, how to treat them, the complexity of PCI, the need for calcium modification, what ancillary tool to use and how to optimize stent quantity, size and placement. We expect Heartflow PCI Navigator to offer procedural efficiency through advanced preparation, improved patient care by ensuring optimal treatment at the right time and increased clinician confidence with detailed pre-procedure knowledge. We plan to provide Heartflow PCI Navigator to accounts as an integrated feature to enhance procedural efficiency, not as a stand-alone product.

We anticipate launching Plaque Tracker, our fifth product, in 2027. Plaque Tracker will enable longitudinal plaque analysis of sequential CCTAs to measure the efficacy of medical therapy based on plaque regression.

With over a decade of commercial presence, we have established a competitively differentiated data set of more than 160 million annotated images, which is primarily sourced from our commercial relationships with customers, driving training and refinement of our algorithms for over 10 years and the ability to train new AI models for future products.

We believe our Heartflow Platform delivers the following key benefits:

•A more accurate non-invasive test for CAD, clinically validated to provide superior assessment of blood flow, plaque volume and plaque characterization compared to traditional non-invasive methods. We believe the Heartflow Platform is the most extensively studied AI-enabled test for CAD. Our belief is grounded in our analysis, including that the Heartflow Platform and its accuracy, clinical utility and economic benefits have been evaluated in over 200 clinical studies and more than 365,000 patients, including our PRECISE and FORECAST trials, each a large randomized controlled trial, with results published in over 600 peer-reviewed clinical publications.

•More informed assessments, personalized care, and better risk stratification, positively impacting physician decisions on which patients should receive an intervention, supporting more efficient intervention planning and driving more personalized medical management.

•Superior economic efficiency and enhanced interventional treatment planning, accurately identifying more patients who need interventional treatment while reducing unnecessary invasive procedures—significantly improving the efficiency of the catheterization lab and therefore hospital economics.

•Proprietary, secure bi-directional data communication with customers that feeds a growing database of approximately 110 million annotated CCTA images that we leverage to improve the Heartflow Platform’s accuracy, automation and clinical utility and seamlessly deliver new features and workflow efficiencies to our customers.

•Improved workflow through our Heartflow RoadMap Analysis that, as demonstrated in our SMART-CT study, reduces CCTA interpretation times by approximately 25% and reduces variability between reviewing physicians by approximately 40%, leading to more consistent diagnoses and standardized patient care.

•Better patient and provider experience, by leveraging a single CCTA for all of our products, patients complete their test in approximately 20 minutes with significantly lower radiation exposure compared to nuclear imaging tests such as SPECT and PET that take multiple hours and require radioactive tracers to be injected into the bloodstream. By providing a definitive diagnosis upfront, the Heartflow Platform eliminates the need for layered testing, streamlining the patient journey and reducing anxiety associated with uncertain or inconclusive results.

Beyond the commercialization of Heartflow FFRCT Analysis and Heartflow Plaque Analysis in symptomatic CAD, we see a significant market opportunity for our technologies in at-risk individuals who show no symptoms. To unlock this potential, we are continuing to evaluate new product opportunities and appropriate clinical evidence supporting eventual regulatory approval, payor coverage and commercialization.

Our clinical studies, including the PRECISE, NXT and PACIFIC trials, have consistently demonstrated that the Heartflow Platform is more accurate than traditional non-invasive tests and highly concordant to invasive testing, reduces unnecessary invasive testing, and enables physicians to optimize treatment and ultimately provide more efficient care.

Current clinical guidelines strongly support the adoption of the Heartflow Platform. The CCTA + Heartflow FFRCT Analysis pathway is supported by the American Heart Association (“AHA”) and American College of Cardiology (“ACC”) guidelines, with CCTA identified as a Class 1, Level A test and Heartflow FFRCT Analysis identified as a Class 2a, Level B test for the diagnosis of CAD in certain patients with stable or acute chest pain and no known CAD. The AHA and ACC guidelines utilize Classes and Levels to indicate the strength of a recommendation and the quality of supporting evidence, respectively. Class 1 represents the strongest recommendation, followed by Class 2a, which represents a moderate recommendation. Similarly, Level A signifies the highest quality of evidence, while Level B indicates moderate quality.

Our Heartflow FFRCT Analysis is reimbursed under a dedicated Category I Current Procedural Terminology (“CPT”) code, effective as of January 1, 2024, and has established coverage policies representing approximately 99% of covered lives in the United States. A Category I CPT code was established for Heartflow Plaque Analysis, effective January 1, 2026, with five of the seven Medicare Administrative Contractors (“MACs”) issuing final local coverage determinations (“LCDs”) that determined this analysis is medically necessary for certain Medicare patients in these MACs’ jurisdictions, and the remaining MACs providing coverage on a case-by-case basis, which represents approximately 75% of covered lives in the United States. A Category I CPT code designates a procedure or service that uses device(s) with Food and Drug Administration (“FDA”) clearance or approval (when required), is performed by many physicians across the United States for its intended clinical use, aligns with current medical practice, and has documented efficacy in literature. The Category I CPT status for our Heartflow FFRCT Analysis and Heartflow Plaque Analysis validates their widespread use and support adoption in clinical practice.

We primarily generate revenue on a “pay-per-click” basis each time a physician chooses to review either our Heartflow FFRCT Analysis, Heartflow Plaque Analysis, or both. Heartflow FFRCT Analysis has served as our commercial foundation, representing 98% of our total revenue as of December 31, 2025. In the second half of 2023, we initiated limited market education efforts for Heartflow Plaque Analysis, our second commercial product. Our Heartflow RoadMap Analysis is generally provided as a workflow efficiency tool to drive customer retention and loyalty and is not a stand-alone product. We expect to launch our next product, Heartflow PCI Navigator, in the second quarter of 2026 as an integrated feature to enhance procedural efficiency, not as a stand-alone product.

Our Growth Strategies

We believe the following strategies will play a critical role in our continued growth:

•Expand adoption of our Heartflow Platform by new accounts: As of December 31, 2025, we have successfully deployed our Heartflow Platform in more than 1,465 accounts in the United States. We intend to drive further adoption by leveraging our existing Territory Sales Managers (“TSMs”), who are responsible for acquiring new accounts, while selectively expanding our team to capture additional geographic opportunities.

•Broaden awareness of the CCTA + Heartflow pathway to drive volume at existing accounts: While we have achieved significant commercial adoption to date, including 195,000 patients on our Heartflow Platform in the U.S. in 2025 alone, we believe this represented less than 2% of our overall market opportunity and approximately 19% of current U.S. CCTA volumes. To expand adoption, we are actively educating physicians on the AHA and ACC chest pain guidelines that support CCTA plus Heartflow FFRCT Analysis as the preferred pathway for diagnosis and management of CAD.

•Increase adoption of our Heartflow Plaque Analysis product: Broad commercial reimbursement coverage and the conversion to Category I CPT code are important for widespread adoption of Heartflow Plaque Analysis. A new Category I CPT code, 75577, was also recently established to describe our Heartflow Plaque Analysis, which took effect in January 2026 and as of January 2026, all seven Medicare Administrative Contractors (“MACs”) covered Plaque Analysis. Beginning in October 2025, many commercial payers, including Aetna, Cigna, and United Healthcare, initiated coverage for Plaque Analysis following an update to the EviCore cardiac imaging guidelines. Since Heartflow Plaque Analysis runs on the same CCTA scan as Heartflow FFRCT Analysis, we expect favorable operating and gross margin leverage as its adoption increases.

•Invest in additional clinical evidence to support adoption and expand our indications: We believe we have developed the largest clinical evidence base supporting a non-invasive AI-powered diagnostic for CAD and expect to continue to invest in clinical evidence to extend our leadership position. Beyond the commercialization of Heartflow FFRCT Analysis and Heartflow Plaque Analysis in symptomatic CAD, we see a significant market opportunity for our technologies in at-risk individuals who show no symptoms. To unlock this potential, we are continuing to evaluate new product opportunities and appropriate clinical evidence supporting eventual regulatory approval, payor coverage and commercialization.

•Extend our technology leadership through continued investment in our platform: Our ongoing research and development initiatives are focused on introducing products, features and improvements to maximize customer value. We prioritize advancements in four key areas including: improving our algorithms by leveraging extensive clinical data to improve accuracy and efficiency; optimizing clinical utility to better support physicians in diagnosis, patient management, and treatment planning; enhancing ease of use through seamless workflow integration to improve operational efficiency; and expanding our platform’s applications to serve a broader patient population.

•Leverage our platform to pursue adjacent and international markets: We believe our installed base and integrated platform technology approach allow us to add on new analysis and insights within the same product experience. Our relationships with referring and imaging physicians provide us with insights into unmet clinical and workflow needs, while our extensive database of CCTA images and AI capabilities enable us to develop and integrate new algorithm-based solutions. In the future we may choose to selectively expand our geographic footprint by strengthening our presence in existing international markets, entering new international markets, or exploring adjacent market opportunities in the U.S. and abroad.

Our Production Process

Our production process involves a sophisticated and highly refined system that combines advanced machine learning algorithms with “human-in-the loop” quality control process, where learnings are fed back into our algorithms to improve their performance and efficiency. After the CCTA test is complete, the patient’s images are securely transferred to our cloud-based system through our established software that integrates directly into the account’s infrastructure.

When the images arrive, we leverage multiple machine learning algorithms which have been trained from a database of millions of annotated CCTA images to precisely segment CCTA data and extract patient-specific 3D anatomy, which includes the coronary tree, myocardium and other anatomic features. The quality of CT images and the anatomy extracted by our algorithms is inspected through proprietary software that guides quality-oriented production analysts through each step to review and potentially correct the segmentation, as needed. Our machine learning algorithms then utilize any analyst inputs to generate a final 3D model of the coronary vessels. Our algorithms then compute stenosis, plaque volumes and plaque characteristics as well as blood flow simulation with computational fluid dynamics over the entire coronary tree. The simulated blood flow and pressures allow

calculation of quantitative Heartflow FFRCT Analysis values at every point on the coronary tree. Once complete, our Heartflow RoadMap Analysis, Heartflow FFRCT Analysis and Heartflow Plaque Analysis are securely delivered directly to the physician in multiple formats: an interactive web experience where they can explore the data in detail, PDF summaries, and direct delivery into the electronic medical record.

The corrections and changes from the analyst quality inspection step are stored in a database as labels for training our algorithms. New and improved versions of our algorithms using the latest machine learning methodologies are trained with incrementally more labels and released over time and incorporated into our platform. The core algorithms for the 3D coronary anatomic model and Heartflow FFRCT Analysis are now on their 3rd generation with improvements over time. This iterative approach of combining improved algorithms with human quality control processes continues to enhance the accuracy and efficiency of our technology.

We have also invested significantly in automating our production process through improved algorithm performance, visualization, and internal workflow enhancements.

Our Data Security

Our Heartflow Platform relies on industry-leading security controls, including encryption at rest and in transit, multi-factor and single-sign on authentication, granular authorization and a secure development lifecycle. We have designed the Heartflow Platform to de-identify data for processing, ensuring the most identifiable sensitive data (including PHI) remains segregated, encrypted, and within source regions, limiting privacy and security risk. Our commitment to information security is demonstrated by our HITRUST, ISO 27001, ISO 13485, SOC 2 Type 2 and UK CyberEssentials certifications.

Our Clinical Results and Economic Evidence

We believe the Heartflow Platform is the most studied AI-enabled test for CAD. The accuracy, clinical utility and economic benefits of our Heartflow Platform have been evaluated in over 200 clinical studies and more than 365,000 patients, including our PRECISE and FORECAST trials, each a large randomized controlled trial, with results published in over 600 peer-reviewed clinical publications. Collectively, this extensive body of clinical evidence has supported regulatory approvals for our products, established broad payor coverage and society guideline inclusion for our Heartflow FFRCT Analysis, and is driving rapid commercial adoption of our portfolio of products. We have sponsored 50 of the 200 clinical studies and are continuing to invest in evidence that highlights the clinical utility and economic benefits of our Heartflow Plaque Analysis to support expansion of payor coverage and commercial adoption. In the future, we expect to begin enrollment in three randomized clinical trials focused on high-risk asymptomatic sub populations to expand the addressable market for our products.

Our clinical programs have been focused on (i) validating the accuracy and reproducibility of our product offerings relative to invasive reference standards and non-invasive alternatives, (ii) establishing the differentiated clinical utility of our products relative to non-invasive alternatives, and (iii) demonstrating the economic benefits associated with our products including reduced costs for payors and improved efficiency for providers. Our studies, including the PRECISE, NXT and PACIFIC trials, have consistently demonstrated that the Heartflow Platform is more accurate than traditional non-invasive tests and highly concordant to invasive testing, reduces unnecessary invasive testing, and enables physicians to optimize treatment and ultimately provide more efficient care. The “p-values” noted below indicate the measure of the study’s “statistical significance,” which refers to the likelihood that a result or relationship is caused by something other than random chance or error. The “p-value” indicates the probability value that the results observed in a study were due to chance alone. A p-value of 0.05 is generally considered statistically significant, meaning that the probability of the results occurring by chance alone is less than five percent. The lower the p-value, the less likely that the results observed were random.

None of the studies discussed below that collected adverse event data related to the Heartflow Platform reported adverse events related to the Heartflow Platform.

Our Heartflow FFRCT Analysis

Accuracy and reproducibility: Numerous foundational clinical trials in cardiology, including the FAME 1 and FAME 2 RCTs have demonstrated that FFR values are the most accurate predictors of the need for intervention in patients with CAD. Key clinical studies that have supported the accuracy and reproducibility of Heartflow FFRCT Analysis relative to invasive FFR testing and non-invasive alternatives include:

•NXT (2014): Our Company-sponsored NXT trial was the basis for de novo 510(k) FDA clearance of Heartflow FFRCT Analysis. It was a prospective, blinded, core-lab adjudicated trial in which CCTA was performed prior to non-emergent ICA in stable patients with suspected CAD. Heartflow FFRCT Analysis values based on the CCTA were compared to invasive FFR values. The trial also compared the efficacy of Heartflow FFRCT Analysis relative to CCTA alone for predicting FFR values. NXT studied 254 patients who were scheduled to undergo clinically indicated ICA and who had CCTA performed within 60 days before ICA or who agreed to undergo CCTA within 60 days before ICA and studied 484 vessels at 10 centers in Europe, the United Kingdom, Japan, Korea, and Australia. The results showed that Heartflow FFRCT Analysis is highly accurate compared to the reference standard of invasive FFR, with a per-vessel accuracy of 86% compared with 65% for CCTA alone (p 0.001).

•PACIFIC (2019): The PACIFIC trial was an investigator-initiated, prospective study funded by the Company to evaluate in a head-to-head manner the diagnostic performance of several non-invasive tests commonly used to identify functionally significant CAD. At a single site in the Netherlands, a total of 208 patients with suspected stable CAD underwent CCTA, SPECT and PET, and then used ICA with invasive FFR as the reference standard. The Heartflow FFRCT Analysis was not initially included in the PACIFIC study, but the investigators subsequently undertook a retrospective PACIFIC FFRCT sub-study to evaluate the diagnostic performances of Heartflow FFRCT Analysis compared to CCTA, SPECT, and PET. Using invasive FFR as the reference standard, the Heartflow FFRCT Analysis demonstrated the highest diagnostic performance for vessel-specific ischemia of all tested noninvasive tests, with an AUC (Area Under the Curve) of 0.94 compared with PET (0.87), CTA (0.83), and SPECT (0.70) (p 0.001 for all).

Differentiated utility, improved clinical and economic outcomes: Numerous studies have demonstrated that use of Heartflow FFRCT Analysis favorably impacts clinical management, supporting physicians in making more informed and better patient-specific decisions about intervention which drives more efficient use of resources. Key company-sponsored clinical studies that demonstrated the impact of Heartflow FFRCT Analysis on clinical decision-making, outcomes and provider and payor economics include:

•ADVANCE (2018): Our Company-sponsored ADVANCE prospective registry studied 5,083 patients at 38 centers across the United States, United Kingdom, Europe, and Japan whose CCTA showed CAD, in order to determine whether the incremental addition of Heartflow FFRCT Analysis resulted in a change in patient management. Results at 90 days showed that Heartflow FFRCT Analysis findings drove a change in management plan for 67% of patients and that Heartflow FFRCT Analysis values 0.80 did not have any reported major adverse cardiovascular events compared to those with values 0.80 or below who experienced higher rates of major adverse cardiovascular events (p 0.01) despite overwhelmingly non-invasive patient management. Additionally, CCTA-based stenosis severity was determined to be a poor predictor of Heartflow FFRCT Analysis values, demonstrating that CCTA alone was not as effective for clinical decision-making. A review of outcomes at one year showed that physician management decisions were safe and durable and that deferral of an invasive procedure based on Heartflow FFRCT Analysis was safe and appropriate, as it was highly unlikely to result in a later revascularization or adverse clinical event.

•PRECISE (2023): Our Company-sponsored PRECISE trial was a prospective randomized controlled study conducted at 65 centers across the United States, Canada, the United Kingdom, and Europe which compared decision-making and outcomes based on a CCTA + Heartflow FFRCT Analysis pathway with the “usual care” pathway which involved alternative non-invasive or invasive testing methods chosen by the clinician, such as exercise electrocardiogram, stress echocardiogram, stress nuclear myocardial perfusion imaging (single-photon emission CT or positron emission tomography), stress cardiovascular magnetic resonance imaging, or catheterization. The study included 2,103 participants without known CAD or prior testing and had a median follow up of 11.8 months. The study found that, compared with the “usual care” pathways, CCTA + Heartflow FFRCT Analysis was 78% more likely to identify patients in need of revascularization (p 0.001), and resulted in a 69% reduction in diagnostic-only ICA. The net effect of this pathway was 2x the yield of ICA leading to a revascularization procedure, from 30.5% of cases to 71.9% of cases. As a result, our internal analysis based on the PRECISE data demonstrated a 20% increase in net revenue for the cardiac catheterization lab, on average.

•PLATFORM (2015): Our Company-sponsored PLATFORM trial was a prospective controlled study of sequential cohorts that enrolled 584 patients across 11 centers in the United Kingdom and Europe. The study assessed the clinical and economic impacts of using a CCTA + Heartflow FFRCT Analysis pathway to select patients with stable, new onset chest pain for ICA. The study compared outcomes between cohorts with a “usual care” invasive pathway to a CCTA + Heartflow FFRCT Analysis pathway. The study found that the CCTA + Heartflow FFRCT Analysis pathway reduced the rate of unnecessary ICA by 83% from 73% to 12% (p 0.0001) and showed a 23% reduction in costs at 90 days and a 32% reduction (p 0.0001) in costs at one year based primarily on the avoidance of unnecessary invasive procedures.

Our Heartflow Plaque Analysis

Our clinical portfolio includes 10 studies and over 25 peer-reviewed publications specific to Heartflow Plaque Analysis. These studies and publications, which include large, multi-center, international trials, document the performance, accuracy and clinical utility of Heartflow Plaque Analysis as well as its positive impact on the physician’s ability to assess risk and manage outcomes. By providing more accurate and detailed information on plaque types and volumes than can be achieved with traditional non-invasive tests or risk measures, Heartflow Plaque Analysis supports more appropriate, precise medical management. Key studies that support the clinical benefits of Heartflow Plaque Analysis include:

•REVEALPLAQUE (2024): Our Company-sponsored REVEALPLAQUE study demonstrated the accuracy of Heartflow Plaque Analysis relative to IVUS, the accepted reference standard for coronary plaque measurement and characterization. REVEALPLAQUE was a prospective, blinded, core-lab adjudicated trial that enrolled 237 patients, with 432 lesions, in the United States and Japan and compared coronary plaque quantification and characterization between Heartflow Plaque Analysis and IVUS. The study showed that Heartflow’s Plaque Analysis results for total plaque volume, calcified plaque, and non-calcified plaque were strongly correlated with IVUS measurements, achieving 95% agreement with IVUS.

•DECODE (2024): Our Company-sponsored DECODE study evaluated the impact of the Heartflow Plaque Analysis on clinical decision-making using data from 100 patients who underwent CCTA. For each case, three cardiologists with expertise in reading CCTA and preventive therapies aligned on a management plan based on patient demographics, clinical history, and the CCTA alone. The cardiologists were then provided with Heartflow Plaque Analysis for the same patients and asked to determine a management plan. The results showed that the use of Heartflow Plaque Analysis led to changes in treatment plans for 66% of patients, including 63% of patients who had medical management up-titrated. The likelihood of changing the management plan increased with higher CAC scores and was more pronounced in patients with significant coronary stenosis; however, even 50% of patients with a CAC score of 0 had a revised management plan with Heartflow Plaque Analysis.

•ADVANCEPLAQUE (2024): The ADVANCEPLAQUE study is a retrospective analysis of our ADVANCE trial after 1-year follow up (see above for more information related to our Company-sponsored ADVANCE trial). In a multi-variate analysis of the data, high total plaque volume as identified by Heartflow Plaque Analysis was shown to be an independent predictor for the risk of adverse clinical cardiac events. In addition, the risk of an adverse cardiac event was shown to be 2x higher in patients where Heartflow Plaque Analysis showed a higher total plaque burden compared to those with a lower plaque burden.

•EMERALD 2 (2024): The EMERALD 2 study, funded by the Company, enrolled 351 patients who presented with acute coronary syndrome, including specifically-identified culprit plaque rupture, within 3 years following a CCTA across the United States, Canada, Denmark, Italy, Hungary, Belgium, Australia, Japan and South Korea. The study sought to investigate the additive value of AI-enabled quantitative coronary plaque analysis together with hemodynamic analysis as predictors of the subsequent plaque rupture. The study showed that adding the CCTA-derived, AI-enabled measures derived from FFRCT and Plaque Analyses predicted plaque rupture more accurately than the reference model of CCTA alone (p 0.001).

•DECIDE: Based on the success of our DECODE study, which supported CMS coverage for Heartflow Plaque Analysis, we initiated in March 2024 the DECIDE registry, a prospective real world analysis measuring the impact of Heartflow Plaque Analysis on changes in treatment decisions compared to CCTA alone or alternative non-invasive tests. In contrast with DECODE in which physicians retrospectively identified revised patient management plans, physicians in our DECIDE registry used Heartflow Plaque Analysis information to implement real world patient management changes, with medical management changes being defined to include a treatment modification, such as initiating, discontinuing or changing dosage for a preventative or anti-ischemic therapy, additional laboratory testing, a referral for a specialist, or undergoing stress testing or ICA between 90 and 180 days post-CCTA. The study’s primary endpoint is change in medical management following Heartflow Plaque Analysis, performed 90 days after the CCTA and made available to the clinician already treating the patient, compared to the initial medical management plan determined by the clinician based on the CCTA alone, and the secondary endpoints will examine changes in key outcomes including death, heart attack, revascularization, cardiovascular medication changes and cardiovascular hospitalizations at both 90-days and one-year follow-up. DECIDE was initiated in March 2024 and we recently completed enrollment of approximately 22,000 patients across 30 sites in the United States. Our current findings from the DECIDE registry show the Heartflow Plaque Analysis led to medical management change in over half of patients beyond CCTA alone, demonstrating a high clinical utility in guiding individualized management of patients. We believe that the outcomes of the DECIDE registry will support expanded commercial payor coverage and continued adoption of Heartflow Plaque Analysis.

Other Clinical Studies

The following summarizes the results of additional clinical studies that were not supported, sponsored, or funded by the Company.

•SCOT-HEART (2015): SCOT-HEART was a foundational open-label, multi-center, parallel group randomized controlled trial that compared the standard of care against the standard of care with CCTA. The study registered 4,146 patients across 12 sites in Scotland. Enrollment was open to patients aged 18–75 years who had been referred by a primary-care physician to a dedicated cardiology chest pain clinic with suspected stable angina due to coronary heart disease. The study highlighted the clinical superiority of CCTA over traditional stress-based NITs, finding a significant 41% reduction in the rate of death or non-fatal heart attacks after five years in patients who underwent CCTA evaluations. The study also demonstrated that patients in the CCTA group had higher rates of preventative therapies throughout follow-up: antiplatelet therapy use fell from 48% (baseline) to 41% (at 1 year) in the standard of care group (p 0.001), whereas it increased from 49% (baseline) to 52% (at 1 year) in those in the CCTA group (p = 0.017). Statin use increased in both groups, from 43% to 50% (at 1 year) in the standard of care group and from 44% to 59% (at 1 year) in the CCTA group (p 0.001 for both groups), but this was greater in those assigned to the CCTA group (p 0.001).

•FAME 1 (2009): The foundational FAME 1, a prospective randomized controlled trial, enrolled 1,005 patients with multi-vessel CAD across 20 sites in the United States and Europe. The study, along with FAME 2, showed that deferring intervention is superior when blood flow, as measured by FFR, was greater than 0.80 but that when FFR was below this same level, intervention was superior to optimal medical therapy. In FAME 1, patients diagnosed with CAD by ICA and planned ICA had rates of major adverse cardiovascular events that were lower with deferral of FFR negative lesions than with angio-guided PCI of all lesions independent of FFR (18.3% vs. 13.2%) (p = 0.02). In addition, 78% of the patients in the angiography group were free from angina at 1 year, as compared with 81% of patients in the FFR group (p = 0.20).

•FAME 2 (2014): The foundational FAME 2, a prospective randomized controlled trial, enrolled 1,220 patients across 28 sites in Europe and North America. The enrolled patients were appropriate candidates for PCI in stable condition who had angiographically assessed one-, two-, or three-vessel CAD suitable for PCI. The study demonstrated that patients diagnosed with CAD by ICA and with invasively-measured positive FFR had rates of major adverse cardiovascular events that were lower with PCI and medical management than with medical management alone (8.1% vs. 19.5%) (p 0.001). This reduction was driven by a lower rate of urgent revascularization in the PCI group (4.0% vs. 16.3%) (p 0.001), with no significant between-group differences in the rates of death and myocardial infarction.

Sales and Marketing

We market and sell our Heartflow Platform in the United States through a direct sales organization. We have developed a highly scalable, capital efficient commercial model that combines TSMs who drive new account adoption with Territory Account Managers (“TAMs”) who focus on increasing utilization by educating referring physicians. Our commercial team does not cover cases or otherwise spend time in an operating room or lab setting, which enables them to focus solely on driving commercial adoption and educational activities.

As of December 31, 2025, our U.S. commercial team included TSMs focused on opening new accounts, TAMs who are focused on broadening referring physician awareness of the CCTA + Heartflow pathway and driving increased volumes at accounts in our installed base, and our customer success organization that supports seamless onboarding, implementation and ongoing utilization at our accounts. We support our direct commercial efforts with a marketing team that generates demand for the CCTA + Heartflow pathway and highlights clearly defined value propositions for the various stakeholders across our customer base, including cardiologists, radiologists and interventional cardiologists.

Our TSMs engage with physicians to communicate the value proposition of the Heartflow Platform, leveraging our large base of clinical evidence to highlight its clinical and economic benefits as well as the lack of any new capital equipment purchase to drive new account adoption. Our TSMs have substantial experience selling into cardiology and radiology practices as well as engaging with broad stakeholders to establish new diagnostic and therapeutic solutions, employing an enterprise sales strategy. Our TAMs utilize our extensive clinical compendium to educate and train physicians on the benefits of our platform, ultimately driving more referrals to our accounts. Our TAMs

have strong backgrounds in establishing new, disruptive therapies and growing a cardiology referral base.

Our technology is simple and intuitive and does not require the purchase of any capital equipment. Our onboarding process seamlessly integrates the Heartflow Platform into the customer’s daily workflow. These unique attributes of our business model afford our commercial organization a differentiated level of efficiency and scalability.

We also have small, direct commercial teams in the United Kingdom, Japan and other countries in the European Union. We may continue to expand our commercial activities outside the United States in areas where we see potential opportunity and supportive reimbursement dynamics.

Research and Development

We have invested significantly in research and development efforts over more than a decade to establish the first and most widely adopted AI-enabled non-invasive test for CAD that is authorized for marketing in the United States. We have built sophisticated AI-based algorithms and established an intuitive, easy to use web and mobile customer interface, developed secure data transfer software, a scalable cloud database, and quality review software, all while

facilitating operational scalability. Our highly skilled and focused research and development (“R&D”) team has been pioneering AI-based coronary imaging for over a decade and remains uniquely positioned to continuously advance our Heartflow Platform. Our R&D team is comprised of PhD research scientists with expertise in AI-based algorithms and medical imaging, alongside software engineers skilled in cloud architecture, AI algorithms, machine and deep learning and 3D visualization, as well as product managers and designers who ensure optimal customer experience and design.

We are continuing to invest in research and development efforts with the goal of driving improvements to the Heartflow Platform and expanding its applicability to additional disease states and patient populations. Our near- to medium-term research and development priorities include: (i) continuing to train and improve our AI algorithms to drive greater quality and efficiency and reduce manual involvement; (ii) enhancing product features for both Heartflow FFRCT Analysis and Heartflow Plaque Analysis; (iii) developing additional workflow enhancements for our customers; and (iv) expanding indications for our platform, including asymptomatic risk prediction.

Reimbursement

The ability of our customers to obtain third-party payor coverage and payment for our Heartflow Platform products for their patients is important to our business. Demand for our existing and new products is, and will continue to be, affected by the extent to which government healthcare programs, such as Medicare and Medicaid, and private health insurers, reimburse our customers for the use of our products with their patients in the countries where we do business. We have successfully engaged with third-party payors in major markets throughout the world to obtain coverage, coding, and payment rates for our products. Nonetheless, not all third-party payors reimburse our customers for our products in all situations. Third-party payor reimbursement for the Heartflow FFRCT Analysis is broad; however, Heartflow Plaque Analysis is our second commercial product, and we continue to work to expand coverage and payment for its use. Even if we develop or acquire a promising new product that has been cleared for commercial distribution by the FDA, demand for the product may be limited unless our customers are reimbursed at favorable rates by private health insurers and government healthcare programs.

Our Heartflow FFRCT Analysis is reimbursed under a Category I CPT code, 75580, effective as of January 1, 2024, and third-party payors have established coverage policies for Heartflow FFRCT Analysis that apply to approximately 99% of covered lives in the United States. A new Category I CPT code, 75577, was also recently established to describe our Heartflow Plaque Analysis, which took effect in January 2026. Our Heartflow Plaque Analysis is covered by Medicare, with five of the seven MACs issuing final LCDs that determined this analysis is medically necessary for certain Medicare patients in these MACs’ jurisdictions, and the remaining MACs providing coverage on a case-by-case basis. As of January 2026, coverage for Heartflow Plaque Analysis represents approximately 75% of covered lives in the United States.

In November 2025, CMS finalized a national payment rate for the AI-Enabled Coronary Plaque Analysis service reported with new code 75577, which includes our Heartflow Plaque Analysis when performed in the physician office setting. The national Medicare payment rate for our Heartflow Plaque Analysis was effective January 1, 2026.

Seasonality

Our revenue has fluctuated, and we expect it to continue to fluctuate from quarter-to-quarter due to a variety of factors including the seasonality and the number of business days. With respect to seasonality, our first quarter revenue may be harmed by adverse weather and the setting of annual patient healthcare insurance plan deductibles. In addition, we may experience fluctuations in the volume of Heartflow Platform usage by our customers based on seasonal factors that impact the number of radiologists and support staff available to conduct CCTAs at customer accounts.

Competition

We consider our primary competition to be traditional non-invasive tests for CAD including primarily stress tests such as SPECT, stress echocardiography and PET. The primary providers of imaging systems that perform these tests include Siemens Healthineers AG, GE Healthcare, Koninklijke Philips N.V. and Canon Medical Systems Corporation. These companies also manufacture CT scanners and therefore have a vested interest in growing the

CCTA market in addition to protecting their share of the non-invasive market. These are large, multi-national, commercial organizations with significant resources and distribution capabilities.

We also face competition from companies that have developed or are developing AI-based platforms that leverage CCTA to diagnose CAD, including earlier-stage companies such as Cleerly, Inc., Elucid Bioimaging Inc. and Keya Medical Technology Co., Ltd. We may also face competition from companies developing AI-based platforms, even if they are not currently in the CAD market.

We believe the primary competitive factors in our market include: (i) the accuracy, reliability, and utility of the test as demonstrated by the strength and quality of clinical data directly utilizing the test and supporting it; (ii) speed and efficiency of achieving a definitive diagnosis at scale; (iii) per patient economics including reimbursement rates and relative costs; (iv) availability and ease of use including integration within hospital systems and clinical workflows as well as customer support; and (v) effective marketing and physician education efforts as well as ability to impact physician mindshare and historical practice patterns.

Intellectual Property

Our success depends in part on our ability to obtain, maintain and defend our patent and other proprietary rights for the Heartflow Platform, the validity and enforceability of our patents, our ability to operate without infringing the valid and enforceable patents and proprietary rights of third parties and the continued confidentiality of our know-how and trade secrets. We are actively involved in research and development and therefore seek to protect the investments we have made into the development of the Heartflow Platform and our proprietary technology by relying on a combination of patents, trademarks, trade secrets, and licenses, as well as through internal compartmentalization processes, confidentiality agreements and proprietary information agreements with suppliers, employees, consultants and others who may have or gain access to our proprietary information. We seek patent protection in the United States and key markets internationally for the Heartflow Platform, and any other inventions to which we have rights, where available and appropriate. We also rely upon trademarks to build and maintain the integrity and identity of our brand, and we seek to protect the confidentiality of trade secrets that may be important to the development of our business, especially where we do not believe patent protection is appropriate or obtainable. We license from third parties certain patent rights and proprietary know-how that we believe to be useful to our business. We have non-exclusively licensed some patents in our patent portfolio to a small number of licensees in a limited field of use that is outside of CCTA, and we believe that those licensees' product offerings covered by our patent portfolio are complementary to our product offerings.

Our patent portfolio, described more fully below, includes claims directed to the Heartflow Platform and its delivery, as embodied in various systems, computer programs, computer implemented methods and related methods of use. These claims are directed to various aspects of deriving anatomical and physiological information from image data for the Heartflow Platform, aspects of the Heartflow Platform user interface, machine learning methods for generation of the 3D models used for our FFRCT Analysis and Plaque Analysis products, and methods of deriving blood flow, anatomy, plaque and organ tissue information from the image data. A number of our issued patents also cover indications other than CAD, such as peripheral artery disease, stroke, or aneurysms as well as technical applications related to image data analysis and processing, and platform-related PHI and data transfer methodologies and a number of issued patents cover alternative methods such as deriving FFRCT using purely machine learning methods or from other imaging modalities.

As of December 31, 2025, our owned and licensed patent portfolio includes approximately 617 issued patents and 93 pending patent applications globally, of which 15 are allowed. In the U.S. this includes 330 issued U.S. patents and 51 pending non-provisional U.S. patent applications (of which 6 are allowed). In foreign jurisdictions our owned and licensed patent portfolio includes 287 issued foreign patents and 42 pending foreign patent applications (of which 9 are allowed). The 287 issued foreign patents include one or more issued patents in Europe, Japan, Korea, China, Australia, Canada, India, Hong Kong, and Israel. We also filed 23 foreign utility models between 2011 and 2015, having ten-year terms, all of which have expired. The 42 pending foreign patent applications include one or more pending applications in jurisdictions such as Europe, Canada, China, Korea and Japan. We own all of our issued patents except for 7 issued U.S. patents and 8 issued foreign patents, for which we have exclusive licenses. All of the issued U.S. patents in the portfolio are utility patents. Assuming payment of all appropriate maintenance, renewal, annuity or other governmental fees, as applicable, our owned and licensed issued U.S. patents expire

through 2044. If issued, our last to expire pending patent application (without accounting for potentially applicable patent term adjustments or extensions) is expected to expire in 2045.

Our patents and applications generally fall into three broad categories:

•those relating to our Heartflow FFRCT Analysis, including claims directed to segmentation, determining blood flow characteristics using AI and/or fluid dynamics, and visualization generation;

•those relating to our Heartflow Plaque Analysis, including claims directed to plaque and vessel visualization and characterization; and

•those relating to our Heartflow RoadMap Analysis, including claims directed to image quality and annotation, segmentation, and vascular tree generation.

We also own registered trademarks for the Heartflow Platform in the United States and certain other countries and own and maintain registration for a number of domain names.

The Heartflow Platform also implements software modules licensed to us by third-party authors under “open source” licenses. The use of open source software may entail greater risks than the use of third-party commercial software. Please see “Risk factors—Risks Related to Our Intellectual Property” for more description of these risks.

We also rely on trade secrets, including know-how, unpatented technology and other proprietary information, to strengthen our competitive position, which we seek to protect, in part, by entering into non-disclosure and confidentiality agreements or invention or patent assignment agreements with parties such as our employees, collaborators, manufacturers, consultants, advisors and other third parties with respect to such information.

Government Regulation

United States Regulation of Medical Devices

Our products are medical devices subject to extensive and ongoing regulation by the FDA, CMS, the Department of Health and Human Services Office of Inspector General (“OIG”) and regulatory bodies in the United States and other countries. Regulations govern virtually every critical aspect of a medical device company’s business operations, including research activities, product development and testing, manufacturing and production, contracting, reimbursement, product messaging, medical communications, sales, marketing and advertising. In the United States, the Federal Food, Drug and Cosmetic Act (“FDCA”) and the implementing regulations of the FDA govern product design and development, preclinical and clinical testing, premarket clearance or approval, product manufacturing, product labeling, product storage, advertising and promotion, product sales and distribution, import, export and post market surveillance. Our business is subject to federal, state, local, and foreign regulations and standards, such as ISO 13485:2016, ISO 14971:2019, FDA’s Quality Management System Regulation (“QMSR”) contained in 21 CFR Part 820, and the EU’s Medical Devices Regulations, Regulation (EU) 2017/745 and subsequent amendments.

FDA Premarket Clearance and Approval Requirements

Unless an exemption applies, each medical device commercially distributed in the United States requires either FDA clearance of a 510(k) premarket notification, grant of a de novo classification request, or approval of a premarket approval (“PMA”) application. Our Heartflow Platform is regulated in the United States by the FDA as a Class II medical device. The FDA classifies medical devices into one of three classes. Devices deemed to pose low to moderate risk are designated as either Class I or II. Class I devices are subject to general controls such as establishment registration and device listing, labeling, adherence to current good manufacturing practices outlined in the QMSR, maintenance and investigation of product complaint records, and adverse event reporting, but are usually exempt from premarket notification requirements. Class II devices are subject to the same general controls and may be subject to special controls such as performance standards, post-market surveillance, particularized labeling requirements and/or clinical testing prior to clearance. Manufacturers of Class II devices, absent an exemption, are required to submit to the FDA a premarket notification prior to commercial distribution. Devices are designated as

Class III, which requires approval of a PMA application, if they are deemed by the FDA to pose the greatest risk. These high-risk devices include life sustaining or life supporting devices, certain implantable devices, and other devices that are intended for a use that is of substantial importance in preventing impairment of human health or that present a potential unreasonable risk of illness or injury. The PMA approval process is more comprehensive than the 510(k) clearance process and typically takes several years to complete.

510(k) Clearance Marketing Pathway

A 510(k) notification requires the sponsor to demonstrate that a medical device is substantially equivalent to another marketed device, termed a “predicate device,” that is legally marketed in the United States and for which a PMA was not required. A device is substantially equivalent to a predicate device if it has the same intended use and technological characteristics as the predicate, or has the same intended use but different technological characteristics that do not raise new questions of safety and effectiveness, and information submitted to the FDA demonstrates that the device is at least as safe and effective as the predicate device.

If the FDA agrees that the device is substantially equivalent to a predicate device currently on the market, it will grant 510(k) clearance to commercially market the device. If there is no viable predicate device for a new device because, for example, of a new intended use, the device is automatically designated as a Class III device. Unless the de novo pathway is available for the new device, the device sponsor must fulfill more rigorous PMA requirements.

After a device receives 510(k) clearance, any modification that could significantly affect its safety or effectiveness, or that would constitute a new or major change in its intended use, requires a new 510(k) clearance, or depending on the modification, could require the filing of a de novo classification request or a PMA application, which would require the submission to the FDA of clinical trial data, among other information. We are required to determine, for each modification to our cleared products, whether to submit a new 510(k) notification for the modification, based on the nature of the modification. If we determine a new 510(k) submission is not required, the decision and justification are documented in a “letter to file.” If the FDA disagrees with our determination at a future date, the FDA can require us to cease marketing or recall the modified device until 510(k) clearance, grant of a de novo classification request or approval of a PMA is obtained. We have made, and we plan to continue to make, minor product enhancements to our cleared products that we believe do not require new 510(k) clearances and that we document in letters to file. We also intend to make product enhancements from time to time that we expect may require new 510(k) clearances.

De Novo Classification Process

A manufacturer can request a risk-based classification determination for a novel device in accordance with the “de novo” process. Medical device types that the FDA has not previously classified as Class I, II, or III are automatically classified into Class III regardless of the level of risk they pose. The Food and Drug Administration Modernization Act of 1997 established a route to market for low-to-moderate risk medical devices that are automatically placed into Class III due to the absence of a predicate device, called the “Request for Evaluation of Automatic Class III Designation,” or the de novo classification procedure. This procedure allows a manufacturer whose novel device is automatically classified into Class III to request down-classification of its medical device into Class I or Class II on the basis that the device presents low or moderate risk, rather than requiring the submission and approval of a PMA application. Pursuant to the Food and Drug Administration Safety and Innovation Act (“FDASIA”), manufacturers may request de novo classification directly without first submitting a 510(k) pre-market notification to the FDA and receiving a not-substantially-equivalent determination. De novo classification requests, like PMA applications and 510(k) notifications, are subject to the payment of user fees.

We obtained initial marketing authorization for Heartflow FFRCT Analysis through the FDA’s “de novo” classification process, supported by clinical data from our NXT clinical trial. Through this process, the FDA agreed that special controls provide reasonable assurance of the safety and effectiveness of the Heartflow FFRCT Analysis and therefore it can be classified as a Class II device. We received a de novo authorization on November 26, 2014 for version 1.4 of the Heartflow FFRCT Analysis. We received the 510(k) clearance for version 2.x of the FFRCT product in January 2015, and 510(k) clearance for a modification to the intended use language in August 2016. Additional clearances were received for a strategic architecture scope change in December 2018, which is the device we refer to as Heartflow Platform. The Heartflow Platform version 2.0, which added the PCI Planner function,

received FDA clearance in August 2019. The Heartflow Platform version 3.0 received FDA clearance in January 2021, and the newest product generation, Heartflow Platform version 3.18, adding Roadmap and Plaque functions, received FDA clearance in October 2022. The Heartflow Platform version 4.0, with improved Plaque detection, received its clearance in July 2025.

Medical Device Clinical Trials

Clinical trials are sometimes required to support 510(k) or de novo submissions. All clinical investigations of devices to determine safety and effectiveness must be conducted in accordance with the FDA’s investigational device exemption (“IDE”) regulations which govern investigational device labeling, prohibit promotion of the investigational device, and specify an array of recordkeeping, reporting and monitoring responsibilities of study sponsors and study investigators. If the device presents a “significant risk” to human health, as defined by the FDA, the FDA requires the device sponsor to submit an IDE application to the FDA, which must become effective prior to commencing human clinical trials. If the device under evaluation does not present a significant risk to human health, then the device sponsor is not required to submit an IDE application to the FDA before initiating human clinical trials, but must still comply with abbreviated IDE requirements when conducting such trials. A significant risk device is one that presents a potential for serious risk to the health, safety or welfare of a patient and either is implanted, used in supporting or sustaining human life, substantially important in diagnosing, curing, mitigating or treating disease or otherwise preventing impairment of human health, or presents a potential for serious risk to a patient in some other way. An IDE application must be supported by appropriate data, such as animal and laboratory test results, showing that it is safe to test the device in humans and that the testing protocol is scientifically sound. The IDE will automatically become effective 30 days after receipt by the FDA unless the FDA notifies the company that the investigation may not begin. If the FDA determines that there are deficiencies or other concerns with an IDE for which it requires modification, the FDA may permit a clinical trial to proceed under a conditional approval.

Regardless of the degree of risk presented by the medical device, clinical studies must be approved by, and conducted under the oversight of, an Institutional Review Board (“IRB”) for each clinical site. The IRB is responsible for the initial and continuing review of the clinical study, and may pose additional requirements for the conduct of the study. If an IDE application is approved by the FDA and one or more IRBs, human clinical trials may begin at a specific number of investigational sites with a specific number of patients, as approved by the FDA. If the device presents a non-significant risk to the patient, a sponsor may begin the clinical trial after obtaining approval for the trial by one or more IRBs without separate approval from the FDA, but must still follow abbreviated IDE requirements, such as monitoring the investigation, ensuring that the investigators obtain informed consent, and labeling and record-keeping requirements. Acceptance of an IDE application for review does not guarantee that the FDA will allow the IDE to become effective and, if it does become effective, the FDA may or may not determine that the data derived from the trials support the safety and effectiveness of the device or warrant the continuation of clinical trials.

During a study, the sponsor is required to comply with the applicable FDA requirements, including, for example, trial monitoring, selecting clinical investigators and providing them with the investigational plan, ensuring IRB review, adverse event reporting, record keeping and prohibitions on the promotion of investigational devices or on making safety or effectiveness claims for them. The clinical investigators in the clinical study are also subject to FDA’s regulations and must obtain patient informed consent, rigorously follow the investigational plan and study protocol, control the disposition of the investigational device, and comply with all reporting and recordkeeping requirements. Additionally, after a trial begins, we, the FDA or the IRB could suspend or terminate a clinical trial at any time for various reasons, such as strategic business decisions or a belief that the risks to study subjects may outweigh the anticipated benefits.

Post-market Regulation

After a device is approved or cleared and placed in commercial distribution, numerous FDA regulatory requirements apply. These include, but are not limited to, requirements to:

•register establishments and list devices with the FDA;

•maintain a quality system that is compliant with the QMSR, which governs design, development, and manufacture of devices;

•establish various specifications and controls for incoming components and finished devices;

•ensure that devices are designed to meet user needs;

•verify that finished devices are manufactured to the appropriate controls and that they meet specifications;

•ensure that devices are assigned and labeled with a Unique Device Identifier (“UDI”) and that certain UDI information is provided to FDA’s Global Unique Identification Database (“GUDID”);

•ensure that labeling and advertising and promotional activities are consistent with cleared/approved uses, adequately substantiated, and truthful and not misleading;

•analyze quality data to identify and correct quality problems;

•submit notifications or applications for clearance or approval of product modifications that could significantly affect safety or effectiveness or that would constitute a major change in intended use;

•review, evaluate and investigate complaints and report adverse events to the FDA when a device may have caused or contributed to a death or serious injury or malfunctioned in a way that would be likely to cause or contribute to a death or serious injury if the malfunction were to recur;

•report to FDA corrections and removals undertaken to reduce a risk to health posed by the device or to remedy a violation of the FDCA that may present a risk to health. In addition, FDA may order a mandatory recall if there is a reasonable probability that the device would cause serious adverse health consequences or death;

•comply with any post-approval restrictions or conditions, including requirements to conduct post-market surveillance studies to establish continued safety data; and

•conduct clinical studies in accordance with good clinical practices and applicable regulations, including requirements for clinical trial registration and results reporting on ClinicalTrials.gov.

In February 2024, the FDA issued the QMSR to amend the previous Quality System Regulation (QSR), incorporating by reference the international standard for medical device quality management systems, ISO 13485:2016. The rule was effective on February 2, 2026. Until then, manufacturers were required to comply with the QSR. Heartflow performed assessments and implemented changes in an effort to comply with the QMSR as of February 2, 2026.

Manufacturing processes for medical devices are required to comply with the applicable portions of the QMSR, which cover the methods and the facilities and controls for the design, manufacture, testing, production processes and controls, quality assurance, labeling, packaging, distribution, installation and servicing, post-market surveillance of finished devices intended for human use. As a manufacturer, we are subject to periodic scheduled or unscheduled inspections by the FDA. Furthermore, Heartflow participates in the Medical Device Single Audit Program (“MDSAP”) where we are assessed by our Notified Body for various global regulations, including the FDA QMSR, on an annual basis. Failure to maintain compliance with the QMSR requirements could result in the shutdown of, or restrictions on, manufacturing operations and the recall or seizure of marketed products.

The FDA polices these requirements by inspection, review of required reports or submissions, and market surveillance, and the agency has broad enforcement powers to address any violations. The FDA may conduct announced or unannounced facility inspections to determine compliance with the QMSR. Failure to comply with applicable regulatory requirements can result in enforcement action by the FDA or other regulatory authorities, which may result in sanctions and related consequences, including:

•inspection non-conformances (“Form 483”);

•untitled letters, warning letters, or it has come to our attention letters;

•injunctions or consent decrees;

•fines or civil penalties;

•recall, detention, or seizure of our product;

•operating restrictions, partial suspension, or total shutdown of production;

•the FDA’s refusal of or delay in granting 510(k) clearance or premarket approval of new or modified products;

•withdrawal of 510(k) clearances or PMA approvals;

•the FDA’s refusal to grant export certificates;

•criminal prosecution;

•unanticipated expenditures to address or defend such actions; and

•reputational harm resulting from such actions.

Other regulatory authorities overseeing the implementation and adherence of applicable state, federal and analogous foreign regulatory authorities may also conduct unannounced inspections. Such inspections may result in similar administrative, civil and criminal penalties. The discovery of previously unknown problems with marketed medical devices, including unanticipated adverse events or adverse events of increasing severity or frequency, whether resulting from the use of the device within the scope of its clearance or off-label by a physician in the practice of medicine, could result in restrictions on the device, including the removal of the product from the market or voluntary or mandatory device recalls.

International Regulation — European Union, United Kingdom, Japan and Canada

In order to market and sell our product outside of the United States, we must comply with numerous and varying regulatory requirements of other countries and jurisdictions regarding quality, safety, and efficacy and governing, among other things, clinical trials, marketing authorization, commercial sales and distribution of our product.

Although many of the regulatory issues we face in the United States are similar to the issues in other geographies, the approval or certification process varies between countries and jurisdictions and can involve additional testing and additional administrative review periods. The time required to obtain approval or certification in other countries and jurisdictions might differ from and be longer than that required to obtain clearance from the FDA. Regulatory approval or certification in one country or jurisdiction does not ensure regulatory approval or certification in another, but a failure or delay in obtaining regulatory approval or certification in one country or jurisdiction may negatively impact the regulatory process in others.

European Union

The primary regulatory environment in Europe is that of the European Union, which includes most of the major countries in Europe. The law regarding medical devices is harmonized in the European Union. On May 26, 2021, the Medical Devices Regulation (EU) 2017/745 (“MDR”) entered into application, repealing and replacing the previous Medical Device Directive (“MDD”) . As a Regulation, the MDR is directly applicable in all member states of the European Union and does not require further implementation into national law. The MDR and its associated amendments, guidance, documents and harmonized standards govern, among other things, device design and development, preclinical and clinical or performance testing, premarket conformity assessment, registration and listing, manufacturing, labeling, storage, claims, sales and distribution, export and import and post-market surveillance, vigilance, and market surveillance.

Since May 26, 2021, medical devices placed on the European Union market must conform to the requirements set out by the MDR. Medical devices must comply with the General Safety and Performance Requirements (“GSPRs”) set out in Annex I of the MDR. Compliance with these requirements is a prerequisite to be able to affix the CE mark to devices, without which they cannot be marketed or sold in the European Union. To demonstrate compliance with the GSPRs provided in the MDR and obtain the right to affix the CE mark, medical devices manufacturers must undergo a conformity assessment procedure. The conformity assessment procedure varies depending on the class of the product, but most cases involve an assessment by a Notified Body. Depending on the relevant conformity assessment procedure, this assessment may consist of a review of the technical file submitted by the manufacturer, an audit of the quality system of the manufacturer, and testing of the product of the manufacturer. Even though a Notified Body is a private organization in one of the member states of the European Union, all Notified Bodies in the European Union are designated and accredited by a national government of the European Union based on stringent criteria. Only such accredited Notified Bodies may give a CE Certificate of Conformity following successful completion of a conformity assessment procedure conducted in relation to the medical device and its manufacturer and their conformity with the GSPRs. The CE Certificate of Conformity confirms the conformity of the device to the GSPRs and allows the applicant to affix the CE mark on the assessed medical device and to commercialize it in the European Union after having prepared and signed a related European Union Declaration of Conformity.

As a general rule, demonstration of conformity of medical devices and their manufacturers with the GSPRs must be based, among other things, on the evaluation of clinical data supporting the safety and performance of the products during normal conditions of use. Specifically, a manufacturer must demonstrate that the device achieves its intended performance during normal conditions of use and that the known and foreseeable risks, and any adverse events, are minimized and acceptable when weighed against the benefits of its intended performance, and that any claims made about the performance and safety of the device (e.g., product labeling and instructions for use) are supported by suitable evidence. This assessment must be based on clinical data, which can be obtained from (i) clinical studies conducted on the devices being assessed, (ii) scientific literature from similar devices whose equivalence with the assessed device can be demonstrated or (iii) both clinical studies and scientific literature. The conduct of clinical studies in the European Union is governed by detailed regulatory obligations. These may include the requirement of prior authorization by the Competent Authorities of the country in which the study takes place and the requirement to obtain a positive opinion from a competent Ethics Committee. This process can be expensive and time-consuming. After a device is placed on the market in the European Union, it remains subject to significant regulatory requirements.

On July 26, 2011, our Notified Body at the time, TUV Nord, issued a CE Certificate of Conformity for, and thus allowed us to affix the CE mark, version 1.0 of the Heartflow Platform (July 26, 2011). The CE Certificate of Conformity was subsequently reviewed for subsequent versions of the Heartflow Platform.

In addition, TUV Nord assessed the conformity of our quality management system (“QMS”) with the industry standard, EN ISO 13485, and TUV Nord issued the certificate confirming that we meet all EN ISO 13485 requirements. Based on the EN ISO certificate, TUV Nord also issued a certificate under the MDSAP (Medical Device Single Audit Program), stating that the requirements of EN ISO 13485:2016 for quality management systems are met in Australia, Canada, USA and Japan.

In the second half of 2024, we changed Notified Bodies from TUV Nord to BSI by an agreement between TUV Nord, BSI and us. BSI has taken over Notified Body responsibilities concerning all EU MDR and MDSAP requirements. BSI has also taken over our QMS certifications. Our CE Mark and Quality System MDSAP certifications are currently issued by BSI.

The advertising and promotion of medical devices in the European Union is subject to the national laws of the individual European Union Member States that implemented the MDD, the AIMD and that apply the MDR, Directive 2006/114/EC concerning misleading and comparative advertising, and Directive 2005/29/EC on unfair commercial practices, as well as other national legislation of individual European Union Member States governing the advertising and promotion of medical devices. European Union Member States’ national legislation may also restrict or impose limitations on our ability to advertise our products directly to the general public. In addition, voluntary European Union and national industry Codes of Conduct provide guidelines on the advertising and

promotion of our products to the general public and may impose limitations on our promotional activities with healthcare professionals.

In addition, other countries, such as Switzerland, have voluntarily adopted laws and regulations relating to medical devices that mirror those of the European Union. Medical devices certified by a Notified Body and CE marked in the European Union may be placed on Swiss market.

United Kingdom

The United Kingdom left the European Union in January of 2020 and the transitional period ended on December 31, 2020. In light of the fact that the CE Marking process is set out in European Union law, which no longer applies in the United Kingdom, the United Kingdom has devised a new route to market culminating in a UKCA Mark to replace the CE Mark. Northern Ireland will, however, continue to be covered by the regulations governing CE Marks. The United Kingdom Medicines and Healthcare products Regulatory Agency (“MHRA”) has established transitional provision to recognize the acceptance of certain CE marked medical devices on the Great Britain market until June 30, 2030, at the latest, depending on the type of device and its classification. Manufacturers of medical devices located outside the United Kingdom, including manufacturers of CE marked medical devices, need to appoint a United Kingdom Responsible Person before the devices may be placed on the United Kingdom market. The United Kingdom government plans on introducing new legislation governing medical devices which will be delivered though secondary legislation. The first piece of legislation was laid in 2024 and updates post-market surveillance requirements. Additional instruments will follow in 2025 and 2026 to introduce new pre-market requirements including international reliance, and further enhancements to the regulations.

Japan

We applied for marketing authorization with the PMDA in Japan in February 2015, which was approved in November 2016. As a result, we are able to commercially market the FFRCT product in Japan. Our initial SHONIN application is still current and includes minor change notifications.

Canada

Heartflow received our initial Canadian Medical Device License in August 2015. This remains current and updated frequently with amendments for every minor software release. As well, Canada recognizes the Heartflow Mobile application as a separate device identified within our Heartflow device family and requires amendments for Mobile updates.

Other Regulations - Federal and State Fraud and Abuse, Data Privacy and Security and Transparency Laws

In addition to FDA restrictions on marketing and promotion of medical devices, there are numerous U.S. federal and state laws, regulations, and guidance documents pertaining to healthcare compliance protections against fraud and abuse, including anti-kickback laws, payment transparency laws, patient inducement laws, and false claims laws, and, in some states, prohibitions against the corporate practice of medicine and the unlicensed practice of medicine (collectively, fraud and abuse laws and regulations). Our relationships with physicians, hospitals and other healthcare providers and referral sources for our products are subject to scrutiny under these laws. Violations of these laws may be punishable by criminal and civil sanctions, including, in some instances, imprisonment and exclusion from participation in federal and state healthcare programs, including the Medicare, Medicaid and Veterans Administration health programs. Because of the breadth and far-reaching nature of these laws, we may be required to alter or discontinue one or more of our business practices to be in compliance with these laws.

These healthcare fraud and abuse laws and regulations are complex, and even minor departures from what is expressly permitted under the laws and regulations can potentially give rise to claims that a statute or regulation has been violated in a manner that could result in serious criminal or civil consequences. Several of the more significant healthcare fraud and abuse laws and regulations that may affect our business or ability to operate are summarized below.

The federal Anti-Kickback Statute is a criminal law that prohibits, among other things, knowingly and willfully offering, paying, soliciting, or receiving any remuneration in cash or in-kind (including any kickback or bribe, but also common forms of remuneration, such as service or consulting fees, service fees, meals, travel expenses, discounts, or rebates), directly or indirectly, overtly or covertly, to induce or in return for purchasing, leasing, ordering or arranging for or recommending the purchase, lease or order of any item or service reimbursable, in whole or in part, under Medicare, Medicaid or other federal healthcare programs. The term “remuneration” has been broadly interpreted to include anything of value. Although there are a number of statutory exceptions and regulatory safe harbors protecting some common activities, the exceptions and safe harbors are drawn narrowly. Practices that involve remuneration that may be alleged to be intended to induce prescribing, uses, purchases, or recommendations of prescriptions, uses, or purchases of our products may be subject to scrutiny if they do not qualify for an exception or safe harbor. Failure to meet all of the requirements of a particular applicable statutory exception or regulatory safe harbor does not make the conduct per se illegal under the Anti-Kickback Statute. Instead, the legality of the arrangement will be evaluated on a case-by-case basis based on a review of all relevant facts and circumstances. Several courts have interpreted the statute’s intent requirement to mean that if any one purpose of an arrangement involving remuneration is to induce referrals of (or purchases, uses, or recommendations of prescriptions, uses, or purchases) federal healthcare program covered business, the Anti-Kickback Statute has been implicated and potentially violated.

Additionally, the Anti-Kickback Statute was amended by the ACA. Specifically, as noted above, under the Anti-Kickback Statute, the government must prove that a defendant acted “knowingly” to prove a violation. The ACA added a provision that clarifies that with respect to violations of the Anti-Kickback Statute, “a person need not have actual knowledge” of the Statute or specific intent to commit a violation of the Statute. This change effectively overturns case law interpretations that set a higher standard under which prosecutors had to prove the specific intent to violate the law. In addition, the ACA codified case law that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute may constitute a false or fraudulent claim for purpose of the federal civil False Claims Act.

The federal civil U.S. False Claims Act prohibits, among other things, any person or entity from knowingly presenting, or causing to be presented, a false or fraudulent claim for payment or approval to the federal government or knowingly making, using or causing to be made or used a false record or statement material to a false or fraudulent claim to the federal government. A claim includes “any request or demand” for money or property presented to the United States government. The civil False Claims Act also applies to false submissions that cause the government to not receive a benefit to which it is entitled, such as a discounted sales price for products covered by federal healthcare programs. Intent to deceive is not required to establish liability under the civil False Claims Act. In addition, the civil False Claims Act includes a whistleblower provision that allows private citizens to bring claims on behalf of the United States government alleging violations of the law. Whistleblowers may be entitled to up to as much as thirty percent (30%) of the government’s financial recovery resulting from such claims. This incentivizes potential whistleblowers to file complaints in federal court, which complaints are relied upon heavily by the government to investigate and prosecute allegations of violations of both the civil False Claims Act and the Anti-Kickback Statute. For example, in October 2025, we and certain of our employees received civil investigative demands (the “CID”) from the U.S. Department of Justice, Civil Division, in connection with an investigation under the federal Anti-Kickback Statute and Civil False Claims Act (the “Investigation”). The CID requests information, documents, and testimony focused on our financial and contractual arrangements with providers and our sales and marketing activities. We are cooperating with the Investigation. We are unable to express a view at this time regarding the likely duration, or ultimate outcome, of the Investigation. Depending on the outcome of the Investigation, there may be a material impact on our business, results of operations, financial condition, or cash flows.

Many medical device, pharmaceutical, biotech and other healthcare companies have been investigated or prosecuted under these healthcare fraud and abuse laws and regulations. Investigations, prosecutions (and settlements) relate to a wide range of activities, including among other things, improper clinical studies, provision of consulting fees to physicians for services that were not commercially reasonable, providing free product to customers to induce them to do business with the manufacturer, providing high value meals to customers to induce them to do business with the manufacturer, or providing non-compliant discounts or rebates to customers, with the expectation that the customers would bill federal programs for the product or the medical services that involve the product. Other companies have been investigated or prosecuted for causing false claims to be submitted by, among other things,

marketing of products for unapproved, and thus noncovered, uses, or for promotion of uses inconsistent with approved labeling (“off label” promotion).

The United States government may further prosecute conduct constituting a false claim under the criminal False Claims Act. The criminal False Claims Act prohibits the making or presenting of a claim to the government knowing such claim to be false, fictitious, or fraudulent and, unlike the civil False Claims Act, requires proof of intent to submit a false claim.

In addition to the Anti-Kickback Statute and the civil and criminal False Claims Acts, the United States federal government has the authority to seek civil monetary penalties, assessments and exclusions against an individual or entity based on a wide variety of prohibited conduct. For example, the Civil Monetary Penalties Law authorizes the imposition of substantial civil money penalties against an entity that engages in activities including: (i) knowingly presenting or causing to be presented, a claim for services not provided as claimed or which is otherwise false or fraudulent in any way; (ii) knowingly giving or causing to be given false or misleading information reasonably expected to influence the decision to discharge a patient; (iii) offering or giving remuneration to any beneficiary of a federal healthcare program likely to influence the receipt of reimbursable items or services; (iv) arranging for reimbursable services with an entity which is excluded from participation from a federal healthcare program; (v) knowingly or willfully soliciting or receiving remuneration for a referral of a federal healthcare program beneficiary; or (vi) using a payment intended for a federal healthcare program beneficiary for another use.

There are other federal anti-fraud laws, including the Health Information Portability and Accountability Act’s fraud provisions, that prohibit, among other actions, knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private payors, knowingly and willfully embezzling or stealing from a healthcare benefit program, willfully obstructing a criminal investigation of a healthcare offense, and knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services.

Finally, many states and foreign countries have similar healthcare fraud and abuse statutes or regulations that may be broader in scope and may apply regardless of payor, in addition to items and services reimbursed under Medicaid and other state programs.

Violations any of these laws or any other governmental regulations that may apply to us may result in significant civil, criminal and administrative penalties, damages, fines, disgorgement, imprisonment or exclusion of devices from government-funded healthcare programs, such as Medicare and Medicaid or comparable foreign programs.

Physician Payment Sunshine Act

Transparency laws regarding payments or other transfers of value provided to certain licensed healthcare professionals and teaching hospitals may also impact our business practices. The federal Physician Payment Sunshine Act requires most medical device manufacturers, including Heartflow, to track and report annually to the Secretary of the United States Department of Health and Human Services (“HHS”) financial arrangements, payments, and other transfers of value made by that entity to physicians (defined to include doctors, dentists, optometrists, podiatrists, and chiropractors), other healthcare providers (such as physician assistants and nurse practitioners) and teaching hospitals, as well as ownership and investment interests held by such physicians and their immediate family members. The payment information is made publicly available in a searchable format on the CMS Open Payments website. Similar laws have been enacted or are under consideration in several states and foreign jurisdictions, including states such as Massachusetts and Vermont, and countries like France, which has adopted the Loi Bertrand, or French Sunshine Act, which became effective in 2013. We will need to dedicate significant resources to establish and maintain systems and processes in order to comply with these regulations. Failure to comply with these federal reporting requirements can result in significant civil monetary penalties. In addition, information reported to HHS, since it is publicly reported, can potentially be used by a whistleblower to bring claims under the civil False Claims Act alleging that certain payments or transfers of value gave rise to kickbacks or false claims.

The Foreign Corrupt Practices Act

The U.S. Foreign Corrupt Practices Act (“FCPA”) prohibits any U.S. individual or business from promising, offering, paying, providing or authorizing the provision of money or anything else of value, directly or indirectly, to any foreign official, political party candidate or certain other persons (including health care professionals of state-funded hospitals) for the purpose of influencing any act or decision of the foreign entity in order to assist the individual or business in obtaining, retaining or directing business. The FCPA also obligates companies whose securities are listed in the United States to comply with accounting provisions requiring them to maintain books and records that accurately and fairly reflect all transactions of the corporation, including international subsidiaries, and to devise and maintain an adequate system of internal accounting controls for domestic and international operations. Activities that violate the FCPA, even if they occur wholly outside the United States, can result in criminal and civil fines, imprisonment, disgorgement, oversight, and debarment from government contracts. In addition, several other domestic and international anti-corruption or anti-bribery laws within and outside the United States apply to our business.

Privacy, Security and Breach Notification

Other federal and state laws and regulations restrict or otherwise impact our business practices. These laws include, without limitation, data privacy, security and breach notification authorities.

HIPAA, as amended by HITECH, requires health plans, certain healthcare providers and healthcare clearinghouses, referred to as “Covered Entities,” to protect the privacy and security of certain types of health information, referred to as protected health information (“PHI”). HIPAA also imposes various requirements on “Business Associates” — entities performing services for, or on behalf of, a Covered Entity that has access to the Covered Entity’s PHI in connection with providing those services as well as their covered subcontractors. Three key sets of federal regulations implementing HIPAA — the Privacy, Security Breach Notification and Omnibus Rules (collectively, “HIPAA Rules”) set forth a number of standards that Covered Entities and Business Associates must meet with respect to protecting the privacy and security of PHI. HIPAA also regulates standardization of data content, codes and formats used in healthcare transactions and standardization of identifiers for health plans and providers.

Our customers are Covered Entities under HIPAA, and, in some cases, Heartflow may be considered a Business Associate to such Covered Entities when they pay Heartflow for certain services that involve the sharing of PHI with Heartflow. When Heartflow bills payors directly for the services, Heartflow is acting as a Covered Entity. Whether acting as a Business Associate, covered subcontractor, or a Covered Entity, Heartflow has obligations to comply with HIPAA and the HIPAA Rules, and either contractual obligations to its Covered Entity Customers or statutory and contractual obligations to ensure that any sub-Business Associates comply. This requires risk assessments and a wide range of compliance policies, procedures and practices to safeguard.

Penalties for violations of HIPAA regulations include civil and criminal penalties. Our failure to comply with HIPAA could result in significant criminal and civil penalties and other damages which could adversely affect our results of operations, financial position or cashflows. We have developed and implemented processes designed to comply with HIPAA and are continuing to assess the need for additional safeguards, policies, procedures, and programing and to develop them where necessary. The requirements under HIPAA may change periodically and could have an effect on our business operations if compliance becomes substantially more costly than under current requirements. Additionally, a breach of unsecured PHI, such as by employee error or an attack by an outsider, could have an adverse effect on our business in terms of potential penalties and corrective action required, in addition to reputational damage.

In addition to HIPAA and other federal privacy regulations, there are a number of state laws governing privacy, confidentiality and security of health information that apply to our business. Most states also have authorities governing breach notification. New laws governing privacy, security, and breach notification may be adopted in the future as well. We have undertaken measures to comply with health information privacy requirements to which we know we are subject. However, we can provide no assurance that we are or will always remain in compliance with diverse and changing privacy, security, and breach notification requirements in all of the jurisdictions in which we do business. Failure to comply with privacy security or breach notification requirements could result in civil or criminal penalties, which could have an adverse effect on our business. Our failure to adequately protect personal or

health related information could have an adverse effect on our business. A wide variety of provincial, state, national and international laws and regulations apply to the creation, collection, use, retention, protection, disclosure, transfer, and other processing of personal information, including protected health information. These data protection and privacy and security related laws and regulations are evolving and being tested in courts, and may result in ever increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. Our failure to comply with applicable laws and regulations, or to protect such data, could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by end customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing end customers and potential end customers), any of which could have an adverse effect on our operations, financial performance, and business. Evolving and changing definitions of personal data and personal information, within the European Union, the United States and elsewhere, especially relating to classification of IP addresses, machine identification, location data, and other information, may limit or inhibit our ability to operate or expand our business. Even the perception of privacy concerns, whether or not valid, may harm our reputation and inhibit adoption of our product by current and future end customers.

Healthcare Reform

Current and future U.S. legislative proposals to further reform healthcare or reduce healthcare costs may result in low, or even no, reimbursement for our product, or for the procedures associated with the use of our product, or limit coverage of our product. The cost containment measures that payors and providers are instituting and the effect of any healthcare reform initiative implemented in the future could significantly reduce our revenues from the sale of our product. Alternatively, the shift away from fee-for-service agreements to capitated payment models supports the value of our product, as they are intended to reduce longitudinal resource utilization, which can be cost saving for both payors and providers.

The ACA was enacted in March 2010. As a U.S.-based company with anticipated sales in the United States, these healthcare reform laws will materially impact our business. Certain provisions of the ACA are still set to become effective in future years and the administrative agencies responsible for issuing regulations that implement some aspects of the laws have yet to do so.

There have been numerous legal challenges and Congressional actions and amendments to certain aspects of the ACA. For example, on August 16, 2022, the Inflation Reduction Act of 2022 (“IRA”) was signed into law, which, among other things, extends enhanced subsidies for individuals purchasing health insurance coverage in ACA marketplaces through plan year 2025. The IRA also eliminates the “donut hole” under the Medicare Part D program beginning in 2025 by significantly lowering the beneficiary maximum out-of-pocket cost and creating a new manufacturer discount program. Additionally, on July 4, 2025, the annual reconciliation bill, the “One Big Beautiful Bill Act,” or OBBBA, was signed into law which is expected to reduce Medicaid spending and enrollment by implementing work requirements for some beneficiaries, capping state-directed payments, reducing federal funding, and limiting provider taxes used to fund the program. OBBBA also narrows access to ACA marketplace exchange enrollment and declines to extend the ACA enhanced advanced premium tax credits, set to expire in 2025, which, among other provisions in the law, are anticipated to reduce the number of Americans with health insurance. Further, it is unclear whether there will be additional attempts to repeal the ACA outright or further pare back its subsidies and enrollment periods.

The uncertain fate of the ACA notwithstanding, we expect that the ACA, as well as other healthcare reform measures that may be adopted in the future, particularly in light of the recent changes in the White House and Congress, may result in more rigorous coverage criteria and in additional downward pressure on the price that we may receive for our products. Any reduction in payments from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms may prevent us from being able to generate additional revenue or attain profitability.

Employees and Human Capital Resources

As of December 31, 2025, we had 843 full-time employees globally. We believe the success of our business will depend, in part, on our ability to attract and retain qualified personnel, in particular highly skilled technology

personnel. Our employees are not subject to a collective bargaining agreement, and we believe that we have good relations with our employees.

Our human capital resources objectives include attracting and retaining top talent, investing in our talent with leadership development and job-related technical training, and increasing diverse representation in our employee base through inclusivity initiatives that build on our culture of inclusion and belonging. The principal purposes of our equity incentive plans are to attract, retain and motivate employees, consultants and directors through the granting of stock-based compensation awards and cash-based performance bonus awards.

Corporate Information

We were incorporated under the laws of the State of Delaware in 2007. On March 1, 2021, we completed an internal reorganization in which a newly formed parent holding company was put in place. The previous holders of our common stock and preferred securities became holders of common stock and preferred securities of HeartFlow Holding, Inc. The equity incentive plan, outstanding equity awards, outstanding warrants and certain other equity-related agreements of HeartFlow, Inc. were assumed by HeartFlow Holding, Inc. Our operations and business activities remained at HeartFlow, Inc., and the wholly-owned non-U.S. subsidiaries of HeartFlow, Inc. remained in place. On July 17, 2025, we consolidated HeartFlow Holding, Inc. into HeartFlow, Inc. and the previous holders of HeartFlow Holding, Inc. common stock and preferred securities became holders of our common stock and preferred securities and the equity incentive plan, outstanding equity awards, outstanding warrants and certain other equity-related agreements of HeartFlow Holding, Inc. were assumed by us. In connection with this consolidation, we changed our name to Heartflow, Inc. Our principal executive offices are located at 331 E. Evelyn Avenue, Mountain View, California 94041, and our telephone number is (650) 241-1221. Our corporate website address is www.heartflow.com. Information contained on, or accessible through, our website shall not be deemed incorporated into and is not a part of this Annual Report or the registration statement of which it forms a part. We have included our website in this Annual Report solely as an inactive textual reference.

Available Information

Our primary Internet address is http://www.heartflow.com. We make our U.S. Securities and Exchange Commission (“SEC”) periodic reports (Forms 10-Q and Forms 10-K) and current reports (Forms 8-K) available free of charge through our website as soon as reasonably practicable after they are filed electronically with the SEC. The content of our website is not incorporated by reference into this Annual Report on Form 10-K or into any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.

The SEC also maintains an Internet website at http://www.sec.gov that contains reports, proxy and information statements, and other information that we file electronically with the SEC.

Heartflow, Inc. (HTFL) Business

Item 1. Business

Overview

Our Technology

Table of Contents

The CCTA + Heartflow Pathway

The Heartflow Platform Portfolio

Table of Contents

Table of Contents

Table of Contents

Our Growth Strategies

Table of Contents

Our Production Process

Table of Contents

Our Data Security

Our Clinical Results and Economic Evidence

Table of Contents

Our Heartflow FFRCT Analysis

Table of Contents

Our Heartflow Plaque Analysis

Table of Contents

Other Clinical Studies

Table of Contents

Sales and Marketing

Research and Development

Table of Contents

Reimbursement

Seasonality

Competition

Table of Contents

Intellectual Property

Table of Contents

Government Regulation

United States Regulation of Medical Devices

FDA Premarket Clearance and Approval Requirements

Table of Contents

510(k) Clearance Marketing Pathway

De Novo Classification Process

Table of Contents

Medical Device Clinical Trials

Post-market Regulation

Table of Contents

Table of Contents

International Regulation — European Union, United Kingdom, Japan and Canada

European Union

Table of Contents

Table of Contents

promotion of our products to the general public and may impose limitations on our promotional activities with healthcare professionals.

United Kingdom

Japan

Canada

Table of Contents

Table of Contents

Finally, many states and foreign countries have similar healthcare fraud and abuse statutes or regulations that may be broader in scope and may apply regardless of payor, in addition to items and services reimbursed under Medicaid and other state programs.

Physician Payment Sunshine Act

Table of Contents

The Foreign Corrupt Practices Act

Privacy, Security and Breach Notification

Table of Contents

Healthcare Reform

Employees and Human Capital Resources

Table of Contents

personnel. Our employees are not subject to a collective bargaining agreement, and we believe that we have good relations with our employees.

Corporate Information

Available Information