Heartflow

1.1 Identity, headquarters, and product stack

Heartflow is a coronary-care software company that says its mission is to turn coronary artery disease from the leading cause of death into a condition that can be detected early, diagnosed accurately, and managed for life. The company was incorporated in Delaware in 2007 as Cardiovascular Simulation, changed its name to HeartFlow in 2009, and by 2025 consolidated its holding-company structure back into Heartflow, Inc. The operating concept has stayed consistent: start with a coronary CTA scan, generate a patient-specific 3D model, and deliver software outputs that clinicians can use across detection, physiology, plaque assessment, and procedure planning. Heartflow now bundles that stack as Heartflow One, with Roadmap Analysis for lesion review, FFRCT Analysis for non-invasive physiology, Plaque Analysis for plaque volume and composition, and PCI Navigator for interventional planning. A notable identity nuance for later chapters is headquarters drift across source dates: the 2025 10-K still listed Mountain View as the principal executive office, while 2026 product and investor pages display a San Francisco address and first-quarter results tied the move to facilities optimization.[CO001, CO002, CO003, CO004, CO005, CO006]

1.2 Leadership, founders, and governance posture

Heartflow's current operating leadership is centered on President and CEO John Farquhar, who officially took the CEO role on March 1, 2022 after joining as chief operating officer in August 2021 and becoming president at the start of 2022. His biography and the transition release frame him as the commercial scaling executive for the public-era chapter, while co-founder John Stevens shifted to vice chair and remains important as a board-level continuity figure. Founder-market fit still matters because the technical origin story is unusually strong: Charles Taylor, the computational-science co-founder, is independently described as the architect of the non-invasive blood-flow simulation work that created Heartflow's first product category. Governance is also unusually heavyweight for a medtech software company of this size. The board chair is former Johnson & Johnson chief executive William C. Weldon, and the public about page also identifies directors including Tim Barabe, Julie Cullivan, Jeffrey Lightcap, Wayne Riley, and Casey Tansey. That mix suggests board coverage across medtech operations, healthcare investing, enterprise scale-up, and policy, but it also highlights key-person dependence on Farquhar for execution and on the founding technical narrative for product credibility.[CO012, CO013, CO014, CO015, CO016, CO017]

1.3 Public-market status, revenue scale, and stakeholder map

Heartflow crossed from venture-backed medtech startup into public company territory in August 2025, when it priced 16.7 million IPO shares at $19.00, raised expected gross proceeds of about $316.7 million, and began trading on Nasdaq under the ticker HTFL. That IPO matters because it resets the capital story from opaque venture financing to a public-equity base with daily market pricing and formal quarterly disclosure. The first two public earnings releases already give later chapters reusable operating anchors: full-year 2025 revenue was $176.0 million with 76.8% gross margin, and first-quarter 2026 revenue reached $52.6 million with 80.2% gross margin, while cash and investments remained above $250 million. Scale indicators are also unusually explicit for a company at this stage. Heartflow said adoption exceeded 1,800 institutions globally and nearly 650,000 patients by May 2026; year-end 2025 disclosures also cited a 1,465-account U.S. installed base and 489 U.S. Plaque accounts. Market-cap snapshots around May 19-20, 2026 placed equity value near $2.33 billion. The main missing piece is exact post-IPO beneficial ownership by legacy investors, insiders, and public float, which limits any strong control-rights conclusion from public sources alone.[CO019, CO020, CO021, CO022, CO023, CO024]

1.4 Milestones, reimbursement expansion, and adverse signals

The milestone record shows a company with real product and commercial momentum, but not a finished risk profile. Independent retrospective coverage credits Heartflow's first FFRCT product with U.S. commercial availability in 2014, while the FDA's K190925 record confirms 2019 clearance for HeartFlow FFRct Analysis. By 2021-2025 the company extended beyond physiology into Roadmap, Plaque, and later PCI planning, with external coverage in September 2025 documenting next-generation plaque clearance and a 21% claimed detection improvement over the first-generation algorithm. Reimbursement momentum also improved materially: Heartflow emphasized growing payer coverage for plaque analysis, Banner became a visible customer and later a broader strategic partner, and trade press argued that new CMS and CPT economics should accelerate CCTA-based adoption. But this is also where the most useful adverse evidence sits. The 2025 10-K warns that Heartflow still depends heavily on FFRCT, faces significant competition, and is generating only very limited revenue from a still-nascent Plaque commercialization effort. Independent reporting adds a second risk lens: the new AI plaque reimbursement codes are attracting scrutiny about whether four-figure payments are justified by clinical and economic benefit. The April 2026 patent case against Cleerly reinforces that this is now an active competitive category rather than a field Heartflow owns uncontested.[CO031, CO032, CO033, CO034, CO035, CO036]

1.5 Exhibits

2.1 Market boundary and evidence-constrained sizing

Heartflow is not selling into all of cardiology imaging; its commercial wedge is the CCTA-based analysis layer that sits after a coronary CTA scan and before a treatment decision. The included spend therefore centers on software analysis, interpretation support, and reimbursement-linked add-ons such as FFRCT and plaque quantification, while excluded spend includes the scanner itself, broad hospital cardiology budgets, and therapeutic procedures that happen only after a diagnostic decision is made. Public evidence is strongest for four sizing lenses rather than a textbook TAM: the sheer burden of CAD, the installed base of Heartflow-enabled accounts, the coverage breadth for reimbursed analyses, and the attach gap between FFRCT-era footprint and Plaque-era utilization. That is enough to show a real and expanding market, but not enough to publish one clean TAM/SAM/SOM number without layering in assumptions about annual CCTA volume, case mix, and payer approval. The practical implication is that Heartflow's valuation-relevant market is best understood as a constrained CCTA workflow market with large upside, not as all cardiovascular imaging spend.[CM001, CM002, CM009, CM010, CM011, CM022]

2.2 Buyer, user, payer, and workflow economics

The economic buyer for Heartflow is usually the health system or imaging program that must justify building and sustaining a high-quality CCTA workflow, but the daily users span imaging cardiologists, radiologists, preventive cardiologists, and increasingly interventional teams. Heartflow's own disclosures make clear that commercialization is not just an algorithm sale: RoadMap is delivered automatically, FFRCT and Plaque are ordered selectively, and the company supports coding, appeals, rate negotiation, PACS and EMR integration, and peer-to-peer education. Reimbursement changes materially improved the adoption case. CMS lifted baseline CCTA payment for 2025, FFRCT reimbursement remained above $1,000, and plaque analysis received Category I coding plus broader payer coverage. Even so, the purchase still requires hospital workflow redesign, physician confidence, and a budget owner willing to treat CCTA plus AI as a programmatic pathway rather than a one-off interpretation service.[CM003, CM004, CM014, CM015, CM016, CM026]

2.3 Growth drivers, reimbursement catalysts, and adoption barriers

Three forces currently support market growth. First, Heartflow and trade press both point to a reimbursement regime that now better rewards AI-assisted coronary analysis, especially as plaque analysis moved into Category I reimbursement and national commercial coverage expanded. Second, Heartflow says it has deep clinical validation, broad guideline support, and a growing real-world dataset, all of which help persuade clinicians and payers that the pathway is not just another radiology AI overlay. Third, workflow automation matters: RoadMap, integration services, and customer-support infrastructure reduce the operational burden of scaling CCTA programs. The barriers, however, are not cosmetic. Heartflow itself warns that physicians may be unwilling to change standard practice, payers may still narrow or revise coverage, and plaque commercialization remains nascent despite early momentum. That means the category can grow quickly while still remaining operationally fragile and sensitive to evidence, coding policy, and local workflow execution.[CM009, CM010, CM011, CM012, CM013, CM016]

2.4 Competition, substitutes, and Heartflow positioning

Heartflow sits inside a crowded competitive stack rather than a winner-take-all software category. Direct AI rivals include Cleerly, Elucid, and Keya; adjacent physiology and post-processing vendors include Medis; and the broader structure is shaped by CT OEMs that can bundle cardiac CT capability while also defending legacy modalities such as stress imaging. Cleerly already markets comparative claims against FFRCT and stress testing, Elucid differentiates on histology-based plaque composition, Keya pushes non-invasive CT FFR economics, and Medis offers angiography-derived physiology through vendor-independent software. Outside the software set, invasive angiography and traditional stress tests still compete for the same diagnostic decision and remain deeply embedded in clinical routines. Heartflow's counter-position is to be the analysis layer of record for CCTA programs: broad reimbursement, high installed base, dataset scale, clinical evidence, and workflow support are the company's core moat arguments. The market-structure consequence is that Heartflow benefits from CCTA growth, but it does not control the scanner, the ordering behavior, or the reimbursement environment outright.[CM005, CM006, CM007, CM008, CM029, CM032]

3.1 Landscape: direct peers, incumbents, substitutes, and entrants

Heartflow sits in a layered market rather than a clean one-for-one software category. The most direct overlap is with Cleerly, Elucid, and Keya, all of which use coronary CT images to quantify plaque, estimate ischemia, or both. Medis is not a true like-for-like substitute for Heartflow’s non-invasive cloud workflow, but it does matter because QFR gives interventional cardiologists an adjacent physiology product inside the cath-lab decision chain. Upstream, scanner and post-processing incumbents such as Siemens, Canon, and GE shape who even has the cardiac CT capacity to adopt CCTA-first pathways, which gives them distribution leverage that pure software vendors lack. The status quo remains resilient: stress testing, PET or SPECT, and direct referral to invasive angiography still compete for the same diagnostic decision, especially where CCTA programs are immature or clinicians do not trust additional software layers. The next competitive wave is already visible. Cardiovascular Business reported that newer plaque-analysis vendors such as Caristo, Artrya, Circle Cardiovascular, Ziosoft, and Siemens’ pending plaque tools are trying to exploit the same reimbursement opening that helped Heartflow and Cleerly scale. The implication is that Heartflow’s market leadership is real, but it sits inside a broadening reimbursed stack where competitors can arrive from direct AI, cath-lab software, or OEM channels rather than from one obvious peer set.[CP001, CP002, CP003, CP004, CP005, CP029]

3.2 Direct competitor profiles, capability overlap, and trust posture

Among direct peers, Cleerly is the most obviously scaled and commercially aggressive challenge because it combines large disclosed funding, coverage wins, and explicit comparative claims against FFRCT and stress testing. It presents itself as a three-in-one plaque, stenosis, and ischemia workflow rather than a point plaque reader. Elucid is more differentiated than directly substitutive today: its pitch is histology-based plaque composition and risk stratification, not current commercial FFRCT scale, though it is clearly building toward a reimbursed plaque-plus-FFRCT stack. Keya is the most credible lower-friction FFRCT challenger in the U.S. because it is already FDA-cleared and tied to code 75580, but its plaque product remains investigational in the United States, which limits direct overlap with Heartflow’s expanding plaque narrative. Medis has far more operating history than the startup peers, yet its center of gravity is still angiography-derived physiology and cath-lab planning rather than reimbursed non-invasive plaque analysis. Relative to this field, Heartflow’s trust posture remains strongest where buyers care about broad guideline support, direct installed-base scale, human-reviewed workflow operations, and both plaque and physiology under one commercial umbrella. The downside is that Heartflow no longer has a category with no alternatives: Cleerly is contesting the clinical narrative, Elucid is contesting tissue characterization, Keya is contesting lower-friction FFRCT delivery, and Medis plus OEMs contest the downstream procedural workflow.[CP006, CP007, CP010, CP011, CP014, CP015]

3.3 Pricing signals, GTM power, switching cost, and multi-homing

Public pricing visibility is poor, so the cleanest comparison is not list price but the reimbursement and workflow structure each vendor brings to market. Heartflow has the strongest public reimbursement footing, with broad FFRCT coverage, substantial plaque coverage, and a mature direct-sales and customer-success model. Cleerly and Elucid now benefit from the same plaque reimbursement tailwind, but neither publishes net contract pricing in the reviewed source set. Keya makes a different pitch: it stresses patient- and payer-centric pricing, no scanner certification, and the ability to run analysis remotely or on site, which lowers deployment friction and may make it easier for a site to trial DVFFR next to existing tools. Medis and OEM ecosystems compete differently again; their advantage is channel access. GE’s partnership with Medis shows how incumbents can pull physiology software into established interventional sales motion, while Siemens and Canon already sit close to scanner procurement and cardiac CT workflow design. That means Heartflow’s switching cost is meaningful after go-live—because billing support, workflow integration, case lists, and physician habits accumulate around the installed account—but not absolute. A hospital can still multi-home by keeping a CCTA program, using Heartflow for some cases, testing Cleerly or Keya for others, and relying on Medis or OEM tooling downstream. In this market, lock-in comes less from hardware dependence and more from reimbursement confidence, reading habits, and partner access.[CP012, CP013, CP018, CP022, CP023, CP024]

3.4 Moat durability, commoditization risk, and adverse evidence

Heartflow’s moat is still stronger than any single peer’s because it combines scale, reimbursement, product breadth, and embedded commercial operations. The company’s direct evidence for this is compelling: 1,465 installed U.S. accounts at the end of 2025, more than 1,800 institutions globally by mid-2026, and a dataset the company says exceeded 200 million annotated CCTA images. That is hard for hospitals to recreate internally and hard for smaller rivals to match quickly. But the moat is not self-reinforcing in the way scanner ownership or a procedure-room install base would be. Cleerly is openly attacking Heartflow’s clinical narrative; Elucid is trying to own the high-risk plaque story; Keya offers a more flexible FFRCT deployment model; and Medis plus GE illustrate how adjacent incumbents can meet cardiologists later in the workflow. Adverse evidence also exists on pricing and durability. STAT questioned whether the new roughly $1,000 plaque-analysis payment is worth it, which matters because payer skepticism can flatten category margins even if clinical adoption grows. Heartflow’s patent suit against Cleerly signals both confidence and vulnerability: its IP estate is large, but the case itself shows that direct rivals are now close enough to trigger legal defense. The clearest conclusion is that Heartflow still leads, yet its future edge depends on staying the operational default for CCTA programs before reimbursed plaque and physiology tools become commoditized across multiple vendors.[CP010, CP011, CP017, CP020, CP027, CP036]

4.1 Revenue model, mix, and monetization quality

Heartflow’s revenue quality is better than a typical early public medtech story because the company is not trying to sell scanners, cath-lab hardware, or one-time software licenses. The 10-K says substantially all revenue is usage-driven, recognized when the requested analysis is delivered, and billed directly to the account each time a physician chooses FFRCT, Plaque, or both. That matters because it ties revenue to real clinical usage rather than to booked seats or deployment promises. The problem is concentration. Management disclosed that FFRCT still represented 98% of revenue at year-end 2025, which means public investors are still underwriting one dominant product plus a Plaque upsell story rather than a balanced multi-module platform. Plaque reimbursement and recent FDA updates help, but commercialization started with limited market education in late 2023 and still lacks product-level revenue disclosure. RoadMap improves retention and workflow but is generally bundled, while PCI Navigator was framed as an integrated feature rather than a separate paid SKU. The result is a monetization stack with strong per-use economics and low hardware friction, but only one clearly proven revenue engine.[CI011, CI012, CI013, CI014, CI015, CI016]

4.2 GTM motion, installed-base utilization, and sales-efficiency proxies

Public data gives Heartflow useful GTM signals even though it does not publish a clean CAC or payback dashboard. The company describes a segmented field model in which Territory Sales Managers win new accounts and Territory Account Managers increase utilization, while the onboarding process avoids customer-side capital equipment purchases. Support is not limited to technical deployment: Heartflow markets training, PACS and EMR integration, coding support, rate negotiation, claims-audit help, appeals assistance, peer education, and case support. That operating model should lower adoption friction and helps explain why the company could reach a 1,465-account U.S. installed base and more than 1,800 institutions globally. Utilization trends are also constructive. Revenue cases climbed from 40,336 in the first quarter of 2025 to 57,776 in the fourth quarter, and management says new accounts usually take about 12 months to reach steady-state volumes. The caveat is pricing mix. Clinic and office accounts carry lower pricing than hospitals, and their share of U.S. revenue cases kept rising, which can dilute blended ASP even while volume grows. Public disclosures therefore support scale and adoption momentum, but they still do not reveal the actual cost of customer acquisition, rep productivity, or mature-account expansion economics.[CI021, CI022, CI023, CI024, CI025, CI026]

4.3 Cost structure, gross-margin drivers, and operating leverage

Heartflow’s public numbers show a company with genuine gross-margin progress but a still-heavy operating-cost structure. Full-year 2025 gross margin reached 76.8%, then 80.2% in the first quarter of 2026, with management attributing expansion to higher case volume and AI-driven productivity improvements inside the production team. The 10-K is useful because it explains what sits beneath that margin: production labor, hosting, software amortization, contract-fulfillment amortization, royalty payments, and facilities or technology overhead. That is better than a hardware business, but it is not pure software either because the production workflow still carries meaningful labor and quality-control components. Meanwhile operating expenses remain large. R&D was about 37% of 2025 revenue and SG&A about 76%, so even strong gross margin does not yet translate into profitability. The first quarter kept that pattern alive, with operating expenses at 136% of revenue and a reported operating loss inflated by the headquarters-move impairment. The margin path therefore looks directionally positive, especially if Plaque adds incremental revenue on the same scan, but Heartflow still needs labor automation and better sales efficiency to turn high gross margins into durable earnings power.[CI005, CI006, CI007, CI008, CI009, CI035]

4.4 Liquidity, obligations, and capital adequacy

Heartflow’s near-term capital picture looks much stronger than its GAAP losses alone would imply because 2025 recapitalized the balance sheet. The company finished 2025 with $280.2 million of cash, cash equivalents, and investments and still reported $254.9 million at March 31, 2026. That liquidity was built by a balance-sheet reset: roughly $332.4 million of net IPO proceeds, $72.8 million of net proceeds from the 2025 convertible notes, and then automatic note conversion plus a $115.1 million term-loan repayment. Public market data now values the company near $2.3 billion, which makes fresh equity available in principle if growth remains credible. The important nuance is that Heartflow is not capital-light in every sense. Operating cash usage was still $54.0 million in 2025, lease commitments totaled $26.5 million, and the company took a 2026 impairment tied to vacating or resizing the Mountain View footprint before arranging a sublease. Even so, public data suggests a multi-year runway rather than an immediate financing dependency, especially because property-and-equipment spend was only $5.0 million in 2025 and royalty obligations are modest. The underwriting question is therefore not survival, but whether the current cash buffer is being converted into durable product mix and sales-efficiency improvements before investors lose patience.[CI001, CI010, CI040, CI041, CI047, CI048]

4.5 Financial verdict, revenue quality, and diligence blockers

The financial verdict is mixed but investable. Revenue quality is better than it first appears because Heartflow sells a recurring, per-analysis workflow without customer capex, and the company has enough coverage, support infrastructure, and installed-base scale to make real usage-driven revenue possible. Gross margin is already strong and looks capable of staying in the high-70s to low-80s if automation keeps reducing manual production effort. The problem is that the public story still depends on an FFRCT franchise that represented 98% of revenue at year-end 2025. Plaque may become a powerful second engine, but public evidence still shows reimbursement momentum and installed-base attach, not disclosed Plaque revenue, ASP, or margin. That leaves the biggest diligence blockers squarely in private data: realized pricing by product and site type, rebate waterfall, CAC and rep productivity, retention by account cohort, top-customer concentration, and product-level mix. Public capital looks adequate for now, but the stock’s roughly 9x to 10x forward revenue multiple already assumes the company can turn broad reimbursement and support-heavy deployment into a more diversified, more efficient platform business.[CI011, CI013, CI067, CI032, CI029, CI030]

4.6 Exhibits

5.1 Product definition in real clinical workflow terms

Heartflow is best understood as a post-processing operating layer on top of coronary computed tomography angiography rather than as a scanner, a PACS replacement, or a stand-alone cath-lab device. The workflow starts after a clinician orders and acquires a CCTA for a patient with suspected coronary artery disease. Heartflow’s official product pages and filing describe a secure transfer of previously acquired CCTA data into its cloud platform, where software turns that scan into a patient-specific 3D representation of the coronary tree and then returns clinically actionable outputs. In current marketing language, Heartflow One bundles four jobs: Identify disease with Roadmap, Decide with FFRCT, Manage with Plaque Analysis, and Build the program with support services. In practice, this means imaging readers receive an anatomic triage layer automatically, then order more detailed physiology and plaque modules as needed, with results delivered back through web, PDF, PACS, and EMR surfaces. The key product point is therefore workflow compression: one CCTA in, a staged set of anatomy, physiology, plaque, and treatment-planning outputs out, without asking the patient to undergo another non-invasive or invasive diagnostic test first.[CE001, CE002, CE003, CE004, CE005, CE006]

5.2 Module map, SKU logic, and current maturity

The module map is clearer in 2026 than it was when Heartflow was mainly an FFRCT company. Roadmap is the default interpretation layer and is explicitly described as bundled with every CCTA sent to Heartflow rather than as a separately sold product. FFRCT remains the flagship and still dominates public economics, because it provides lesion-specific physiology and uses the familiar invasive FFR threshold of 0.80 or below to identify clinically significant disease. Plaque Analysis is the second major commercial module, moving Heartflow from ischemia guidance into risk stratification and preventive management by quantifying plaque volume and composition. PCI Navigator is the next adjacency: filings and 2026 coverage frame it as a pre-PCI and intra-procedure planning tool that combines anatomy, physiology, and plaque localization in one interface, but public evidence still looks launch-stage rather than fully mature. Plaque Tracker is even earlier and remains a 2027 roadmap item for longitudinal regression tracking. That leaves Heartflow with one clearly scaled core product, one increasingly validated and reimbursed add-on, one bundled workflow enhancer, and two downstream/longitudinal roadmap extensions that deepen the same CCTA-centered platform rather than opening a new modality.[CE006, CE007, CE008, CE009, CE010, CE011]

5.3 Architecture, operating model, and data asset

Public evidence supports a fairly specific operating architecture. Heartflow says the platform ingests previously acquired CCTA DICOM data, applies deep learning and other machine-learning models to segment anatomy, then runs computational fluid dynamics and related calculations to derive FFRCT, blood-flow, stenosis, and plaque outputs from a 3D computer model. The filing is explicit that this is not a pure lights-out software product: the production process includes a human-in-the-loop quality-control step where analysts review and correct extracted anatomy before final delivery, and those corrections become labeled data for later model generations. That design matters economically and strategically. It raises the implementation and labor footprint versus a fully self-serve SaaS product, but it also creates a feedback loop between deployed cases, annotations, and algorithm refinement. Heartflow says this loop has produced more than 160 million annotated CCTA images and more than a decade of refinement, which is the closest thing the company has to a product-data moat. The strength is specificity: AI plus physics plus operational review. The risk is hidden dependence on production throughput, quality staffing, and internal tooling that remain mostly opaque in public materials.[CE001, CE002, CE003, CE004, CE005, CE027]

5.4 Deployment, integration, reliability proxies, and support

Heartflow’s deployment model is unusually service-heavy for a company often described as AI software. The support page is not an afterthought; it effectively describes the implementation playbook. Heartflow offers protocol and workflow recommendations for CCTA image quality, hands-on deployment of Heartflow One, PACS and EMR integration help, coding and reimbursement support, rate negotiation and claims-audit help, peer-to-peer education, and case-level clinical plus technical support. That package lowers adoption friction for hospitals and imaging centers, and it likely explains how the company could claim more than 1,465 U.S. accounts in late 2025 and more than 1,800 institutions on current marketing pages. The trade-off is that public reliability evidence is mostly indirect. Heartflow markets a 90-minute median turnaround and patient pages emphasize that no extra scan, appointment, or radiation is required beyond the original CCTA, but the reviewed source set does not include a public status page, uptime history, incident disclosure archive, or hard external SLA language. The practitioner/developer signal is also thin. Public sources show integration claims and support contacts, but not open API docs or a public sandbox, so integration depth still appears account-managed rather than community-led.[CE012, CE016, CE023, CE024, CE025, CE026]

5.5 Differentiation, trust controls, and roadmap risk

Heartflow’s differentiation is credible, but it is not unchallenged. The strongest product edge visible in public evidence is the combination of regulatory breadth, clinical evidence, installed-base scale, and data/annotation depth around one CCTA-centered workflow. The company can credibly say it spans anatomy, physiology, plaque, and support services, while filings show a large patent estate across FFRCT, Plaque, and Roadmap methods. It also discloses concrete trust controls: encryption in transit and at rest, MFA and SSO, granular authorization, de-identification of PHI for processing, and certifications including HITRUST, ISO 27001, ISO 13485, SOC 2 Type 2, and UK CyberEssentials. FDA history is also meaningful, from the 2014 de novo for FFRCT to the 2025 K250902 clearance covering the broader Heartflow Analysis feature set. Still, the chapter is not a clean win. Cleerly and other cardiac-CT vendors now contest the plaque and interpretation narrative, Heartflow is actively defending its IP in litigation, and the company still does not publish enough public detail on uptime, developer-facing integration, or the scaled live usage of PCI Navigator to eliminate execution risk. The roadmap looks coherent, but public maturity still falls by module.[CE017, CE018, CE019, CE020, CE021, CE022]

5.6 Exhibits

6.1 Buyer, user, payer, and geographic segmentation

Heartflow is not sold into a generic enterprise IT budget; it is sold into cardiac-imaging programs that already run coronary CTA and can therefore order analysis on top of an existing scan. The practical buyer is usually a hospital, health-system, outpatient imaging center, or cardiology service line that has to justify workflow change, reimbursement mechanics, and clinical champion support. The users are more fragmented: imaging cardiologists or radiologists need a faster first read, ordering or preventive cardiologists need physiology and plaque outputs to guide medical management, and interventional cardiologists increasingly use the same data for PCI planning. Payers matter because Heartflow’s public reimbursement pages now frame Plaque and FFRCT as covered by Medicare and multiple national insurers, making coverage breadth part of the product story rather than a background assumption. Geography is also broader than a U.S.-only marketing footprint: Heartflow’s own pages say the platform is commercially available in the United States and selected international markets, while NHS England provides the clearest external proof that non-U.S. deployment is more than a nominal clearance story.[CU001, CU002, CU003, CU004, CU005, CU028]

6.2 Adoption trajectory, usage intensity, and installed-base headroom

Public adoption evidence is unusually concrete for a medtech workflow company. Heartflow’s filing and 2026 investor updates give three useful anchor metrics: a 1,465-account U.S. installed base at year-end 2025, a 489-account U.S. Plaque installed base, and more than 1,800 institutions globally by spring 2026. Patient counts stepped from more than 500,000 in January 2026 to more than 600,000 in March and over 650,000 by May, which is directionally consistent with continued usage growth after the IPO. Just as important, the filing says 195,000 U.S. patients ran through the platform in 2025 and that this represented about 19% of current U.S. CCTA volumes. That means the current installed base is still far from saturated. Both the 2025 and first-quarter 2026 results attribute growth primarily to higher U.S. FFRCT volume, which is the strongest public clue that once an account is installed, recurring case flow—not one-time software revenue—is what moves the income statement.[CU006, CU007, CU008, CU009, CU010, CU011]

6.3 Named customer proof: what is clearly live versus merely referenced

Heartflow’s named-customer proof is real but uneven. Banner Imaging is the cleanest U.S. proof point because the customer itself said Heartflow was offered at seven imaging locations in 2024, and AuntMinnie later reported a deeper 2026 Banner partnership that brings the workflow into hospital CT assessment and PCI planning. NHS England is the cleanest public-system reference because it gives deployment count, patient count, savings, and longitudinal rollout timing from a customer-side source rather than from Heartflow’s own marketing. By contrast, several other references are supportive but softer: Heartflow’s platform page includes a named Sutter Health cardiologist quote, the support page includes a WellStar executive quote, and the GAMEFILM page lists Image One and other participating sites. Those references show real clinician or site engagement, but they do not disclose order volume, contract status, or whether the deployment is system-wide versus champion-led. The patient-stories page is even weaker for enterprise underwriting: it is useful evidence that physicians and patients saw value, but it does not prove durable customer economics.[CU016, CU017, CU018, CU019, CU020, CU021]

6.4 Durability, repeat usage, and what public evidence cannot prove

The strongest durability signal is structural rather than statistical. Heartflow says revenue is generated each time a physician chooses to review FFRCT, Plaque, or both, so a live account can keep generating revenue as long as clinicians keep ordering cases. The company also says RoadMap is bundled to improve customer loyalty and that support services include coding help, rate negotiation, PACS and EMR integration, peer education, and case-level support. Those are classic land-and-expand tools: reduce initial friction, win clinician trust, then raise recurring case volume and add Plaque on top of the same scan. Public evidence also suggests real repeat use because 2025 and Q1 2026 growth were both tied to U.S. FFRCT volume. But there is an equally important absence: the reviewed public set does not disclose NRR, GRR, logo retention, contract length, renewal cohorts, or representative satisfaction samples. That means the chapter can support a plausible recurring-usage thesis, not a proven retention thesis.[CU014, CU015, CU030, CU031, CU032, CU033]

6.5 Expansion levers, concentration, and procurement friction

Heartflow’s public expansion thesis is coherent: Plaque rides on the same CCTA scan as FFRCT, major payer coverage is widening, and independent trade press repeatedly argues that reimbursement and guideline support should accelerate cardiac-CT AI usage. Arizona and Florida landing pages show how Heartflow turns coverage into sales collateral at the local level, and Fierce plus CIToday show that payer wins and CMS rule changes are part of the company’s sales motion. Still, concentration and procurement risk remain meaningful. The filing says no single customer exceeds 10% of revenue, but it also says a relatively small number of customer decision-makers can control multiple accounts, which is a more subtle concentration risk than simple revenue share. The same filing warns that customers can reduce order volumes, negotiate utilization rebates, or react to reimbursement cuts, and it highlights the possibility of a proposed Medicare payment reduction. Finally, STAT’s skeptical piece shows that value questions persist even as coverage broadens, especially for plaque analysis before it becomes routine at scale.[CU003, CU028, CU029, CU035, CU036, CU037]

6.6 Exhibits

7.1 Regulatory and Legal Risks

Heartflow's highest-severity risk is not the absence of regulatory approval, but the obligation to keep a rapidly evolving software platform inside its approved and reimbursable perimeter. FDA cleared Heartflow Analysis under K250902 in July 2025 as a Class II device and explicitly tied post-market operation to Quality System requirements, labeling rules, and medical device reporting. Heartflow's own 10-K goes further: if FDA disagrees with the company's internal view that a change falls inside existing clearance or PCCP boundaries, the agency can require a new filing, stop marketing of a modified product, or force a recall. The same filing discloses prior MAUDE reports involving false negatives and imprecise results, even though none had resulted in a recall as of the 2025 filing. Commercial risk is tightly coupled to regulation. FFRCT reimbursement is mature, but plaque reimbursement only became meaningfully national in late 2025 and 2026, with five of seven MACs covering it and two still case-by-case. That creates a live risk that coding, medical-necessity criteria, or payer economics tighten before utilization is proven. Heartflow's April 2026 patent suit against Cleerly shows the company is defending its moat, but litigation also creates cost, management distraction, and countersuit exposure. The legal and regulatory bench is stronger than a typical growth-stage medtech, yet residual exposure remains high because quality, reimbursement, and IP are all thesis-critical.[CR001, CR002, CR003, CR004, CR005, CR016]

7.2 Operational, Quality, and Security Risks

Operationally, Heartflow is a software-heavy medtech business whose value depends on delivering correct, fast, and workflow-compatible outputs inside hospital care pathways. The 10-K states that past software code and release-process defects caused intermittent interruptions to physician use, and it also discloses historic MAUDE reports involving false negatives and imprecise readings. That matters because physician, patient, and payer confidence is a core adoption variable. The company has meaningful mitigations: encryption at rest and in transit, de-identification of sensitive data, annual cyber risk assessment, quarterly Audit Committee oversight, and certifications including HITRUST, ISO 27001, ISO 13485, and SOC 2 Type 2. But the same filing says Heartflow depends on outsourced AWS cloud infrastructure, third-party service providers, and production-related computing concentrated in California and Texas. A cloud outage, cyber event, or local disaster can delay report delivery and damage trust. Workflow dependence is equally real. Heartflow must ingest customer CCTA studies, integrate with PACS and EMR environments, and help sites improve image quality and reading efficiency; if that enablement slips, utilization can stall even when reimbursement exists. External inputs also matter: Heartflow itself cites the 2022 iodinated contrast shortage as evidence that supply disruption can reduce CCTA volumes. Q1 2026 results add a further execution signal because gross-margin gains were partially offset by hiring and training production personnel while the company also absorbed a facilities impairment during headquarters relocation.[CR003, CR005, CR006, CR007, CR008, CR009]

7.3 Partner and Dependency Risks

Heartflow's commercial model is deeply dependent on counterparties it does not control. Payers are the most obvious: FFRCT is broadly covered, but plaque still requires newly won national-commercial and MAC support to translate into routine use. The company therefore carries both policy risk and operational reimbursement risk, which is why Heartflow maintains a large coding, appeal, and market-access support function. Hospitals are the second major dependency. Heartflow says more than 1,800 institutions use the platform, which diversifies installed base, but the 10-K still warns that decision-making is concentrated enough that one customer loss can create disproportionate damage. Adoption also depends on PACS/EMR integration, CT program redesign, and clinical championing at the site level. The scanner and imaging ecosystem is a third dependency: Heartflow benefits from CCTA growth, but Canon, Siemens, GE, Philips, and other vendors increasingly market their own cardiac CT and post-processing capabilities, while plaque-analysis competitors such as Cleerly and newer entrants are using reimbursement momentum to close commercial gaps. Public-system and flagship-account wins such as NHS England rollout and Banner Health expansion help de-risk market acceptance, yet they also create concentration in reference accounts and raise the cost of any service failure. Residual exposure is therefore high even though the installed base is large, because payer, customer, and workflow dependencies all transmit directly into utilization and revenue.[CR017, CR018, CR019, CR020, CR022, CR023]

7.4 People and Execution Risks

Execution risk at Heartflow is less about a missing management bench than about coordination load across specialized functions. The company reported 843 full-time employees at year-end 2025 and says success depends on attracting and retaining highly skilled technology personnel. At the same time, growth now requires synchronized performance from AI engineering, quality/regulatory, information security, market access, revenue operations, production support, and customer success. Q1 2026 results show that Heartflow is still adding sales personnel and training production teams while also increasing technology and clinical-research spend, which means scale is still being bought, not yet fully harvested. That increases risk of onboarding lag, inconsistent field execution, or service bottlenecks during a period when plaque analysis, PCI planning, and broader workflow products are still being commercialized. The mitigation is real: Heartflow now discloses a deeper C-suite than many medtech peers, including dedicated leaders for legal and compliance, medical, technology, product, finance, operations, customer success, revenue, regulatory and quality, and reimbursement. That reduces classic single-founder fragility. Even so, the public narrative still centers heavily on CEO John Farquhar in earnings and product launches, so a leadership disruption or failure to coordinate this broad functional build-out would still hit growth, payer execution, and confidence simultaneously.[CR014, CR015, CR022, CR032, CR033, CR034]

7.5 Financial and Model Risks

Heartflow is growing quickly, but the financial model still carries meaningful concentration and proof-of-profitability risk. Q1 2026 revenue rose 41% year over year to $52.6 million, and the company raised full-year guidance to $228-$232 million, yet it still posted a $29.5 million operating loss and held $254.9 million of cash and investments rather than positive free cash flow. The near-term model remains anchored on U.S. FFRCT volume, which the company itself identifies as a single-product dependence risk, while plaque commercialization is explicitly described in the 10-K as nascent. That means investors are effectively underwriting continued flagship volume growth plus successful reimbursement conversion on a newer product set. The cost side is also live: sales hiring, production training, technology investment, clinical evidence generation, litigation, and security/quality overhead all consume operating leverage. Market risk compounds that pressure. STAT's reimbursement critique shows payer or physician backlash is plausible if AI pricing appears ahead of proven value, while Cardiovascular Business and Cardiac Wire both show that reimbursement is attracting more well-funded entrants into plaque analysis. Mitigation exists in the form of strong gross margins, a large installed base, and public-system/customer proof, but residual exposure remains medium-high because profitability depends on utilization density, reimbursement durability, and competition staying rational at the same time.[CR011, CR012, CR013, CR014, CR015, CR016]

8.1 Public-market starting point and capital-structure context

By May 20, 2026, Heartflow is no longer a private narrative asset; it is a public medtech-software company whose price already embeds durable growth and improving economics. CompaniesMarketCap showed the stock near $27.08 and market capitalization near $2.33 billion. Subtracting the $254.9 million of cash, cash equivalents, and investments reported at March 31, 2026 produces enterprise value of roughly $2.08 billion, or about 9.0x the midpoint of management's $228 million to $232 million 2026 revenue guide. That multiple is not absurd for 41% year-over-year Q1 growth and 80.2% gross margin, but it is also not distressed given continuing operating losses and thin product-mix disclosure. The capital-structure question is far cleaner than it was pre-IPO: the August 2025 offering priced 16.67 million shares at $19, convertible notes converted into common stock at the IPO, and the company still held enough cash to avoid a near-term financing scramble. The market is therefore no longer underwriting survival. It is underwriting whether plaque and broader workflow products can justify paying in advance for a second growth engine.[CV001, CV002, CV003, CV004, CV005, CV010]

8.2 Why Heartflow deserves a premium — and why that premium should stay capped

Heartflow deserves some premium to generic medtech because it has a real installed-base, reimbursement, and workflow machine rather than a speculative AI demo. FY2025 ended with 1,465 U.S. accounts and 489 plaque accounts, while Q1 2026 commentary framed more than 1,800 institutions and nearly 650,000 patients worldwide. The product stack now includes FDA-cleared plaque analysis and commercial decision-support materials like DECIDE, which support the idea that Heartflow can deepen use on the same CCTA study. Those facts support a premium multiple. The anti-thesis is just as concrete. Public filings still say FFRCT represented 98% of 2025 revenue, so investors are mostly underwriting one proven engine plus an under-disclosed upsell story. Competitors are better funded and increasingly reimbursed: Cleerly won UnitedHealthcare and Cigna coverage and raised another $106 million, Elucid has $121 million of disclosed funding and a differentiated histology-based pitch, Keya markets CT-FFR under CPT 75580, and OEM or cath-lab channels such as Medis with GE and Canon can squeeze the workflow. STAT's pricing critique shows that even covered reimbursement can still face value backlash. Premium warranted, but not without a ceiling.[CV007, CV008, CV009, CV014, CV015, CV016]

8.3 Bull, base, and bear range logic

Scenario math is more informative here than a single-point target. The bear case assumes 2027 revenue only reaches $245 million to $255 million because plaque monetization disappoints, competitive coverage compresses pricing power, and the market assigns only 4.5x to 6.0x EV/revenue. That yields about $1.10 billion to $1.53 billion of enterprise value, clearly below the current $2.08 billion. The base case assumes $285 million to $300 million of 2027 revenue, continued durable FFRCT growth, visible but still partial plaque contribution, and a 7x to 9x multiple; that produces $1.99 billion to $2.70 billion of enterprise value, which mostly brackets today's value. The bull case requires much more: $340 million to $380 million of 2027 to 2028 revenue, explicit plaque revenue diversification, and continued category leadership despite growing competition. At 9x to 11x EV/revenue, enterprise value would reach about $3.06 billion to $4.18 billion. Upside exists, but not with the sort of asymmetry that justifies a buy before better evidence appears.[CV032, CV033, CV034, CV035, CV036, CV037]

8.4 Comparable framework: public references plus private milestone markers

Comparable work argues for discipline rather than enthusiasm. Heartflow's current roughly 9x forward EV/revenue sits above workflow or procedure medtech references like iCAD and PROCEPT, both around 5x market-cap-to-revenue, and roughly alongside imaging-AI references like Nano-X and Butterfly. These are imperfect comps. None combines coronary CCTA software, reimbursement breadth, and Heartflow's installed-base scale in exactly the same way, so some premium is justified. But the private direct-peer set does not show a vacuum either. Cleerly's reimbursement wins and fresh funding, Elucid's capital base and histology differentiation, Keya's CT-FFR positioning, and Medis or Canon channel strength all suggest coronary AI has moved from category creation to competitive commercialization. The correct valuation read is that Heartflow is better proven than most direct peers, but the current multiple already sits near the upper end of adjacent imaging-AI references while the most important monetization variables remain private. That is why the comparable table should inform a valuation range, not be mistaken for a precise fair-value oracle.[CV018, CV019, CV020, CV021, CV022, CV023]

8.5 Recommendation, entry discipline, thesis-break triggers, and diligence asks

The investment-committee conclusion is track, not avoid and not buy. The company is exit-ready in the public-market sense because it already trades, has cleaned up pre-IPO financing overhang, and still carries enough liquidity to fund execution. But thesis completeness remains lower than company quality. The committee should want one of two things before upgrading: either a materially better entry, closer to 7x 2026 midpoint EV/revenue and roughly $21.78 per share, or materially better evidence that plaque is a revenue engine with defensible unit economics. The thesis breaks if revenue growth slips below 20% despite stable coverage, if payer or MAC policies tighten around plaque pricing, or if quality, regulatory, or litigation events interrupt physician trust. Final diligence should focus on product-level plaque revenue, gross-to-net realization, denial rates, mature-account utilization, retention, and customer concentration. Until those items are visible, current pricing offers only moderate upside against a real downside path, which is exactly the setup for a monitored watchlist position rather than a decisive entry.[CV038, CV039, CV040, CV041, CV042, CV043]