Heartflow, Inc.

Investing in our common stock involves a high degree of risk. You should carefully consider the risks

described below, as well as the other information in this Quarterly Report on Form 10-Q, including our

condensed consolidated financial statements and the related notes and “Management’s Discussion and

Analysis of Financial Condition and Results of Operations.” The risks described below are not the only

ones facing us. Additional risks and uncertainties not presently known to us or that we currently believe

are not material may also impair our business, financial condition, results of operations and prospects.

Please also see the sections titled “Special Note Regarding Forward-looking Statements.”

Risk Factors Summary

The following risks and uncertainties included in this subsection are among the most significant we face

and are qualified in their entirety by reference to all of the risk factors as further described in this Item 1A.

•We have incurred significant net losses since our inception, we expect to incur additional substantial

losses in the foreseeable future and we may not be able to achieve or sustain profitability.

•Our revenue is currently generated almost entirely from the sales of only one product, Heartflow

FFRCT Analysis, and we are therefore highly dependent on the success of this product, which makes

it difficult to evaluate our current business, predict our future prospects and forecast our financial

performance and any growth.

•If healthcare providers are unwilling to change their standard practice regarding the evaluation of

CAD, our business, financial condition, results of operations and prospects will be adversely affected.

•If third-party payors, including government payors, do not cover and provide adequate reimbursement

for the Heartflow Platform, or if existing payment amounts are reduced or coding policies change,

adoption of the Heartflow Platform by healthcare providers may be negatively impacted, and our

business, financial condition, results of operations and prospects will be adversely affected.

•We face risks associated with a concentrated customer base.

•We face significant competition in an environment of rapid technological change, and there is a

possibility that our competitors may develop products that are more effective, accurate, reliable, cost-

effective or more advanced than ours, which may harm our financial condition. If we are unable to

compete successfully or our potential market share is reduced, we may be unable to increase or

sustain our revenue or achieve profitability.

•The commercialization of Heartflow Plaque Analysis is nascent, and we may not be able to achieve or

maintain sufficient market acceptance or the levels of utilization we expect from Heartflow Plaque

Analysis or any other future product.

•We face risks associated with our use and development of AI models, which may result in operational

challenges, legal liability, reputational concerns and competitive risks.

•If we fail to properly manage our future growth, our business could suffer.

•Our business could be disrupted by catastrophic events.

•We depend on our information technology systems, and any failure of these systems could harm our

business and adversely affect our business and operating results.

•Our networks and those of our third-party service providers may become the target of bad actors or

security breaches that we cannot anticipate or successfully defend, which could have an adverse

•We face extensive regulatory requirements to bring our products to market, and our failure to receive

and maintain regulatory clearances or approvals of our current and future products in the United

States or abroad or to comply with medical device regulatory requirements could adversely affect our

•If we are unable to obtain and maintain sufficient intellectual property rights, or the scope of our rights

is not sufficiently broad, third parties could develop and commercialize technology and products

similar or identical to ours, and our ability to successfully commercialize our technology and products

may be adversely affected.

Risks Related to our Business and Industry

We have incurred significant net losses since our inception, we expect to incur additional

substantial losses in the foreseeable future and we may not be able to achieve or sustain

profitability.

We have incurred significant net losses since our inception in 2007, and we expect to incur additional

substantial losses in the foreseeable future. For the three and nine months ended September 30, 2025,

we incurred net losses of $50.9 million and $92.4 million, respectively. As of September 30, 2025, we had

an accumulated deficit of approximately $1.1 billion. Since inception, we have spent significant amounts

of cash to develop the Heartflow Platform, to fund research and development, including our preclinical

research and development activities and clinical trials related to our products, to scale our commercial

operations and to recruit and retain key talent.

The net losses we incur may fluctuate significantly from quarter to quarter and year to year, such that a

period-to-period comparison of our results of operations may not be a good indication of our future

performance. We expect to continue to incur significant research and development, sales and marketing,

regulatory and other expenses as we expand our marketing efforts to increase adoption of our products,

expand existing relationships with our customers, obtain regulatory clearances or approvals for our

planned or future products, conduct clinical trials to extend applicability of our platform into new

indications or to develop new products or add new features to our existing products. The investments in

our business may be more costly than we expect, and if we do not achieve the benefits anticipated from

these investments, or if the realization of these benefits is delayed, they may not result in increased

revenue or growth in our business. In addition to the anticipated costs of growing our business, we expect

our general and administrative expenses to increase due to the additional costs of being a public

company. If our revenue growth does not increase to more than offset the anticipated increases in our

operating expenses, we may not be able to achieve or sustain profitability and our business, financial

condition, results of operations and prospects will be harmed.

In addition, our revenue may decline or our revenue growth, if any, may be constrained. Our ability to

increase sales is uncertain, and we may never be able to achieve or sustain profitability for many

reasons, including that: our Heartflow FFRCT Analysis may not achieve widespread adoption among

healthcare providers and we may be unable to increase revenue generated from sales of our Heartflow

FFRCT Analysis; our Heartflow Plaque Analysis may not achieve widespread adoption among healthcare

providers and we may be unable to generate sufficient revenue from sales of our Heartflow Plaque

Analysis; payors, such as insurance companies and government insurance programs, may decide not to

reimburse for our products, may set the amount of such reimbursement too low or may reduce the

amount of such reimbursement; healthcare industry trends, including growth in CCTA usage, may move in

directions that do not allow for adoption of our products or that do not provide adequate incentives for the

adoption of our products; competitors may develop or acquire a product that successfully competes with

ours; manufacturers of CT scanners may partner with our competitors or develop or acquire a competing

product and integrate one or more products that successfully competes with ours; we may not be able to

obtain regulatory approval for future versions of our products (including improved versions of our AI

algorithms), new indications for use of our products or other future products; and there may be changes in

existing or anticipated clinical guidelines, including the current American College of Cardiology (“ACC”)

and American Heart Association (“AHA”) Class 1, Level A guidelines for CCTA and Class 2a, Level B

guidelines for Heartflow FFRCT Analysis for certain patients with stable or acute chest pain and no known

CAD, or the timing of adoption of positive clinical guidelines that support the use of the Heartflow FFRCT

Analysis.

Because of these and the other risks and uncertainties described in this Quarterly Report on Form 10-Q,

we are unable to predict the extent to which we will be able to increase sales, if at all, or the timing for

when or the extent to which we will become profitable, if ever. We will need to generate significant

additional revenue to achieve and sustain profitability, and even if we do achieve profitability, we may not

be able to sustain or increase profitability. Our failure to become and remain profitable would depress the

value of our company and our stock price and could impair our ability to raise capital, fund our research

and development efforts, expand our business, diversify our product offerings or continue our operations.

A decline in the value of our company could cause you to lose all or part of your investment.

Our revenue is currently generated almost entirely from the sales of only one product, Heartflow

FFRCT Analysis, and we are therefore highly dependent on the success of this product, which

makes it difficult to evaluate our current business, predict our future prospects and forecast our

financial performance and any growth.

Asof September 30, 2025, our Heartflow FFRCT Analysis represented 98%of our total revenue. In the

second half of 2023, we began limited market education efforts of our second product, Heartflow Plaque

Analysis. Over the next several years, we expect to continue to devote a substantial amount of resources

to increase sales of our Heartflow FFRCT Analysis and also expand our commercialization efforts and

drive increased adoption of our Heartflow Plaque Analysis. However, we may not succeed in increasing

sales of our Heartflow FFRCT Analysis or in increasing adoption of our Heartflow Plaque Analysis. We

expect to continue to derive almost all of our revenue from sales of Heartflow FFRCT Analysis for the

foreseeable future, so we are highly dependent on its success.

In addition, because we plan to devote substantial resources to increase sales of Heartflow FFRCT

Analysis and rely on it as our main source of revenue, any factors that negatively impact these efforts, our

Heartflow Plaque Analysis commercialization efforts or our ability to diversify our products would have a

Therefore, it is difficult to predict our future prospects and forecast our financial performance and any

growth, and any such forecasts are inherently limited and subject to a number of uncertainties. If our

assumptions regarding the risks and uncertainties we face, which we use to plan our business, are

incorrect or change due to circumstances in our business or our markets, or if we do not address these

risks successfully, our operating and financial results could differ materially from our expectations and our

business, financial condition, results of operations and prospects could suffer.

If healthcare providers are unwilling to change their standard practice regarding the evaluation of

CAD, our business, financial condition, results of operations and prospects will be adversely

affected.

Our success depends on physicians, hospitals and other healthcare providers adopting and using the

Heartflow Platform to aid in the evaluation of CAD. While we have had some recent success in achieving

broader adoption of the Heartflow Platform, we have in the past faced, and may in the future face,

challenges in achieving higher rates of adoption. Many healthcare providers have extensive experience

with existing non-invasive tests for CAD and have established relationships with the companies that

provide these tests or in some instances own or manage the equipment for these tests in their offices.

Existing tests are performed in a high enough volume that healthcare providers generate sufficient

revenue from their use and are well versed in their use, reimbursement and outcomes. The outcomes and

workflow efficiencies that we believe our Heartflow Platform provides may not be valued by healthcare

providers as highly as we expect or at all. In addition, healthcare providers have been, and may continue

to be, slower to adopt or recommend our products because we have a more limited commercial track

record and healthcare providers may feel they can generate more revenue from existing tests. Healthcare

providers also may not find our clinical data compelling and may not recommend or use our products until

they receive additional recommendations from other healthcare providers that our products have a clinical

benefit, or at all.

In addition, the Heartflow Platform relies on healthcare providers following the ACC and AHA guidelines

by referring certain patients with stable or acute chest pain and no known CAD to undergo a CCTA, with

the CCTA images to be analyzed by our Heartflow FFRCT Analysis. Although the ACC and AHA guidelines

support CCTA plus our Heartflow FFRCT Analysis as the preferred pathway for diagnosing and managing

CAD in certain patients with stable or acute chest pain and no known CAD, these guidelines may not be

widely adopted by healthcare providers. Moreover, healthcare providers may choose not to adopt the

Heartflow Platform if they are not able to obtain an adequate CCTA. Further, if future studies and trials or

other events, including reimbursement rates of CCTA, adversely impact the rate of use of CCTAs in

practice, then healthcare providers may be less willing to adopt a technology that uses CCTAs.

Also, the Heartflow Platform may be more difficult than we expect to integrate into standard practice

because a provider may be resistant to introduce our embedded information technology and workflow

infrastructure. Due to different laws, policies and preferences of healthcare providers regarding patient

privacy both in the United States and abroad, they may be averse to sending data externally (outside of

their facility) or abroad. Furthermore, if healthcare providers using the Heartflow Platform experience what

they perceive to be false negative result or imprecise readings, including due to user error, they may

determine not to continue using our platform going forward.

We expect that addressing these and similar issues will require a significant amount of our time and

resources, and if we are unsuccessful, we would be unable to achieve broader adoption of the Heartflow

Platform by healthcare providers. If our products do not gain broader acceptance by healthcare providers,

our business, financial condition, results of operations and prospects will be adversely affected.

If third-party payors, including government payors, do not cover and provide adequate

reimbursement for the Heartflow Platform, or if existing payment amounts are reduced or coding

policies change, adoption of the Heartflow Platform by healthcare providers may be negatively

impacted, and our business, financial condition, results of operations and prospects will be

adversely affected.

Our ability to grow sales and revenue from our Heartflow FFRCT Analysis and to successfully

commercialize our Heartflow Plaque Analysis depend, in large part, on whether third-party payors,

including private health insurers, managed care plans and government healthcare programs, such as

Medicare and Medicaid, cover and adequately reimburse for the use of the Heartflow Platform and the

underlying CCTA. Patients generally rely on payors to reimburse all or a significant part of the costs

associated with their treatment. As a result, appropriate coding, coverage determinations, and

reimbursement levels are critical to the commercial success of the Heartflow Platform. Reimbursement is

obtained from a variety of sources, including government sponsored and private health insurance plans,

and varies by country and by region within some countries. These payors determine whether to provide

coverage and payment for specific products and procedures.

In addition, payors continually review new technologies and can, without notice, change coverage

parameters, deny coverage, bundle services, or reduce payment amounts. As a result, the coverage

determination process is often time consuming and costly, with no assurance that coverage and adequate

reimbursement will be obtained or maintained if obtained. If payors change their reimbursement policies,

or if the current Category I CPT codes related to our Heartflow FFRCT Analysis or future Category I CPT

codes related to our Heartflow Plaque Analysis are not favorably categorized or priced, reimbursement for

the Heartflow Platform could be reduced to an amount that would make adoption of our Heartflow

Platform challenging.

Moreover, physicians, hospitals and other healthcare providers may decline to adopt or reduce usage of

the Heartflow Platform due to the economic impact a negative change in reimbursement may have on

their business and, as a result, we may experience a significant loss of revenue, which would have a

Reimbursement for our Heartflow Platform, which includes the separately billable services, Heartflow

FFRCT Analysis and Heartflow Plaque Analysis, is subject to periodic changes to reimbursement levels by

government payors and private health insurers. For example, the Centers for Medicare and Medicaid

Services (“CMS”) adopts changes to reimbursement policies during the annual Medicare rulemaking

process, which includes updates to Medicare payment levels to hospitals under the Medicare Hospital

Outpatient Prospective Payment System (“OPPS”) rule, and updates to Medicare payment rates to

physician offices, independent diagnostic testing facilities, and freestanding imaging centers under the

Medicare Physician Fee Schedule (“MPFS”) rule. In addition to risks associated with government

reimbursement, our Heartflow FFRCT Analysis and Heartflow Plaque Analysis technologies face

reimbursement uncertainty from commercial payors, such as UnitedHealthcare, Aetna, Cigna, Anthem,

and regional Blue Cross Blue Shield plans. Such commercial payors routinely reassess their medical

policies, coverage criteria and payment policies and rates, and may choose to deny coverage or payment,

impose restrictive utilization management protocols (such as prior authorization), or reduce or bundle

payment amounts based on internal cost-effectiveness assessments or evolving clinical guidelines. Even

if Medicare maintains favorable reimbursement, commercial payors may independently determine

whether Heartflow FFRCT Analysis or Heartflow Plaque Analysis meets their plans’ medical necessity

standards, which may vary among commercial payors.

As part of their participation in the Medicare program and in support of the annual rulemaking process,

hospitals submit Medicare cost reports and report their charges for specific services provided in the

hospital setting. These cost and charge data reported from hospitals can impact reimbursement rates

because CMS uses that data to determine future Medicare reimbursement levels on an annual basis. In

the aggregate, when costs associated with a specific service reported by the hospitals decrease, there is

a risk that CMS will reduce the reimbursement rate proportionately. These lower reported costs can be a

result of coding errors or erroneous denials of claims, the inclusion of lower-cost services within the APC,

reductions in costs for services within the APC, or other similar issues. For example, in July 2025, CMS

issued the proposed 2026 OPPS rule, which, if finalized as proposed, could result in a reduction of up to

15% in the Medicare reimbursement rate for the clinical APC that includes our Heartflow FFRCT Analysis,

along with other hospital services. CMS publishes final OPPS and MPFS rules in the fourth quarter each

year. We cannot be sure at this time whether the proposed hospital reimbursement rate for Heartflow

FFRCT Analysis for 2026 will be finalized, modified, or if CMS will increase the rate back to 2025 levels.

There is a risk that similar or other coding or claims issues may occur and lead CMS to lower the

reimbursement rate for the Heartflow Platform for 2027 or in future years. In addition, we may not become

aware of any such issues early enough to prevent any adverse impacts to the reimbursement for our

products, and our ability to remedy any such issues may be limited by applicable laws, regulations or

policies.

Given the evolving nature of the healthcare industry and ongoing healthcare cost reforms, we are and will

continue to be subject to effects of changes in the level of reimbursement for our products. We cannot be

sure that third-party payors will maintain the current level of coverage and payment to our customers for

use of our existing products. A reduction in coverage or payment or change in policy by the Medicare

program could cause some commercial third-party payors to implement similar reductions in their

coverage or payment amounts for the Heartflow Platform. Unfavorable coverage or payment

determinations at the national or local level could adversely affect our business, financial condition,

We face risks associated with a concentrated customer base.

Our Heartflow Platform had an installed base of more than 1,100 accounts in the United States as of

December 31, 2024. We define an “account” as any individual facility that orders a Heartflow FFRCT

Analysis, Heartflow Plaque Analysis, or both. We define an account as “new” if a unique facility begins

generating revenue cases for our FFRCT Analysis, Plaque Analysis, or both. Accounts may have more

than one reading physician or CT machine. Conversely, a “customer” can be either an individual account

or a health or hospital system with multiple accounts. While a single customer may include multiple

accounts, no single customer accounted for 10% or more of our revenue during the three and nine

months ended September 30, 2025 and 2024. However, the decision-making function for some of these

accounts is concentrated in a relatively small number of customers, such that the loss of one customer

could result in a disproportionate loss across our accounts. For example, for the year ended December

31, 2024, our top two largest customers, both large health systems with multiple accounts, collectively

represented approximately 8% of our revenue.

We cannot guarantee that we will continue to generate revenue from these customers, whether due to an

increase in competition, new technologies, our customers’ ability to terminate their contracts with us or

reduce order volumes, or other factors outside of our control. If we do not increase the number of our

customers and drive increased use of the Heartflow Platform as the preferred non-invasive testing

method for assessing CAD, we will continue to face risks associated with a more concentrated customer

base.

Revenue from these customers may fluctuate from time to time due to demand for the Heartflow Platform,

the timing of which may be affected by seasonality or other factors outside of our control such as CT

scanner capacity, contrast availability and staffing availability. These customers could also potentially

pressure us to reduce the prices we charge for the Heartflow Platform, which could have a material

adverse effect on our margins and business. For example, during the year ended December 31, 2024,

our average sales price was impacted by customer pricing contracts that included utilization and volume

rebates and by changes in the mix of customer accounts, which is a trend we expect to continue in the

near term, and it is possible that similar trends in customer pricing contracts may continue to have a

negative impact on our average sales price in the future. In addition, if any of our largest customers

terminates its relationship with us or otherwise reduces its FFRCT Analysis volumes for any reason, we

may be unable to replace them with a customer who refers a similar number of patients for the Heartflow

Platform, and such termination or reduction in volume could have a material adverse effect on our

We face significant competition in an environment of rapid technological change, and there is a

possibility that our competitors may develop products that are more effective, accurate, reliable,

cost-effective or more advanced than ours, which may harm our financial condition. If we are

unable to compete successfully or our potential market share is reduced, we may be unable to

increase or sustain our revenue or achieve profitability.

The medical technology industry is highly competitive, subject to rapid change and significantly affected

by the introduction of new products and technologies and other activities of industry participants. Because

of the size of the market opportunity for the treatment of CAD, we believe current and potential future

competitors will dedicate significant resources to aggressively promote their products or develop new

products or treatments. Our principal competition comes from companies that provide traditional non-

invasive tests that aid physicians in the evaluation of CAD, such as SPECT, stress echocardiography and

PET. Established, traditional non-invasive tests for CAD have been used for many years and are therefore

difficult to change or supplement. Many of the companies that sell these traditional non-invasive tests or

the equipment they require have established relationships with healthcare providers. One of the major

hurdles to adoption of our products is overcoming established testing patterns, which requires education

of physicians and supportive clinical data.

The companies that sell the traditional non-invasive tests for CAD include companies that offer: (i) cardiac

specific tests to primary care and cardiology offices, such as manufacturers of capital equipment for

stress echocardiography and SPECT, including GE Healthcare, Siemens Healthineers AG and Koninklijke

Philips N.V.; and (ii) products used for the invasive FFR testing market.

With the greater resources of some of these competitors and their more diversified product offerings, it is

possible that they or other entrants into the market may develop competing products or technologies that

could be more effective, accurate, reliable, cost-effective, more advanced or otherwise improved relative

to the Heartflow Platform, which could render our products obsolete or less competitive. In addition, one

or more competitors could develop and market an on-premise solution, which may be more appealing

than our cloud-based offering. Moreover, new treatments, such as GLP-1s, may indirectly reduce stenosis

or plaque build-up, which could reduce the market opportunity for non-invasive CAD tests and, as a

result, our Heartflow Platform. In addition, we currently target our Heartflow Platform for use only on

symptomatic patients and expanding the Heartflow Platform for asymptomatic patients may take years,

with potential delays due to the high-risk nature of the effort. Our competitors who offer traditional non-

invasive tests offer those tests to both symptomatic and asymptomatic patients, and this increased market

penetration could create additional price pressure for our products.

In addition, the field of cardiovascular genomics is subject to rapidly changing technology, and others may

invent and commercialize technology platforms such as next generation sequencing approaches that

could compete with our products or could make our products or any product we may sell in the future

obsolete. We also face competition and price pressure from companies that have developed or are

developing AI-based platforms that leverage CCTA to diagnose CAD, including earlier-stage companies

such as Cleerly, Inc., Elucid Bioimaging Inc. and Keya Medical Technology Co., Ltd. We may also face

competition from companies developing AI-based platforms, even if they are not currently in the CAD

market and recent and future advances in AI may allow other companies to quickly create competing

products, and they may be able to create such products less expensively and benefit from FDA and

reimbursement approvals we and others have obtained. For us to remain competitive, we must

continuously work on our products’ design and features, improve our algorithms, and invest in and

develop new technologies, including in the rapidly evolving area of AI. If we are unable to introduce

products, features and improvements aimed at increasing the value proposition of the Heartflow Platform

for our customers, or if the products, features and improvements we introduce are viewed less favorably

than our competitors’ products, we may be unable to compete successfully. If we are unable to compete

successfully against our current or future competitors, we may be unable to increase market acceptance

for our products, which could prevent us from increasing or sustaining our revenue or achieving

profitability and could cause the market price of our common stock to decline.

In addition, the Heartflow Platform relies on a CCTA first being performed, as the Heartflow Platform

requires a CT image from a CT scanner to perform its analysis. A number of companies manufacture CT

scanners, including, among others, GE Healthcare, Hitachi, Ltd., Koninklijke Philips N.V., Samsung

Electronics Co., Ltd., Siemens Healthineers AG and Canon Medical Systems Corporation. These

companies are more diversified than we are and have substantial financial, manufacturing, sales and

marketing distribution and other resources. Any of these companies or others could determine to develop,

partner with or acquire and offer a product that competes with ours or manufacture CT scanners that are

no longer compatible with our Heartflow Platform. Further, these larger companies have market

penetration in the CT scanner market and understand the market for CAD and, if they are able to develop,

partner with or acquire a competing product, they may offer it as a bundle with the purchase of a CT

scanner, which could prevent us from increasing or sustaining our revenue or achieving profitability. In the

past, three of these companies, Siemens Healthineers AG, Koninklijke Philips N.V. and Canon Medical

Systems Corporation, considered development of a local workstation-based technology prototype aimed

at deriving CT-based blood flow data without an invasive procedure. If these companies decide to further

pursue this technology and obtain regulatory approval or clinical validation, it may become competitive

with our products. In addition, we are reliant on these third-party CCTAs and CT scanners continuing to

support standard output file formats that our Heartflow Platform supports. If a CT manufacturer were to

change to a proprietary format or develop a novel method of performing CT scans, we would need to

further develop our existing technology to accommodate the images its scanners output, which could

materially affect the ability of physicians to use the Heartflow Platform, increase our R&D expenses, and

could adversely affect our business, financial condition, results of operations and prospects.

The size and expected growth of our addressable market may be smaller than we estimate.

Our estimate of the addressable market for our current products and any future products is subject to

significant uncertainty and is based on assumptions and estimates, including our internal analysis and

industry experience. While we believe our assumptions and the data underlying our estimates are

reasonable, these assumptions and estimates may not be correct. As a result, our estimates of the

addressable market for our current or future products may prove to be incorrect. Moreover, our ability to

serve a significant portion of this estimated market is subject to many factors, including our success in

promoting the use of CCTA as a non-invasive diagnostic test that can be combined with the Heartflow

Platform, which is subject to many risks and uncertainties, and relies on the availability and proximity of

healthcare facilities with active CCTA programs to the patients in our estimated market. Accordingly, if we

are unable to increase the use of CCTA at the rates we estimate, if the actual number of patients who

would benefit from our products is less than we estimate, or if the price at which we can sell future

products or the reimbursement rate received by healthcare providers is less than we estimate, the size

and expected growth of our addressable market would be smaller than our estimates, which could have a

We may not be successful in updating or otherwise enhancing the Heartflow Platform.

A part of our strategy is bringing new enhancements to our customers through updates to the Heartflow

Platform, which may include offering new products, additional features, applications and improvements to

our technology. We expect to make significant investments to advance these efforts, and enhancing the

Heartflow Platform is a complex and time-consuming endeavor. New products, additional features,

applications and improvements to our technology that initially show promise may fail to achieve the

desired results or may not achieve acceptable levels of analytical accuracy, utility or user friendliness.

Product development and improvement is expensive, may take months or years to complete and can

have uncertain outcomes. Failure can occur at any stage of the development or improvement process

and may occur only after substantial work has been completed, or after completion.

Even if, after development, an updated product appears successful, we may, depending on the nature of

the update, need to obtain regulatory clearances, authorizations or approvals before we can market the

updated product. Such regulatory clearances, authorizations or approvals are likely to require significant

time and expenditures and the applicable regulatory authority may not clear, authorize or approve any

product, update or new product we develop. Obtaining such clearances, authorizations or approvals may

require data from clinical trials, which can be costly and time-consuming to obtain. In certain jurisdictions

or in certain cases, clinical data may also be required in order to obtain reimbursement coverage, and this

clinical data may be in addition to data required to obtain regulatory clearances, authorizations or

approvals. Some clinical studies may fail to meet their endpoints, introducing risk or delay in the ability to

commercialize a new feature or product. In light of these requirements, we may choose to limit the scope

of any new products, additional features, applications and improvements we seek to develop.

Even if we develop a product update or new product that receives regulatory clearance, authorization or

approval, and for which we obtain sufficient commercial third party and government reimbursement

coverage, we would need to commit substantial resources to commercialize and market the updated

product, new product or new application of our existing product, which may never achieve market

acceptance among various stakeholders or be commercially successful. Further, the applicable

regulations or the application of those regulations could change in ways that would impact the Heartflow

Platform and our ability to successfully manufacture or market our products. The expenses or losses

associated with unsuccessful updates to or expansion of the Heartflow Platform could adversely affect our

The commercialization of Heartflow Plaque Analysis is nascent, and we may not be able to

achieve or maintain sufficient market acceptance or the levels of utilization we expect from

Heartflow Plaque Analysis or any other future product.

We began limited market education efforts for our Heartflow Plaque Analysis in the second half of 2023,

and we have generated very minimal revenue from this product. HeartFlow Plaque Analysis is covered by

all seven local Medicare Administrative Contractors (MACs) regions and select commercial payors.

However, the coverage criteria, timing, commercial payor reimbursement rates and availability of

coverage are still evolving and may vary by payor and jurisdiction, and other payors may not adopt similar

coverage policies. As a result, even with these developments, we may not be able to achieve customer

acceptance or broad commercial reimbursement coverage, which could limit its adoption.

The market for alternative plaque analysis products is competitive in terms of development, availability,

pricing, product quality and time-to-market. We face competition from companies that provide or are

developing similar plaque analysis products, which may distinguish themselves from us through, among

other things, perceived product quality, style and visuals, sleek design, enhanced user-friendliness and

innovative features. In addition, some of these competitors are agile, early-stage companies that may be

able to respond more quickly and effectively than we can to new or changing opportunities, technologies,

standards or customer requirements in the plaque analysis category. Some of these competitors

commercially launched competing plaque analysis products prior to our launch of Heartflow Plaque

Analysis and may have a first-mover advantage as a result. For more information on risks related to our

competition, see the risk factor titled “We face significant competition in an environment of rapid

technological change, and there is a possibility that our competitors may develop products that are more

effective, accurate, reliable, cost-effective or more advanced than ours, which may harm our financial

condition. If we are unable to compete successfully or our potential market share is reduced, we may be

unable to increase or sustain our revenue or achieve profitability.”

Our competitors may also be able to offer plaque analysis products similar or superior to ours at a more

attractive price than we can or may be better positioned to serve certain segments of our market, which

could create additional price pressure. For example, our competitors have in the past, and may in the

future, offer plaque analysis and other products at a more attractive price than we can such that current or

potential customers may select our competitors’ products in lieu of purchasing and using our Heartflow

Plaque Analysis. Moreover, our competitors have in the past, and may in the future, suggest that their

plaque analysis and other products could replace both our Heartflow Plaque Analysis and our Heartflow

FFRCT Analysis, which would adversely affect our ability to achieve sufficient market acceptance for our

Heartflow Plaque Analysis, could affect sales of our Heartflow FFRCT Analysis and could cause our

Heartflow FFRCT Analysis to lose market share. While we believe Heartflow Plaque Analysis represents a

significant long-term opportunity for us, there can be no assurances that we will successfully compete in

such market and our business, financial condition, results of operations and prospects could be materially

and adversely affected.

We face risks associated with our use and development of AI models, which may result in

operational challenges, legal liability, reputational concerns and competitive risks.

We use and develop AI and automated analysis and decision-making technologies, including proprietary

AI algorithms and models and computational fluid dynamics (collectively, “AI Technologies”) to power the

Heartflow Platform. In addition, we use AI Technologies to drive improvements in the performance of the

Heartflow Platform. We expect that significant increased investment will be required in the future to

improve our use and development of AI Technologies.

As with many technological innovations, there are significant risks involved in developing, maintaining and

deploying these technologies. In particular, if the AI Technologies underlying our Heartflow Platform are

incorrectly designed or implemented; trained or reliant on incomplete, inadequate, inaccurate or otherwise

poor quality data; used without sufficient oversight and quality control; misused or used outside of scope

of applicable regulatory authorizations; and/or adversely impacted by unforeseen bugs, defects, technical

challenges, cybersecurity threats or material performance issues, the performance of our Heartflow

Platform and business, as well as our reputation and the reputations of our customers, could suffer or we

could incur liability resulting from the violation of laws or contracts to which we are a party, regulatory

enforcement actions or civil claims. This could result in fines, penalties and damage awards and

disgorgement of any output, development or technology developed as a result of such violations.

In addition, we leverage a human-in-the-loop AI system that combines advanced algorithms with an

analyst-based quality inspection and monitoring process to create patient-specific reports based on CCTA

images. While we constantly work to improve our Heartflow Platform and algorithms, the AI Technologies

we work with are novel and complex, and we cannot assure you that our AI Technologies will be able to

perform as intended under all circumstances, or that our analyst-based review process will identify and

correct any errors in the outputs of our AI Technologies.

The regulatory framework for AI Technologies is rapidly evolving as many federal, state and foreign

government bodies and agencies have introduced or are currently considering additional laws, regulations

and guidance. For example, the FDA has issued guidance documents relating to the incorporation of AI

Technologies into medical devices and marketing submissions for AI-enabled devices. Specifically, draft

guidance issued on January 7, 2025, titled Artificial Intelligence-Enabled Device Software Functions:

Lifecycle Management and Marketing Submission Recommendations, proposes recommendations for the

design, development and implementation of AI-enabled devices that the FDA encourages manufacturers

consider using throughout the total product lifecycle. In addition, the California Privacy Protection Agency

has approved for rulemaking regulations under the CCPA regarding the use of automated decision-

making that may require assessing risks and to provide notice and rights to opt-out and access to

information underlying the logic and outputs. Colorado passed the Colorado AI Act, which will go into

effect in February 2026. This law creates duties for developers and deployers to use reasonable care to

protect consumers from any known or reasonably foreseeable risks of “algorithmic discrimination” arising

from the intended and contracted uses of “high-risk AI systems,” including those that impact healthcare

services. Such additional laws, regulations and guidance may impact our ability to develop, use and

commercialize AI Technologies in the future.

It is possible that further new laws and regulations will be adopted in the United States and in other non-

U.S. jurisdictions, or that existing laws and regulations, including competition and antitrust laws, may be

interpreted in ways that would limit our ability to use AI Technologies for our business, or require us to

change the way we use AI Technologies in a manner that negatively affects the performance of our

Heartflow Platform and the way in which we use AI Technologies. We may need to expend resources to

adjust our Heartflow Platform in certain jurisdictions if the laws, regulations or decisions are not consistent

across jurisdictions. Further, the cost to comply with such laws, regulations or decisions and/or guidance

interpreting existing laws, could be significant and would increase our operating expenses (such as by

imposing additional reporting obligations regarding our use of AI Technologies). Such an increase in

operating expenses, as well as any actual or perceived failure to comply with such laws and regulations,

could materially and adversely affect our business, financial condition, results of operations and

prospects.

Our Heartflow Platform and the data and models it generates could have bugs, defects or errors,

including human quality control errors, or otherwise fail to meet the expectations of patients,

physicians and third-party payors, which could adversely affect our reputation, business and

operating results.

We cannot provide assurance that the proprietary technology and algorithms used in our Heartflow

Platform do not contain undetected bugs, defects or errors or that our analyst-based review process will

identify and correct any errors in the outputs of our AI Technologies. We cannot provide assurance that

the inbound CCTA images and image quality will always allow a true representation of the patient

anatomy, and any such limitations in CCTA images could affect the results of our analyses. We have in

the past, and may in the future, experience defects or errors in our Heartflow Platform or the data and

models it generates that remain undetected by our analyst-based review process, and our reputation,

business and operating results could be adversely affected.

Furthermore, the success of the Heartflow Platform depends in part on patients’, physicians’ and third-

party payors’ confidence that our platform can provide reliable, high-quality actionable data and analysis

that will improve clinical decision making. We believe that patients, physicians and third-party payors are

likely to be sensitive to product defects and errors in the use of our products, including if the defects and

errors affect a physician’s ability to use the CCTA imaging results or result in a misdiagnosis. In the past,

we have experienced software code defects and software release process defects that have resulted in

intermittent interruptions to the physician’s ability to use our Heartflow Platform, and we may experience

such defects in the future. A subset of these defects were reported as part of the FDA’s Manufacturer and

User Facility Device Experience (“MAUDE”) disclosure. For more information, see the risk factor titled

“The Heartflow Platform may be subject to recalls, which could be costly and could harm our reputation

and business.” As a result, the failure of our Heartflow Platform to perform as expected, including to

reduce unnecessary invasive testing or fail to enable physicians to optimize treatment planning or provide

more efficient care, could significantly impact a physician’s willingness to use and rely on the Heartflow

Platform, which would impair our operating results and our reputation. In addition, we may be subject to

legal claims arising from any such failures.

Bugs, defects or errors in the Heartflow Platform or the failure of third-party service providers we rely on,

such as Amazon Web Services (“AWS”) or other cloud storage and telecommunications services

providers, to block a virus or prevent a security breach could harm our reputation and adversely impact

our results of operations. Defects may cause our products to be vulnerable to security attacks, cause

them to fail to produce accurate results or temporarily interrupt our commercial operations. Because the

techniques used by computer hackers to access or sabotage networks change frequently and generally

are not recognized until launched against a target, we or our third-party services providers may be unable

to anticipate these techniques and provide a corrective measure in time to protect the Heartflow Platform

and our networks. Potential defects may further cause the platform to be unavailable for a period of time,

affect ability of a customer to access information, result in a slow or suboptimal user experience, impact

turnaround time of an analysis, or provide other forms of degradation to the overall service.

We depend on our talent to grow and operate our business, and if we are unable to hire, integrate,

develop, motivate and retain our personnel, including highly qualified, technical personnel, we

may not be able to grow effectively and this could adversely affect our business.

To execute our growth plan, we must attract and retain highly qualified, technical personnel. Competition

for these personnel is intense, especially for engineers with high levels of expertise in AI, cloud

architecture, 3D visualization, research scientists and senior sales executives with experience in the

cardiology industry. We may experience difficulty in hiring and retaining employees with appropriate

qualifications. Many of the companies with which we compete for experienced personnel have greater

resources than we have. We also compete with companies that are believed to have high potential growth

opportunities or that have experienced rapid recent growth.

Our future success depends in part on our ability to continue to retain our executive officers and other key

employees and to recruit and hire new employees, including engineers, research scientists, case analysts

and production team members. We do not maintain “key person” insurance for any of our executives or

other employees. The loss of the services of any of these persons could impede the achievement of our

development, research and commercialization objectives. Any of our executive officers and other

employees may terminate employment with us at any time with no advance notice. The replacement of

any of our key personnel likely would involve significant time and costs, may significantly delay or prevent

the achievement of our business objectives and may harm our business.

In addition, job candidates and existing employees often consider the value of the stock awards they

receive in connection with their employment. If the perceived value of our stock awards declines or is

perceived to be less valuable than stock awards of other competing employers, it may adversely affect

our ability to recruit and retain highly skilled employees. In addition, many of our employees have become

or will soon become vested in a substantial amount of stock or number of stock options. Our employees

may be more likely to leave us if the shares they own or the shares underlying their vested options have

significantly appreciated in value relative to the original purchase prices of the shares or the exercise

prices of the options, or if the exercise prices of the options that they hold are significantly below the

market price of our common stock. If we fail to attract new personnel, or fail to retain and motivate our

current personnel, our business and prospects could be adversely affected.

If we fail to properly manage our future growth, our business could suffer.

We intend to continue to grow and may experience periods of rapid growth and expansion, which could

place a significant additional strain on our limited personnel, information technology systems and other

resources. Our future growth will impose significant added responsibilities on management, including the

need to identify, recruit, train and integrate additional employees. In order to manage our operations and

growth we will need to continue to improve our operational and management controls, administrative and

operational infrastructure, reporting and information technology systems and financial internal control

procedures. Due to our limited financial resources and the limited experience of our management team in

managing a company with such future growth expectations, we may not be able to effectively manage the

expected expansion of our operations or recruit and train additional qualified personnel. Moreover, the

expected expansion of our operations may lead to significant costs and may divert our management and

business development resources. Any inability to manage growth could delay the execution of our

business plans or disrupt our operations.

In addition, as demand for the Heartflow Platform increases, we will need to scale our capacity, expand

customer service and enhance our internal quality assurance program. We may fail to implement any

increases in scale, related improvements and quality assurance, and we may fail to find appropriate

personnel to facilitate the growth of our business. Due to our limited resources, we may not be able to

effectively manage this simultaneous execution and expansion of our operations. This may result in

weaknesses in our infrastructure, give rise to operational mistakes, legal or regulatory compliance

failures, loss of business opportunities, loss of employees and reduced productivity among remaining

employees. The expansion of our operations may lead to significant costs and may divert financial

resources from other projects, such as the development of any new products. If our management is

unable to effectively manage our expected development and expansion, our expenses may increase

more than expected, our ability to generate or increase our revenue could be reduced and we may not be

able to implement our business strategy. Our future financial performance and our ability to compete

effectively and commercialize our Heartflow Plaque Analysis or any of our future products will depend in

part on our ability to effectively manage the future growth and expansion of our company. If we are unable

to manage our growth effectively, it may be difficult for us to execute our business strategy and our

business, financial condition, results of operations and prospects may be adversely affected.

Our business could be disrupted by catastrophic events.

The occurrence of any catastrophic event, including earthquake, fire, flood, tsunami or other weather

event, power loss, telecommunications failure, software or hardware malfunctions, pandemics, political

unrest, geopolitical instability, severe or prolonged economic downturn, including domestic and global

inflationary trends, interest rate volatility, and uncertainty with respect to the federal debt ceiling and

budget and potential government shutdowns related thereto, cyberattack (including a ransomware attack),

war or terrorist attack, could result in lengthy interruptions in our ability to serve our customers. In

addition, acts of terrorism could cause disruptions to the internet or the economy as a whole and could

disproportionately affect us given our reliance on the internet and cloud-based services. Specifically, our

corporate headquarters are located in Mountain View, California and our production-related computers

are currently located in our Mountain View office and in Austin, Texas. California is considered to be an

active earthquake zone, is prone to catastrophic fires, severe weather events and the follow-on effects

thereof, including tsunamis, mudslides, flooding, power outages and other events that could disrupt our

business. Texas is also subject to severe weather events, power outages and other events that could

disrupt our business. Any event that prevents our access to such facilities, physically or virtually, would

prevent us from operating our business and have an adverse effect on our business, financial condition,

In addition, we rely on our network and third-party infrastructure, including our cloud-based infrastructure

which we outsource to AWS, enterprise applications, internal technology systems and our website, for our

development, marketing, operational support-hosted services and sales activities. In the event of a

catastrophic event, we may be unable to continue our operations and may endure system interruptions,

delays in our ability to generate reports and output them to physicians, reputational harm, delays in our

product development, breaches of data security and loss of critical data, all of which could have an

adverse effect on our future operating results. If we are unable to develop adequate plans to ensure that

our business functions continue to operate during and after a disaster and to execute successfully on

those plans in the event of a disaster or emergency, our business would be harmed. Even with our

disaster recovery arrangements and insurance coverage, the ability of our customers to access and utilize

our Heartflow Platform could be interrupted, or we could lose critical data, which would have a negative

In addition, the occurrence of a catastrophic event could impact providers of CCTAs, contrast agents for

CCTAs or suppliers of iodinated contrast media or similar supplies that are necessary to perform CCTAs.

For example, in 2022, the shutdown of an iodinated contrast media manufacturing facility led to a

significant shortage of iodinated contrast media, which resulted in the cancellation or rescheduling of non-

urgent contrast-requiring cardiac procedures and imaging. Any of these events could affect demand for

the Heartflow Platform, which could have a material adverse effect on our business, financial condition,

Consolidation among healthcare providers could have an adverse effect on our business,

In the United States, there has been a trend of consolidation among healthcare providers and purchasers

of medical technology devices, often to gain greater market power. As healthcare providers consolidate,

they may try to use their market power to negotiate price concessions or reductions for the products and

services they purchase and use, including our Heartflow Platform. As a result, it is unknown whether such

purchasers will decide to stop purchasing our Heartflow Platform or demand discounts on our prices. If we

reduce our prices in response to these industry trends, our revenue would decrease, which could have a

We may acquire other companies, solutions or technologies, which could divert our

management’s attention, result in additional dilution to our stockholders and otherwise disrupt

our operations and adversely affect our operating results.

We may in the future seek to acquire or invest in companies, solutions or technologies that we believe

could complement or expand our products, enhance our technical capabilities or otherwise offer growth

opportunities. The pursuit of potential acquisitions or other investment opportunities may divert the

attention of management and cause us to incur various expenses in identifying, investigating and

pursuing suitable transactions, whether or not they are consummated.

If we acquire any businesses, we may not be able to integrate the acquired personnel, operations and

technologies successfully, or effectively manage the combined business following the acquisition. We also

may not achieve the anticipated benefits from the acquired business due to a number of factors,

including: inability to integrate or benefit from acquired technologies or services in a profitable manner;

unanticipated costs or liabilities associated with the acquisition; incurrence of acquisition-related costs;

difficulty integrating the accounting systems, operations and personnel of the acquired business;

difficulties and additional expenses associated with supporting legacy products and hosting infrastructure

of the acquired business; diversion of management’s attention from other business concerns; use of

resources that are needed in other parts of our business; adverse effects on our existing business

relationships with business partners and customers as a result of the acquisition; the potential loss of key

employees; and use of substantial portions of our available cash to consummate the acquisition.

In addition, a significant portion of the purchase price of any companies, solutions or technologies that we

may acquire may be allocated to acquired goodwill and other intangible assets, which must be assessed

for impairment at least annually. If our acquisitions do not yield expected returns, we may be required to

take charges to our operating results based on this impairment assessment process, which could

adversely affect our results of operations.

Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, which

could adversely affect our operating results and cause the market price of our common stock to decline. If

an acquired company, solution or technology fails to meet our expectations and does not complement or

expand our products, enhance our technical capabilities or otherwise offer growth opportunities, our

business, financial condition, results of operations and prospects may suffer.

Sales to customers outside the United States or with international operations expose us to risks

inherent in international sales.

In the three months ended September 30, 2025 and 2024, sales to customers outside the United States

accounted for approximately 7% and 8%, respectively, and accounted for approximately 8% and 9% of

our revenue in the nine months ended September 30, 2025 and 2024, respectively. One element of our

growth strategy is to further expand our international operations and worldwide customer base. Operating

in international markets requires significant resources and management attention and subjects us to

regulatory, economic and political risks that are different from those in the United States.

We have limited operating experience in international markets, and we cannot assure you that our

existing presence in the United Kingdom, Europe and Japan or any expansion efforts into other

international markets will be successful. Our experience in the United States and international markets

may not be relevant to our ability to expand in other markets. Our international expansion efforts may not

be successful in creating further demand for our products outside of the United States or in effectively

selling our products in the international markets we enter. In addition, expansion into other international

markets will be costly and will impose additional burdens on our executive and administrative personnel,

finance and legal teams, sales and marketing teams and general managerial resources. If our efforts to

introduce our products into other international markets are not successful, we may have expended

significant resources without realizing the expected benefit. Ultimately, the investment required for

international expansion could exceed the results of operations generated from this expansion.

In addition, we operate in an industry which is subject to significant enforcement scrutiny by both U.S. and

non-U.S. government authorities. Our international business requires us to comply with U.S. and foreign

laws and regulations, such as various anti-bribery and anti-corruption laws, including the U.S. Foreign

Corrupt Practices Act (“FCPA”), the U.S. Fraud Act and in certain cases the U.K. Bribery Act of 2010.

Compliance with these is costly and exposes us to significant civil and criminal penalties for non-

compliance. Any failure to comply with applicable legal and regulatory obligations could impact us in a

variety of ways that include, but are not limited to, significant criminal, civil and administrative fines,

penalties and disgorgement of profits, including imprisonment of individuals, denial of export privileges,

seizure of shipments, restrictions on certain business activities and exclusion or debarment from

government contracting. Our international operations expose us to risks inherent in operating in foreign

jurisdictions that could adversely affect our business.

If we do not obtain and maintain international regulatory registrations, clearances or approvals for

our Heartflow Platform, we will be unable to market and sell our products outside of the United

States.

Any future sales of our products outside of the United States are subject to foreign regulatory

requirements that vary widely from country to country. While the regulations of some countries may not

impose barriers to marketing and selling our products or only require notification, others require that we

obtain the clearance or approval of a specified regulatory authority or a Certificate of Conformity of a

notified body. Complying with foreign regulatory requirements, including obtaining registrations,

clearances or approvals, can be expensive and time consuming and we may not receive regulatory

clearances or approvals in each country in which we plan to market our products or we may be unable to

do so on a timely basis. The time required to obtain registrations, clearances or approvals, if required by

other countries, may be longer than that required for FDA clearance or approval, and requirements for

such registrations, clearances or approvals may significantly differ from FDA requirements. If we modify

our products, we may need to apply for regulatory clearances or approvals before we are permitted to sell

the modified product.

In addition, AI governing regulations around medical devices evolve rapidly, and we may not continue to

meet the quality and safety standards required to maintain the authorizations that we have received. If we

are unable to maintain our authorizations in a particular country, we will no longer be able to sell the

applicable product in that country.

Regulatory registration, clearance, marketing authorization, or approval by the FDA does not ensure

registration, clearance, marketing authorization, or approval by foreign regulatory authorities or authorized

representatives in other countries. Registration, clearance, marketing authorization, or approval by one or

more foreign regulatory authorities or authorized representatives do not ensure registration, clearance,

marketing authorization, or approval by regulatory authorities in other foreign countries or by the FDA.

Nevertheless, a failure or delay in obtaining registration or regulatory clearance or approval in one country

may have a negative effect on the regulatory process in others.

Risks Related to Data Privacy and Information Technology

Failure to comply with laws and regulations affecting the transmission, security and privacy of

personal information (including health information) could result in significant penalties.

Federal, state and foreign government bodies and authorities have adopted, are considering adopting, or

may adopt laws and regulations regarding the collection, use, processing, storage and disclosure of

personal information obtained from consumers and individuals. In the United States, federal, state, and

local governments have enacted numerous data privacy and security laws, including data breach

notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal

Trade Commission Act), and other similar laws (e.g., wiretapping laws). Under these laws we may be

required to obtain certain consents to process personal data. For example, some of our data processing

practices have been, and may in the future continue to be, subject to challenges or lawsuits under

privacy, security, and communications laws, including, for example, challenges based on wiretapping laws

for sharing consumer information with third parties through various methods, such as via third-party

marketing pixels or software development kits. Our inability or failure to obtain consent for these practices

could result in adverse consequences, including class action litigation and mass arbitration demands. In

addition, numerous federal and state laws and regulations, including the Health Insurance Portability and

Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic

and Clinical Health Act of 2009 (“HITECH”), govern the collection, dissemination, security, use and

confidentiality of patient identifiable health information. HIPAA and the HITECH Act require us to comply

with standards for the use and disclosure of health information within our company and with third parties.

The Standards for Privacy of Individually Identifiable Health Information (“Privacy Standards”), and the

Security Standards for the Protection of Electronic Protected Health Information (“Security Standards”),

under HIPAA establish a set of basic national privacy and security standards for the protection of

individually identifiable health information by health plans, healthcare clearinghouses and certain

healthcare providers, referred to as covered entities, and the business associates with whom such

covered entities contract for services. As a result, both covered entities and business associates can be

subject to significant civil and criminal penalties for failure to comply with the Privacy Standards or the

Security Standards.

HIPAA, the HITECH Act and the Affordable Care Act (“ACA”) also include standards for common

healthcare electronic transactions and code sets, such as claims information, plan eligibility, payment

information and the use of electronic signatures, unique identifiers, operating rules. Companies that bill

payors for healthcare-related services and device use are required to conform to the transaction

standards. CMS, on behalf of HHS, has the authority to investigate complaints and audit for compliance

with the HIPAA standards for transactions, code sets, unique identifiers and operating rules, including the

Administrative Simplification provisions of HIPAA and the ACA. Failure to comply with these standards,

and any investigation or audit and penalties imposed may have an adverse impact on our business.

HIPAA requires covered entities and business associates to develop and maintain policies and

procedures with respect to protected health information that is used or disclosed, including the adoption of

administrative, physical and technical safeguards to protect such information. The HITECH Act expands

the notification requirement for breaches of patient identifiable health information, restricts certain

disclosures and sales of patient identifiable health information and provides a tiered system for civil

monetary penalties for HIPAA violations. The Final HIPAA Omnibus Rule modifies the breach reporting

standard in a manner that will likely make more data security incidents qualify as reportable breaches.

The HITECH Act also increased the civil and criminal penalties that may be imposed against covered

entities, business associates and possibly other persons and gave state attorneys general new authority

to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek

attorney fees and costs associated with pursuing federal civil actions. Additionally, states have adopted

comparable privacy and security laws and regulations that differ somewhat from federal and other states’

laws, and that govern where more stringent than federal law.

As a business associate under HIPAA, if we do not comply with the requirements of HIPAA, the HITECH

Act or applicable state privacy and security laws, we could be subject to criminal or civil sanctions that

could adversely affect our financial condition. The costs of complying with privacy and security related

legal and regulatory requirements are substantial and could have an adverse effect on our business. In

addition, we are unable to predict what changes to the HIPAA Privacy Standards and Security Standards

might be made in the future or how those changes could affect our business. Any new legislation or

regulation in the area of privacy and security of personal information, including personal health

information, could also adversely affect our business operations. In addition, a security breach could

require reporting to federal and state government entities, notification to affected individuals, expensive

investigation and remediation and mitigation. Government agencies could, in their discretion, impose fines

and penalties relating to the breach, that would have an adverse effect on our business.

Foreign data privacy regulations, such as the General Data Protection Regulation (E.U.) 2016/679, the

European Union’s Data Protection Directive (“Directive 95/46/EC”), and the country specific regulations

that implement Directive 95/46/EC, also govern the processing of personally identifiable data, and a

number of these regulations are stricter than U.S. laws.

In addition, many states have laws, regulations and other authorities that govern data privacy, security

and breach notification. While some of these laws exempt protected health information subject to HIPAA,

they may apply to other personal information we collect, including personal information collected from

employees or from visitors to our website. Failure to comply with these authorities may have an adverse

We expect to expend significant resources to comply with these laws and regulations. The functional and

operational requirements and costs of compliance with such laws and regulations may adversely impact

our business, and failure to enable our solutions to comply with such laws and regulations could lead to

significant fines and penalties imposed by regulators, as well as claims, lawsuits and contractual

indemnification obligations by or for our customers or third parties and significant reputational harm.

We depend on our information technology systems, and any failure of these systems could harm

our business and adversely affect our business and operating results.

Information technology and telecommunications systems are vulnerable to damage from a variety of

sources, including telecommunications or network failures, failures during the processes of upgrading or

replacing software, power outages, hardware failures, user or human errors and natural disasters.

Moreover, despite network security and back up measures, some of our servers are potentially vulnerable

to cybersecurity incidents, including phishing attacks by computer hackers or other malicious human acts,

computer viruses, ransomware, malware and similar disruptive problems or other methods of

compromising employee or customer administrator credentials to access protected health information and

our internal data. Failures or significant downtime of our information technology or telecommunications

systems could prevent us from operating our business. Any disruption or loss of information technology or

telecommunications systems on which critical aspects of our operations depend could have an adverse

effect on our business and our operating results may suffer.

In addition, our brand, reputation and ability to attract, retain and serve our customers are dependent

upon the reliable performance of our Heartflow Platform, including our underlying information technology

systems and infrastructure. Our technical infrastructure may not be adequately designed with sufficient

reliability and redundancy to avoid performance delays or outages that could be harmful to our business.

If our Heartflow Platform is unavailable when physicians attempt to access it, or if it does not load as

quickly as they expect, physicians may not use our Heartflow Platform as often in the future, or at all. As

our customer base continues to grow, we will need an increasing amount of technical infrastructure,

including network capacity and computing power, to continue to satisfy the needs of our users.

We rely upon AWS to operate our cloud offering; any disruption of or interference with our use of

AWS would adversely affect our business, results of operations and financial condition.

We outsource all of our cloud-based infrastructure to AWS. Our customers need to be able to access our

cloud-based infrastructure at any time, without interruption or degradation of performance. AWS runs its

own platform that we access, and we are, therefore, vulnerable to service interruptions at AWS. We may

experience interruptions, delays and outages in service and availability from time to time as a result of

problems with our AWS provided infrastructure. For example, in October 2025 and at other times in the

past, AWS has suffered significant outages that had a widespread impact on cloud-based software and

services companies. Although our cloud offering has not been affected by these outages, a similar outage

could render our cloud offering inaccessible to customers, and such outages may be prolonged.

Additionally, AWS has suffered outages at specific customer locations in the past, rendering the customer

unable to access our offering for periods of time. Lack of availability of our AWS infrastructure could be

due to a number of potential causes including technical failures, natural disasters, fraud or security

attacks that we cannot predict or prevent.

In addition, if the security of the AWS infrastructure is compromised or believed to have been

compromised, our business, results of operations and financial condition could be adversely affected. It is

possible that our customers and potential customers would hold us accountable for any breach of security

affecting the AWS infrastructure and we may incur significant liability from those customers and from third

parties with respect to any breach affecting AWS systems. For more information, see the risk factor titled

“Failure to comply with laws and regulations affecting the transmission, security and privacy of personal

information (including health information) could result in significant penalties.” Because our agreement

with AWS limits AWS’ liability for damages, we may not be able to recover a material portion of our

liabilities to our customers and third parties from AWS. Customers and potential customers may refuse to

do business with us because of the perceived or actual failure of our cloud offering as hosted by AWS and

our operating results could be harmed.

Our agreement with AWS allows AWS to terminate the agreement by providing 30 days’ advance notice,

and allows AWS to terminate in case of a material breach of contract if such breach is uncured for 30

days following receipt of notice of such breach, or to terminate immediately upon notice to us (i) if AWS

has the right to suspend our account; (ii) if AWS’ relationship with a third-party software or technology

provider terminates, expires or requires AWS to change the way it provides its services; or (iii) in order to

comply with the law or requests of governmental entities. Although we expect that we could receive

similar services from other third parties, if any of our arrangements with AWS are terminated, we could

experience interruptions on our platform and in our ability to make our platform available to customers, as

well as delays and additional expenses in arranging alternative cloud infrastructure services.

If we fail to offer high quality customer support, our business and reputation could suffer.

Our customers rely on our customer support teams to resolve technical and operational issues if and

when they arise. We may be unable to respond quickly enough to accommodate short-term increases in

customer demand for customer support. We also may be unable to modify the nature, scope and delivery

of our customer support to compete with changes in customer support services provided by our

competitors or to adapt to product and industry developments. Increased customer demand for customer

support, without corresponding revenue, could increase costs and harm our results of operations. In

addition, as we continue to grow our operations and reach a large global customer base, we need to be

able to provide efficient customer support that meets our customers’ needs globally at scale. The number

of our customers has grown significantly, and that growth has and will continue to put additional pressure

on our support organization. As our business scales, we may need to engage third-party customer

support service providers, which could negatively impact the quality of our customer support if such third

parties are unable to provide customer support that is as effective as that we provide ourselves. Our sales

are highly dependent on our business reputation and on positive recommendations from our existing

customers. Accordingly, high quality customer support is important for the renewal and expansion of our

agreements with existing customers and any failure to maintain such standards of customer support, or a

market perception that we do not maintain high quality customer support, could harm our reputation, our

ability to sell product to existing and prospective customers and our business, financial condition, results

of operations and prospects.

We invest significantly in research and development, and to the extent our research and

development investments do not translate into new products, features or improvements to our

current products, or if we do not use those investments efficiently, our business, financial

condition, results of operations and prospects would be harmed.

A key element of our strategy is to invest significantly in our research and development efforts to

introduce new products, features and improvements aimed at increasing the value proposition of the

Heartflow Platform for our customers. For the three months ended September 30, 2025 and 2024, our

research and development expenses were 37% and 36% of our revenue, respectively, and 36% and 34%

of our revenue for the nine months ended September 30, 2025 and 2024, respectively. If we do not spend

our research and development budget efficiently or effectively on compelling innovation and technologies,

our business may be harmed and we may not realize the expected benefits of our strategy. Moreover,

research and development projects can be technically challenging and expensive. The nature of these

research and development cycles may cause us to experience delays between the time we incur

expenses associated with research and development and the time we are able to offer compelling

solutions and generate revenue, if any, from such investment. For example, investments made to expand

the Heartflow Platform to asymptomatic patients may be expensive, technically challenging, experience

delays and may not be successful. Additionally, anticipated customer demand for a product or feature we

are developing could decrease after the development cycle has commenced, and we would nonetheless

be unable to avoid substantial costs associated with the development of any such product or features. If

we expend a significant amount of resources on research and development and our efforts do not lead to

the successful introduction or improvement of products or features that are competitive in our current or

future markets, it would harm our business, financial condition, results of operations and prospects.

Our networks and those of our third-party service providers may become the target of bad actors

or security breaches that we cannot anticipate or successfully defend, which could have an

adverse impact on our business.

The Heartflow Platform involves the storage and transmission of our customers’ personal information or

identifying information of their patients. Increasingly, we and other companies are subject to a wide variety

of attacks on their networks on an ongoing basis. In addition to attacks from traditional computer

“hackers,” malicious code (such as viruses and worms), employee theft or misuse, ransomware attacks

and denial of service attacks, sophisticated nation state and nation state supported actors now engage in

intrusions and attacks (including advanced persistent threat intrusions), and add to the risks to our

internal networks and the information they store and process. Additionally, such bad actors frequently

attempt to fraudulently induce employees or customers into disclosing sensitive information such as user

names, passwords or other information in order to gain access to our customers’ data, their patient’s data

or our data, including our intellectual property and other confidential business information, or our

information technology systems. Because techniques used to obtain unauthorized access or to sabotage

systems change frequently and generally are not recognized until successfully launched against a target,

we may be unable to anticipate these techniques or to implement adequate preventative measures.

Despite significant efforts to create process and security barriers to such threats, it is virtually impossible

for us to entirely mitigate these risks. Any such breach could compromise our networks, creating system

disruptions or slowdowns and exploiting security vulnerabilities of our products, and the information stored

on our networks could be accessed, publicly disclosed, lost or stolen, which could subject us to liability

and cause us significant financial harm. Such breaches often result in reputational damage, negative

publicity, loss of industry data security certifications, customers and sales, increased costs to remedy any

problem, costly litigation and contractual indemnification obligations by or for impacted customers or third

parties any of which could adversely affect our business. In addition, although we have, and intend to

maintain, insurance with respect to any such indemnification obligations, the coverage limits of our

insurance policies may not be adequate and one or more successful claims brought against us may have

an adverse effect on our business, financial condition, results of operations and prospects.

We also rely on third-party service providers, such as cloud storage and telecommunications services

providers. Such service providers are also potentially vulnerable to cybersecurity incidents that could

result in the interruption of their services to us or unauthorized access, use or disclosure of our

confidential information and confidential information of our customers and protected health information of

their patients.

Our products are also targets for malicious cybersecurity acts. While some of our products contain

encryption or security algorithms to protect third-party content or patient information or other data stored

in our products, these products could still be hacked or targeted by malicious software programs or other

attacks or the encryption schemes could be compromised, breached or circumvented by motivated or

sophisticated hackers, which could harm our business and our reputation. In addition, see the risk factor

titled “Our Heartflow Platform and the data and models it generates could have bugs, defects or errors,

including human quality control errors, or otherwise fail to meet the expectations of patients, physicians

and third-party payors, which could adversely affect our reputation, business and operating results” for

more information on bugs, defects or errors in the Heartflow Platform.

Risks Related to Legal and Regulatory Matters

We face extensive regulatory requirements to bring our products to market, and our failure to

receive and maintain regulatory clearances or approvals of our current and future products in the

United States or abroad or to comply with medical device regulatory requirements could

adversely affect our business.

In order to market any product, we must establish and comply with numerous and varying regulatory

requirements that differ by country and by region within certain countries. Approval, clearance or

marketing authorization in the United States by the FDA or by a regulatory authority or other body in

another country does not ensure approval by the regulatory authorities in other countries or jurisdictions

or ensure approval, clearance or other marketing authorization for the same conditions of use. Approval

processes vary among countries and can involve additional product testing and validation and additional

administrative review periods. In general, unless an exemption applies, in the United States, current and

future versions of our products must receive pre-market notification (“510(k)”), de novo classification (“de

novo”) or pre-market approval (“PMA”) from the FDA before they can be marketed in the United States.

We cannot provide assurance that any of our future products, to the extent required, will be cleared,

approved or otherwise authorized by the FDA through any of its pre-market review processes, or that the

FDA will provide export certificates that are necessary to export certain products to certain countries. In

addition, the national health or social security organizations of certain foreign countries, including those

outside Europe, require our products to be qualified before they can be marketed in those countries.

Failure to receive, or delays in the receipt of, relevant foreign qualifications in the European Economic

Area or other foreign countries could have an adverse effect on our business.

Pre-market notification, de novo classification request or PMA applications may require support by data

from clinical trials. We are subject to requirements to publicly register and report the results of our clinical

trials. We must also abide by good clinical practice (“GCP”) requirements in the conduct and

documentation of our clinical trials and report to the FDA significant financial interests of investigators in

any clinical trials we submit to support marketing applications for our products. We, the FDA or an

institutional review board (“IRB”), may suspend or terminate clinical trials at any time on various grounds,

including a finding that patients are being exposed to an unacceptable health risk or that the treatment

does not have any effect. If the FDA considers data from our clinical trials to be actually or potentially

biased due to investigators’ financial interests, or unreliable due to GCP noncompliance, it can require us

to implement extensive data analyses or other corrective actions, or exclude data from consideration in

support of our marketing applications. These outcomes could result in delay or denial of FDA clearance or

approval and could result in the need to conduct additional, costly and time-consuming clinical trials.

Additionally, we are required to obtain pre-market clearance or approval to market significantly modified

versions of our currently cleared Heartflow Platform, as well as to market the existing product for new

indications. The FDA requires us to make and document a determination as to whether or not a

modification requires a new 510(k) clearance, de novo classification or PMA approval; however, the FDA

can review and disagree with our decision. Although we have received 510(k) clearance from the FDA for

the current version of the Heartflow Platform, we may not be successful in receiving clearances, de novo

classification or approvals in the future or the FDA may not agree with our decisions not to seek

clearances, de novo classifications or approvals for any new products or particular product modifications

or updates. The FDA may require us to obtain a new 510(k) clearance, de novo classifications or approval

for any past or future modification or a new indication for our existing products. Such submissions may

require the development and submission of additional data, may be time consuming and costly, and

ultimately may not be cleared or approved by the FDA.

If the FDA requires us to obtain pre-market clearances, de novo classifications or approvals for any

marketed modification to a previously cleared version of the Heartflow Platform, we may be required to

cease manufacturing and marketing of the modified product or to recall the modified product until we

obtain such FDA marketing authorization. The FDA may not clear, grant or approve such submissions in a

timely manner, if at all. The FDA also may change its policies, adopt additional regulations, or revise

existing regulations, each of which could prevent or delay pre-market clearance, de novo classification or

approval of our devices, or could impact our ability to market a device that was previously cleared. Any of

the foregoing could adversely impact our business and financial condition.

In addition, the FDA and other comparable foreign regulatory authorities may delay, limit or deny

clearance, de novo classification or approval of future versions of or future indications for our products or

any other potential product for many reasons, including, among others:

•the results of our clinical trials may not meet the level of statistically significant and clinically

meaningful efficacy with an acceptable safety profile as required by FDA, or other comparable

regulatory authorities in other countries, for marketing approval;

•the FDA or other comparable regulatory authorities in other countries may disagree with the number,

design, size, conduct or implementation of our clinical trials;

•the FDA or other comparable regulatory authorities in other countries may disagree with our

interpretation of data from our clinical trials;

•the FDA or other comparable regulatory authorities in other countries may not accept data generated

at one or more of our clinical trial sites;

•if our 510(k) notifications, de novo classification requests, PMA applications, or similar notifications or

applications, if and when submitted, are reviewed by the FDA or other comparable regulatory

authorities, as applicable, the regulatory authorities may have difficulties scheduling the necessary

review meetings in a timely manner, or may recommend against clearance or approval of our

application; or

•the FDA may determine that our 510(k) notifications for new indications, if and when submitted, must

follow a different regulatory pathway than we have attempted, and there may be potentially extended

standards, timelines, reviews (such as by an FDA Advisory Committee) and costs in order to pursue

approval.

Further, the ability of the FDA to review and approve new products, to provide feedback on clinical trials

and development programs, to meet with manufacturers, and other related processes can be affected by

a variety of factors, including government budget and funding levels, reductions in workforce, ability to

hire and retain key personnel, and statutory, regulatory and policy changes. Government shutdowns, if

prolonged, can significantly impact the ability of government agencies upon which we rely, such as the

FDA, to timely review and process our regulatory submissions, which could have a material adverse

effect on our business.

Any of these factors, many of which are beyond our control, could jeopardize our ability to obtain

regulatory clearance, de novo classification or approval for current or future versions of the Heartflow

Platform and could result in difficulties and costs for us. If we fail to comply with regulatory requirements in

international markets or to obtain and maintain required marketing authorizations, or if marketing

authorizations in international markets are delayed, our ability to realize the full market potential of our

new potential products will be limited.

Healthcare policy changes, including recently enacted legislation reforming the U.S. healthcare

system could have an adverse effect on our business, financial condition, results of operations

and prospects.

In the United States, there have been and continue to be a number of legislative and regulatory initiatives

to contain healthcare costs. Federal and state lawmakers regularly propose and, at times, enact

legislation that would result in significant changes to the U.S. healthcare system, some of which are

intended to contain or reduce the costs of medical products and services, including our own products. For

example, on July 4, 2025, the annual reconciliation bill, the “One Big Beautiful Bill Act,” or OBBBA, was

signed into law which is expected to reduce Medicaid spending and enrollment by implementing work

requirements for some beneficiaries, capping state-directed payments, reducing federal funding, and

limiting provider taxes used to fund the program. OBBBA also narrows access to ACA marketplace

exchange enrollment and declines to extend the ACA enhanced advanced premium tax credits, set to

expire in 2025, which, among other provisions in the law, are anticipated to reduce the number of

Americans with health insurance. These changes may decrease patient access to advanced

cardiovascular diagnostics, including Heartflow's FFRCT and Plaque Analysis products, particularly

among lower-income and high-risk populations. In addition, reduced federal and state funding, caps on

supplemental payments, and limits on provider revenue sources may constrain hospital and health

system budgets, potentially slowing adoption of innovative diagnostics despite demonstrated clinical

value.

Current and future legislative proposals to further reform healthcare or reduce healthcare costs may limit

coverage of or lower reimbursement for the diagnostic tests associated with the use of our products. The

cost containment measures that payors and providers are instituting and the effect of any healthcare

reform initiative implemented in the future could impact our revenue from the sale of our products.

We expect additional state and federal healthcare policies and reform measures to be adopted in the

future, particularly in light of the recent administration changes in the White House and Congress, any of

which could limit reimbursement for healthcare products and services or otherwise result in reduced

demand for our products or additional pricing pressure and have a material adverse effect on our industry

generally and on our customers. We cannot predict what other healthcare programs and regulations will

ultimately be implemented at the federal or state level or whether any future legislation or regulation in the

United States may negatively affect our business, financial condition, results of operations and prospects.

The continuing efforts of the government, insurance companies, managed care organizations and other

payors of healthcare services to contain or reduce costs of healthcare may adversely affect our ability to

set a price that we believe is fair for our products, our ability to generate revenue and achieve or maintain

profitability and the availability of capital.

Any changes of, or uncertainty with respect to, future coverage or reimbursement rates could affect

demand for our products, which may prevent us from being able to generate additional revenue or attain

profitability.

We are subject to many laws and governmental regulations affecting our marketed products, both

domestically and internationally, and any adverse regulatory action may adversely affect our

The Heartflow Platform is subject to regulation by numerous government authorities, including the FDA

and comparable foreign authorities, after clearance or approval of current and future versions of the

product. To varying degrees, each of these authorities requires us to comply with laws and regulations

governing the development, design, testing, manufacture, labeling, advertising, promotion, distribution,

import and export of our products. The Heartflow Platform (also referred to as Heartflow Analysis, which

consists of four main functions, the Heartflow FFRCT Analysis, the Heartflow Plaque Analysis, the

Heartflow RoadMap Analysis and the Heartflow PCI Planner (which we expect to launch in 2026)) has

been cleared by the FDA (K213857), and only the Heartflow FFRCT Analysis function of the Heartflow

Platform is Conformité Européene Marked (“CE Marked”) in the European Economic Area, the United

Kingdom and Australia, received medical device licensing in Canada and has been approved for

marketing authorization in Japan by the Pharmaceuticals and Medical Devices Agency (“PMDA”), all for

specific indications for use. The Heartflow Platform has also been cleared by the equivalent regulatory

authorities in Israel, Saudi Arabia and United Arab Emirates and licensed in Bahrain.

We currently have ongoing responsibilities under U.S., U.K., European Economic Area, Switzerland,

Canada, Australia, Japan, Saudi Arabia, United Arab Emirates, Bahrain and Israel (registered or licensed

regions) regulations, including requirements related to product and facility registration, device listing,

adverse event reporting, reporting of recalls and field corrective actions, manufacturing, advertising,

promotion, distribution, import, and export. In certain jurisdictions outside of the United States, we

contract with third parties (i.e., notified bodies, authorized representatives, and manufacturing

authorization holders) who either oversee regulatory compliance or assume regulatory responsibilities for

our products distributed by those third parties. We are subject to periodic inspections and audits by the

FDA, notified bodies, authorized representatives and comparable foreign authorities to determine

compliance with regulatory requirements, including good manufacturing practices such as the Quality

System Regulation of the FDA, Medical Device Single Audit Program, ISO 13485:2016, and EN ISO

13485:2021 concerning the EU, establishment registration and device listing, medical device reporting,

vigilance reporting of adverse events, notification of corrections, recalls, field safety corrective actions and

product labeling and marketing. These inspections and audits can result in inspectional observations or

reports, warning letters or other forms of enforcement action. If the FDA or comparable foreign authorities

conclude, as a result of these inspections or audits or from any other source of information, that we are

not in compliance with applicable laws or regulations, or that our products are ineffective or pose an

unreasonable health risk, such authorities could ban these products, suspend or cancel our marketing

authorizations, impose “stop sale” and “stop import” orders, refuse to issue export certificates, detain or

seize adulterated or misbranded products, order a recall, repair, replacement, correction or refund of such

products, require us to conduct post-market surveillance studies or change the labeling for our products,

or require us to notify health professionals and others that the products present unreasonable risks of

substantial harm to the public health. Failure to comply with regulatory requirements may also subject us

to additional administrative and judicially imposed sanctions, warning letters, civil and criminal penalties,

injunctions, interruption of manufacturing or clinical trials, total or partial suspension of production and

resulting adverse publicity.

Discovery of previously unknown problems with our products’ design or manufacture may result in

restrictions on the use of the Heartflow Platform, restrictions placed on us or our suppliers or withdrawal

of the existing regulatory clearance of the Heartflow Platform. The FDA or comparable foreign authorities

may also impose operating restrictions, enjoin and restrain violations of applicable law pertaining to

medical devices, assess civil or criminal penalties against our officers, employees or us or recommend

criminal prosecution of our company. Adverse regulatory action of a certain magnitude may restrict us

from effectively marketing and selling our products. In addition, negative publicity or product liability

claims resulting from any adverse regulatory action could have an adverse effect on our business,

In many of the foreign countries in which we market our products, we are subject to extensive medical

device regulations that are similar to those of the FDA, including those in Europe. The regulation of our

products in Europe falls within the European Economic Area, which consists of the 27 member states of

the European Union, as well as Iceland, Liechtenstein and Norway. Only medical devices that comply with

certain conformity requirements of the Medical Devices Regulation (E.U.) 2017/745 concerning Medical

Devices, or the E.U. Medical Devices Directive, Directive 2006/114/EC are allowed to be marketed within

the European Economic Area.

Foreign governmental regulations have become increasingly stringent and more extensive, and we may

become subject to even more rigorous regulation by foreign governmental authorities in the future.

Penalties for a company’s noncompliance with foreign governmental regulation could be severe, including

revocation or suspension of a company’s business license and civil or criminal sanctions. In some

jurisdictions, such as Germany, any violation of a law related to medical devices is also considered to be

a violation of unfair competition law. In such cases, governmental authorities, our competitors and

business or consumer associations may then file lawsuits to prohibit us from commercializing the

Heartflow Platform in such jurisdictions. Our competitors may also sue us for damages. Any domestic or

foreign governmental law or regulation imposed in the future may have an adverse effect on our business,

Delays in the commencement or completion of future or ongoing clinical testing could result in

increased costs to us and delay our ability to market the Heartflow Platform for additional

indications.

We recently completed enrolling patients for our DECIDE clinical trial to evaluate our Heartflow Plaque

Analysis in a real-world setting. We do not know whether our DECIDE clinical trial will be completed on

schedule, or at all. The commencement or completion of clinical trials can be disrupted for a variety of

reasons, including difficulties in:

•recruiting and enrolling patients to participate in, and investigators to conduct, a clinical trial;

•reaching agreements on acceptable terms with prospective clinical research organizations and trial

sites;

•obtaining approval of an investigational device exemption, application from the FDA or equivalent

authorization from foreign regulatory authorities, if required; or

•obtaining IRB approval to conduct a clinical trial at a prospective site.

A clinical trial may also be suspended or terminated by us, an IRB, the FDA or other regulatory authorities

due to a number of factors, including:

•failure to conduct the clinical trial in accordance with regulatory requirements or in accordance with

our clinical protocols;

•inspection of the clinical trial operations or trial site by the FDA or other regulatory authorities resulting

in the imposition of a clinical hold;

•safety or effectiveness issues; or

•lack of adequate funding to continue the clinical trial.

In addition, changes in regulatory requirements and guidance may occur, and we may need to amend

clinical trial protocols to respond to such changes, which could impact the cost, timing or successful

completion of a clinical trial. If we experience delays in the commencement or completion of our clinical

trials, the commercial prospects for additional indications for our products will be harmed.

Interim, “top-line” and preliminary data from our clinical trials that we announce or publish from

time to time may change as more patient data become available and are subject to audit and

verification procedures that could result in material changes in the final data.

From time to time, we may publicly disclose interim, top-line or preliminary data from our clinical trials,

including our DECIDE clinical trial, which is based on a preliminary analysis of then-available data, and

the results and related findings and conclusions are subject to change following a more comprehensive

review of the data related to the particular trial or additional data collected at a later time. We also make

assumptions, estimations, calculations and conclusions as part of our analyses of data, and we may not

have received or had the opportunity to fully and carefully evaluate all data. As a result, the interim, top-

line or preliminary results that we report may differ from future results of the same trial, or different

conclusions or considerations may qualify such results, once additional data have been received and fully

evaluated. Interim, top-line or preliminary data also remain subject to audit and verification procedures

that may result in the final data being materially different from the interim, top-line or preliminary data we

previously announced. As a result, interim, top-line and preliminary data should be viewed with caution

until the final data are available. Adverse differences between interim data and final data could

significantly harm our business prospects. Further, disclosure of interim data by us or by our competitors

could result in volatility in our share price.

Further, others, including the FDA and other regulatory authorities or other bodies, may not accept or

agree with our assumptions, estimates, calculations, conclusions or analyses or may interpret or weigh

the importance of data differently, which could impact the value of the particular trial, or the approvability

or potential for commercialization of the particular medical device. In addition, the information we choose

to publicly disclose regarding a particular study or clinical trial is based on what is typically extensive

information, and others may not agree with what we determine is material or otherwise appropriate

information to include in our disclosure. The interim, top-line or preliminary data that we report may differ

from final results, and regulatory authorities and other bodies may disagree with the conclusions reached,

which may harm our ability to obtain marketing authorization for, and commercialize, our future products,

which could harm our business, financial condition, results of operations and prospects.

We may face product liability claims that could result in costly litigation and significant liabilities.

We may not be able to maintain adequate product liability insurance.

Development, marketing and clinical testing of our products may expose us to product liability and other

tort claims. Although we have, and intend to maintain, liability insurance, the coverage limits of our

insurance policies may not be adequate and one or more successful claims brought against us may have

an adverse effect on our business, financial condition, results of operations and prospects. For example,

the U.S. Supreme Court declined to hear an appeal where the U.S. Court of Appeals for the Ninth Circuit

ruled that the 1976 Medical Device Amendments to the Federal Food, Drug and Cosmetic Act did not

preempt state laws in a product liability case involving a medical device company. If other courts in the

United States adopt similar rulings, we may be subject to increased litigation risk in connection with our

products. Product liability claims could negatively affect our reputation, product sales, and our ability to

obtain and maintain regulatory approval for our products.

In addition, although we have product liability and clinical study liability insurance, this insurance is

subject to deductibles and coverage limitations. Our current product liability insurance may not continue to

be available to us on acceptable terms, if at all, and, if available, coverage may not be adequate to protect

us against any future product liability claims. If we are unable to obtain insurance at an acceptable cost,

on acceptable terms with adequate coverage, or at all, or otherwise protect against potential product

liability claims, we will be exposed to significant liabilities, which may harm our business. A product liability

claim, recall or other claim with respect to uninsured liabilities or for amounts in excess of insured

liabilities could have an adverse effect on our reputation, business, financial condition, results of

operations and prospects.

The Heartflow Platform may be subject to recalls, which could be costly and could harm our

reputation and business.

We are subject to ongoing medical device reporting regulations that require us to report to the FDA or

similar governmental authorities in other countries if our products cause, or contribute to, death or serious

injury, or if they malfunction and would be likely to cause, or contribute to, death or serious injury if the

malfunction were to recur. We could voluntarily elect to, or the FDA and similar governmental authorities

in other countries could require us to, perform a correction, field safety corrective action, removal or other

recall of our products in the event of material deficiencies or defects in design, manufacturing or labeling

that could cause harm. Our products have been in the past, and may in the future, be the subject of

medical device reports of adverse events with the MAUDE database, including reports of false negative

results and incorrect or imprecise results or readings. Between 2017 and October 31, 2025, 132

Heartflow Platform MAUDE reports were made, with 109 of those reports due to false negative results, 20

reports due to incorrect, inadequate or imprecise results or readings, and three reports due to an adverse

event without an identified device or use problem. While none of these MAUDE reports resulted in a

mandated or voluntary correction, field safety action, removal ora recall, a government mandated or

voluntary correction, field safety corrective action, removal or other recall could occur as a result of

manufacturing errors or design defects, including defects in labeling. Any correction, field safety corrective

action, removal or other recall would divert managerial and financial resources and could lead to a

substantial loss of physician and patient confidence in our products and, consequently, have an adverse

effect on our growth prospects or operating results. A correction, field safety corrective action, removal or

other recall could also result in substantial litigation, including product liability claims, with liabilities well in

excess of our insurance coverage limits. Any of these events could have an adverse effect on our

reputation, business, financial condition, results of operations and prospects.

Off-label or other unlawful promotion of our products could result in costly investigations and

sanctions from the FDA and other regulatory bodies.

The Heartflow Platform (also referred to as Heartflow Analysis, which consists of four main functions, the

Heartflow FFRCT Analysis, the Heartflow Plaque Analysis, the Heartflow RoadMap Analysis and the

Heartflow PCI Planner (which we expect to launch in 2026)) has been cleared by the FDA (K213857), and

only the Heartflow FFRCT Analysis function of the Heartflow Platform is CE Marked in the European

Economic Area, the United Kingdom and Australia, received medical device licensing in Canada and has

been approved for marketing authorization in Japan by the PMDA, all for specific indications for use. The

Heartflow Platform has also been cleared by the equivalent regulatory authorities in Israel, Saudi Arabia

and United Arab Emirates and licensed in Bahrain. We may only promote or market our products for their

specifically cleared or approved indications. We train our marketing and sales force against promoting our

products for uses outside of the cleared or approved indications for use (“off-label use”).

If the FDA determines that our promotional materials or training constitute promotion of an off-label use,

or if there are claims that are not adequately substantiated or that are otherwise false or misleading, it

could request that we modify our training or promotional materials or subject us to regulatory or

enforcement actions, including the issuance of an untitled letter, a warning letter, injunction, seizure, civil

fine or criminal penalties. It is also possible that other federal, state or foreign enforcement authorities,

including the Federal Trade Commission or Department of Justice, might take action if they consider our

business activities to constitute promotion of an off-label use or other unlawful promotion, which could

result in significant penalties, including criminal, civil and administrative penalties, damages, fines,

disgorgement, exclusion from participation in government healthcare programs and the curtailment of our

operations. Any of these events could significantly harm our business, results of operations, financial

condition and prospects.

Further, the advertising and promotion of our products are subject to European Economic Area Member

States laws implementing the Medical Devices Directive concerning misleading and comparative

advertising, and Directive 2005/29/EC on unfair commercial practices, as well as other European

Economic Area Member State legislation governing the advertising and promotion of medical devices.

European Economic Area Member State legislation may also restrict or impose limitations on our ability to

advertise our products directly to the general public. In addition, voluntary E.U. and national codes of

conduct provide guidelines on the advertising and promotion of our products to the general public and

may impose limitations on our promotional activities with healthcare professionals harming our business,

We are subject to numerous federal, state and foreign healthcare fraud and abuse, compliance,

transparency and privacy laws and regulations, and a failure to comply with such laws and

regulations could have an adverse effect on our business; similarly, an investigation, inquiry or

audit by a government agency that alleges violations of law or regulation may have an adverse

effect on our business.

Our operations are, and will continue to be, directly and indirectly affected by various federal, state and/or

foreign healthcare laws, including those described below. In particular, because the use of our products

are directly or indirectly reimbursed by U.S. federal health care programs, for example Medicare, we are

subject to the federal Anti-Kickback Statute, a criminal law that prohibits, among other things, any person

or entity from knowingly and willfully offering, paying, soliciting or receiving any remuneration in cash or

in-kind (including any kickback or bribe, but also common forms of remuneration, such as service or

consulting fees, service fees, meals, travel expenses, discounts or rebates), directly or indirectly, overtly

or covertly, in cash or in-kind, in return for or to induce the referring, ordering, leasing, purchasing or

arranging for or recommending the referring, ordering, purchasing or leasing of any good, facility, item or

service, for which payment may be made, in whole or in part, under federal healthcare programs, such as

the Medicare and Medicaid programs. The term “remuneration” has been broadly interpreted to include

anything of value. Although there are a number of statutory exceptions and regulatory safe harbors

protecting certain common activities, the exceptions and safe harbors are drawn narrowly. Failure to meet

all of the requirements of a statutory exception or regulatory safe harbor does not make the conduct per

se illegal under the Anti-Kickback Statute. Instead, the arrangement will be evaluated on a case-by-case

basis based on a cumulative review of all of its facts and circumstances. Several courts have interpreted

the statute’s intent requirement to mean that if any one purpose of an arrangement involving

remuneration is to induce referrals of (or purchases, uses or recommendations of prescriptions, uses or

purchases related to) federal healthcare program covered business, the Anti-Kickback Statute has been

implicated and potentially violated. Our practices may not in all cases meet all of the criteria for safe

harbor protection from Anti-Kickback Statute liability. Further, the ACA, amends the intent requirement of

the federal Anti-Kickback Statute and certain criminal healthcare fraud statutes. A person or entity no

longer needs to have actual knowledge of the statute or specific intent to violate it. In addition, the

government may assert that a claim for payment by a government health care program including items or

services resulting from a violation of the Anti-Kickback Statute constitutes a false or fraudulent claim for

purposes of the false claims laws.

The U.S. civil False Claims Act prohibits, among other things, any person or entity from knowingly

presenting, or causing to be presented, a false or fraudulent claim for payment or approval to the federal

government or knowingly making, using, or causing to be made or used a false record or statement

material to a false or fraudulent claim to the federal government. A claim includes “any request or

demand” for money or property presented to the U.S. government. The civil False Claims Act also applies

to false submissions that cause the government to not receive a benefit to which it is entitled, such as a

discounted sales price for products covered by federal healthcare programs. Intent to deceive is not

required to establish liability under the civil False Claims Act. In addition, the civil False Claims Act

includes a whistleblower provision that allows private citizens to bring claims on behalf of the U.S.

government alleging violations of the law. Whistleblowers may be entitled to up to as much as thirty

percent (30%) of the government’s financial recovery resulting from such claims. This incentivizes

potential whistleblowers to file complaints in federal court, which complaints are relied upon heavily by the

government to investigate and prosecute allegations of violations of both the civil False Claims Act and

the Anti-Kickback Statute. U.S. enforcement authorities or private whistleblowers acting on behalf of the

U.S. government may file complaints under the civil False Claims Act alleging that we have caused one or

more of our customers to submit false submissions for reimbursement from federal health care programs,

including Medicare, Medicaid, or the Veterans Affairs program due to alleged kickbacks, the sale of

adulterated or misbranded products, or the provision of false or misleading information to our customers

or other third parties. For example, in October 2025, we and certain of our employees received civil

investigative demands (the “CID”) from the U.S. Department of Justice, Civil Division, in connection with

an investigation under the federal Anti-Kickback Statute and Civil False Claims Act (the “Investigation”).

The CID requests information, documents, and testimony focused on our financial and contractual

arrangements with providers and our sales and marketing activities. We are cooperating with the

Investigation. We are unable to express a view at this time regarding the likely duration, or ultimate

outcome, of the Investigation. Depending on the outcome of the Investigation, there may be a material

impact on our business, results of operations, financial condition, or cash flows.

Additionally, under the federal Civil Money Penalty Statute, the Department of Health and Human

Services (“HHS”) may impose civil money penalties against entities that make offers to transfer or transfer

remuneration, including gifts, payments or routine waivers of co-payments or deductibles, to any

Medicare beneficiary in order to influence such individual to order or receive any item or service for which

payment may be made, in whole or in part, under Medicare and/or a State health care program. The

federal Civil Money Penalty Statute also creates potential civil liability, with a lower threshold for violation,

of the same types of activities that would violate the criminal Anti-Kickback Statute.

Violations of these laws and regulations may result in significant criminal and/or civil fines and penalties,

as well as potential exclusion from participation in federal health care programs, that could significantly

impact our business and operations.

We are also subject to other federal and state fraud and abuse laws, including HIPAA’s fraud provisions,

which among other things, are criminal laws that prohibit, among other actions, knowingly and willfully

executing, or attempting to execute, a scheme or artifice to defraud any healthcare benefit program,

including private payors, knowingly and willfully embezzling or stealing from a healthcare benefit program,

willfully preventing, obstructing, misleading, delaying or attempting to delay a criminal investigation of a

healthcare offense and knowingly and willfully falsifying, concealing or covering up a material fact or

making any materially false, fictitious or fraudulent statement or representation in connection with the

delivery of or payment for healthcare benefits, items or services. Many of these state laws closely mirror

the federal Anti-Kickback Statute or civil False Claims Act but apply more broadly to products and

services that are paid for in any way, whereas the federal law pertains only to those reimbursed by federal

health care programs. In addition, many states have also adopted laws prohibiting fee-splitting (the

sharing of professional fees with non-state licensed persons or entities), restricting marketing activities

with physicians and/or prohibiting the practice of medicine (or the direction of the practice of medicine) by

corporations or others that are not specifically licensed to practice medicine within the state. While under

our model, licensed practitioners independently are providing any and all medical treatment and

diagnostic services for which a state license is required, these state laws still may apply to us.

We also are subject to foreign fraud and abuse laws and regulations, which vary by country, and can

prohibit many of the same activities addressed by U.S. laws.

We are also subject to the federal and state transparency reporting laws and regulations, gift bans and

compliance reporting provisions. The Physician Payments Sunshine Act (also known as Open Payments)

requires manufacturers of drugs, devices, biologics and medical supplies for which payment is available

under Medicare, Medicaid or the State Children’s Health Insurance Program to report annually to the

Centers for Medicare and Medicaid Services information related to payments and other transfers of value

provided directly or indirectly to physicians (defined to include doctors, dentists, optometrists, podiatrists

and chiropractors), other healthcare providers (such as physician assistants and nurse practitioners) and

teaching hospitals. Such manufacturers are also required to annually report certain ownership and

investment interests held by such U.S. physicians and their immediate family members. Certain states,

like Massachusetts and Vermont, have similar reporting requirements. Some states, like Vermont, prohibit

gifts and certain benefits from being provided to physicians licensed within that state. Other states, such

as California and Nevada, mandate implementation of compliance programs to ensure compliance with

fraud and abuse laws and regulations, as well as with industry codes of conduct, such as the AdvaMed

Code of Ethics on Interactions with Health Care Professionals. Our business is subject to these many

requirements, which can be nuanced and lacking in clear guidance. Our failure to comply with these laws

or regulations could result in substantial fines or penalties. Further, our reports made pursuant to these

laws may be used by enforcement authorities or whistleblowers to raise or substantiate allegations

against us.

We are also subject to the federal physician self-referral prohibitions, commonly known as the Stark Law,

which prohibits, among other things, physicians who have a financial relationship, including an

investment, ownership or compensation relationship with an entity that submits claims for payment to the

Medicare or Medicaid programs, from referring Medicare or Medicaid patients for certain “designated

health services,” which include diagnostic imaging services related to our products, unless an exception

applies. Similarly, entities may not bill Medicare or any other party for services furnished pursuant to a

prohibited referral. Many states have their own self-referral laws as well, which in some cases apply to all

payors, not just Medicare and Medicaid.

If our operations are found to be in violation of any of the laws described above or any other

governmental regulations that apply to us now or in the future, we may be subject to significant penalties,

including civil and criminal penalties, damages, fines, disgorgement, exclusion from governmental

healthcare programs and the curtailment or restructuring of our operations, any of which could adversely

affect our ability to operate our business and our financial results.

We also note that there is risk of our being found in violation of these laws by the fact that many of them

have not been fully, clearly or consistently interpreted by the regulatory authorities or the courts, and their

provisions are open to a variety of interpretations. Any action against us for violation of these laws, even if

we successfully defend against it, could cause us to incur significant legal expenses and divert our

management’s attention from the operation of our business. Moreover, to achieve compliance with

applicable federal and state privacy, security and electronic transaction laws, we may be required to

modify our operations with respect to the handling of patient information. Similarly, to achieve compliance

with other applicable federal and state anti-fraud, open payments or other healthcare regulations, we may

be required to modify our operations. Implementing any of these modifications may prove costly. At this

time, we are not able to determine the full consequences to us, including the total cost of compliance, of

these various federal and state laws.

We are subject to U.S. and foreign anti-corruption and anti-money laundering laws with respect to

our operations and non-compliance with such laws can subject us to criminal and/or civil liability

and harm our business.

We are subject to the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the

U.S. Travel Act, the USA PATRIOT Act, the U.K. Bribery Act of 2010 and Proceeds of Crime Act 2002 and

possibly other state and national anti-bribery and anti-money laundering laws in countries in which we

conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies and their

employees and third-party intermediaries from authorizing, promising, offering or providing, directly or

indirectly, improper payments or benefits to recipients in the public or private sector. We use third-party

representatives to support sales of our products abroad. In addition, as we increase our international

sales and business, we may engage with additional business partners and third-party intermediaries to

sell our products abroad and to obtain necessary permits, licenses and other regulatory approvals. We or

our third-party intermediaries may have direct or indirect interactions with officials and employees of

government agencies or state owned or affiliated entities. We can be held liable for the corrupt or other

illegal activities of these third-party intermediaries, our employees, representatives, contractors, partners

and agents, even if we do not explicitly authorize or have actual knowledge of such activities.

Noncompliance with anti-corruption and anti-money laundering laws could subject us to whistleblower

complaints, investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement

of profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension or

debarment from contracting with certain persons, the loss of export privileges, reputational harm, adverse

media coverage and other collateral consequences. If any subpoenas or investigations are launched, or

governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal

litigation, our business, results of operations and financial condition could be materially harmed. In

addition, responding to any action will likely result in a materially significant diversion of management’s

attention and resources and significant defense and compliance costs and other professional fees. In

certain cases, enforcement authorities may even cause us to appoint an independent compliance monitor,

which can result in added costs and administrative burdens. As a general matter, enforcement actions

and sanctions could harm our business, financial condition, results of operations and prospects.

We are subject to governmental export and import controls that could impair our ability to

compete in international markets due to licensing requirements and subject us to liability if we are

not in compliance with applicable laws.

Our products are subject to export control and import laws and regulations, including the U.S. Export

Administration Regulations, U.S. Customs regulations and various economic and trade sanctions

regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Control. Exports of

our products must be made in compliance with these laws and regulations. If we fail to comply with these

laws and regulations, we and certain of our employees could be subject to substantial civil or criminal

penalties, including: the possible loss of export or import privileges; fines, which may be imposed on us

and responsible employees or managers; and, in extreme cases, the incarceration of responsible

employees or managers. Obtaining the necessary authorizations, including any required license, for a

particular sale may be time consuming, is not guaranteed and may result in the delay or loss of sales

opportunities. In addition, changes in our products or changes in applicable export or import regulations

may create delays in the introduction and sale of our products in international markets, prevent our

customers with international operations from deploying our products or, in some cases, prevent the export

or import of our products to certain countries, governments or persons altogether. Any change in export or

import regulations, shift in the enforcement or scope of existing regulations or change in the countries,

governments, persons or technologies targeted by such regulations, could also result in decreased use of

our products, or in our decreased ability to export or sell our products to existing or potential customers

with international operations. Any decreased use of our products or limitation on our ability to export or

sell our products would likely adversely affect our business.

Furthermore, we incorporate encryption technology into certain of our products. Various countries

regulate the import of certain encryption technology, including through import permitting and licensing

requirements, and have enacted laws that could limit our ability to distribute our products or could limit our

customers’ ability to implement our products in those countries. Encrypted products and the underlying

technology may also be subject to export control restrictions. Governmental regulation of encryption

technology and regulation of imports or exports of encryption products, or our failure to obtain required

import or export approval for our products, when applicable, could harm our international sales and

adversely affect our revenue. Compliance with applicable regulatory requirements regarding the export of

our products, including with respect to new releases of our products, may create delays in the introduction

of our products in international markets, prevent our customers with international operations from

deploying our products throughout their globally distributed systems or, in some cases, prevent the export

of our products to some countries altogether.

Moreover, U.S. export control laws and economic sanctions programs prohibit the shipment of certain

products and services to countries, governments and persons that are subject to U.S. economic

embargoes and trade sanctions. Any violations of such economic embargoes and trade sanction

regulations could have negative consequences, including government investigations, penalties and

reputational harm.

Any future litigation against us could be costly and time-consuming to defend.

We have been in the past, and we may become in the future, subject to legal proceedings and claims that

arise in the ordinary course of business, such as claims brought by our third-party vendors, our customers

or their patients in connection with contractual disputes or the use of our Heartflow Platform, claims

brought by us or by competitors related to intellectual property or employment claims made by our current

or former employees. Litigation might result in substantial costs and may divert management’s attention

and resources, which might seriously harm our business, financial condition, results of operations and

prospects. Insurance might not cover such claims, might not provide sufficient payments to cover all the

costs to resolve one or more such claims, and might not continue to be available at all or on terms

acceptable to us (including premium increases or the imposition of large deductible or co-insurance

requirements). A claim brought against us that is uninsured or underinsured could result in unanticipated

costs, potentially harming our business, financial condition, results of operations and prospects. In

addition, we cannot be sure that our existing insurance coverage will continue to be available on

acceptable terms or at all or that our insurers will not deny coverage as to any future claim.

Risks Related to our Intellectual Property

If we are unable to obtain and maintain sufficient intellectual property rights, or the scope of our

rights is not sufficiently broad, third parties could develop and commercialize technology and

products similar or identical to ours, and our ability to successfully commercialize our technology

and products may be adversely affected.

Our commercial success will depend, in part, on our ability to continue obtaining and maintaining

intellectual property protection for our technology and products, in both the United States and certain

other countries, successfully defending this intellectual property against third-party challenges and

successfully enforcing this intellectual property to prevent third-party infringement. We rely upon a

combination of patents, trade secrets, know-how, copyrights, trademarks, license agreements and

contractual provisions to establish our intellectual property rights and protect our products.

Our ability to protect our technologies and products from unauthorized or infringing use by third parties

depends in substantial part on our ability to obtain and maintain valid and enforceable patents in both the

United States and certain other countries. The patent positions of medical technology and software

companies can be highly uncertain and involve complex legal, scientific and factual questions for which

important legal principles remain unresolved. In addition, the patent prosecution process is expensive,

time-consuming and complex, and we may not be able to file, prosecute, maintain, enforce, defend or

license all necessary or desirable patents or patent applications at a reasonable cost or in a timely

manner, or in all jurisdictions.

We cannot guarantee that any patents will issue from any pending or future patent applications owned by

or licensed to us, or if issued, the breadth of such patent coverage. In particular, during prosecution of any

patent application, the issuance of any patents based on the application may depend upon our ability to

generate additional preclinical or clinical data that support the patentability of our proposed claims. We

may not be able to generate sufficient additional data on a timely basis, or at all. It is also possible that we

may fail to identify patentable aspects of inventions made in the course of our development and

commercial activities before it is too late to obtain patent protection on such inventions. If we fail to timely

file for patent protection in any jurisdiction, we may be precluded from doing so at a later date.

The issuance of a patent is not conclusive as to its inventorship, ownership, scope, validity, or

enforceability, and our owned or licensed patents may be challenged in the courts or the patent offices of

the United States or abroad. Such challenges may result in a loss of exclusivity or in the patent’s claims

being narrowed, invalidated or held unenforceable, in whole or in part, which could limit our ability to stop

third parties from using or commercializing similar or identical products, or limit the duration of patent

protection for our technology and products. In addition, changes in either the patent laws, implementing

regulations or interpretations of patent laws in the United States or foreign countries may diminish the

value of our patent rights.

Even if unchallenged, our owned or licensed patents may not provide us with exclusivity or commercial

value for our products, or any significant protection against competitive products, or prevent others from

designing around our claims. Our competitors might conduct research and development activities in

countries where we do not have patent rights (or in those countries where we do, under safe harbor

provisions) and then use the information learned from such activities to develop competitive products for

sale in our major commercial markets. Further, if we encounter delays in regulatory approvals, the period

of time during which we could market our products under patent protection could be reduced. Any of

these outcomes could impair our ability to prevent competition from third parties, which may have an

adverse impact on our business.

Patent applications are generally maintained in confidence until publication. In the United States, for

example, patent applications are maintained in secrecy for up to 18 months after their filing.

Nonpublication requests may allow a United States patent application to go unpublished until issuance.

Similarly, publication of discoveries in scientific or patent literature often lag behind actual discoveries.

Consequently, we cannot be certain that we or our licensors were the first to invent, or the first to file

patent applications on our products. There is also no assurance that all of the potentially relevant prior art

relating to our patents and patent applications has been found, which could be used by a third party to

challenge the validity of our patents or prevent a patent from issuing from a pending patent application.

In addition to patents, proprietary trade secrets and unpatented know-how are important to our business.

For information about risks related to these intellectual property rights, see the risk factor titled “If we are

unable to protect the disclosure and use of our confidential information and trade secrets, the value of our

products and technologies and our business and competitive position could be harmed” below. We also

rely on the trademarks we own to distinguish our products from the products of our competitors. We

cannot guarantee that any trademark applications filed by us will be approved. Third parties may also

oppose or attempt to cancel our trademark applications or trademarks, or otherwise challenge our use of

the trademarks. In the event that the trademarks we use are successfully challenged, we could be forced

to rebrand our products, which could result in loss of brand recognition, and could require us to devote

resources to advertising and marketing new brands. Competitors or other parties may adopt trade names

or trademarks similar to ours, thereby impeding our ability to build brand identity and possibly leading to

market confusion.

Further, we cannot provide assurance that competitors will not infringe the trademarks we use, or that we

will have adequate resources to enforce these trademarks. If we attempt to enforce our trademarks and

assert trademark infringement claims, a court may determine that the marks we have asserted are invalid

or unenforceable, or that the party against whom we have asserted trademark infringement has superior

rights to the marks in question. In this case, we could ultimately be forced to cease use of such

trademarks. We may license our trademarks and trade names to third parties, such as distributors.

Though these license agreements may provide guidelines for how our trademarks and trade names may

be used, a breach of these agreements or misuse of our trademarks and trade names by our licensees

may jeopardize our rights in or diminish the goodwill associated with our trademarks and trade names.

Over the long term, if we are unable to establish name recognition based on our trademarks and trade

names, then we may not be able to compete effectively and our business may be adversely affected.

For information about risks related to our inability to protect our intellectual property rights outside the

United States, see the risk factor titled “We may not be able to adequately protect our intellectual property

rights throughout the world” below.

If we are unable to protect the disclosure and use of our confidential information and trade

secrets, the value of our products and technologies and our business and competitive position

could be harmed.

In addition to patent protection, we also rely on other intellectual property rights, including trade secrets,

know-how, and/or other proprietary information that is not patentable or that we elect not to patent.

However, trade secrets can be difficult to protect, and some courts are less willing or unwilling to protect

trade secrets. Although we have taken steps to protect our trade secrets and unpatented know-how,

including by entering into confidentiality agreements with third parties, and proprietary information and

invention agreements with our employees, consultants and advisors, third parties may still obtain this

information or we may be unable to protect our rights. There can be no assurance that binding

agreements will not be breached, that we would have adequate remedies for any breach, or that our trade

secrets and unpatented know-how will not otherwise become known or be independently discovered by

our competitors. We also seek to preserve the integrity and confidentiality of our data and trade secrets

by maintaining physical security of our premises and physical and electronic security of our information

technology systems. While we have confidence in these individuals, organizations and systems, our

security measures may be breached, and we may not have adequate remedies for any such breach.

If any of our trade secrets were to be lawfully obtained or independently developed by a competitor, we

would have no right to prevent them, or those to whom they communicate it, from using that information to

compete with us. Any exposure of our trade secrets and other proprietary information would impair our

competitive advantages and could have a material adverse effect on our business, financial condition,

results of operations and prospects. In particular, a failure to protect our proprietary rights may allow

competitors to copy our products or technologies, which could adversely affect our pricing and market

share. Unauthorized parties may also attempt to copy or reverse engineer certain aspects of our products

or technologies that we consider proprietary.

Costly and time-consuming litigation could be necessary to enforce and determine the scope of our trade

secret rights and related confidentiality, non-disclosure and non-use provisions, and outcomes of such

litigation are unpredictable. Enforcing a claim that a party illegally disclosed, used or misappropriated a

trade secret can be difficult, expensive and time-consuming, and the outcome is unpredictable. While we

use commonly accepted security measures, trade secret claims are often based on a combination of

federal and state law in the United States, and the criteria for protection of trade secrets can vary among

different jurisdictions. If the steps we have taken to maintain our trade secrets are deemed inadequate,

we may have insufficient recourse against third parties for misappropriating the trade secret. In addition,

agreement terms that address non-competition are difficult to enforce in many jurisdictions and might not

be enforceable in certain cases. Even if we were to be successful in the enforcement of our claims, we

may not be able to obtain adequate remedies.

Reliance on third parties requires us to share our trade secrets, which increases the possibility

that a competitor will discover them or that our trade secrets will be misappropriated or disclosed

to others.

Any collaboration or other engagement with third parties for the development of our products may require

us, at times, to share trade secrets with them. We may also conduct joint research and development

programs that may require us to share trade secrets under the terms of our research and development

partnerships or similar agreements. We seek to protect our trade secrets and other proprietary technology

in part by entering into confidentiality agreements with third parties prior to beginning research or

disclosing proprietary information. These agreements typically limit the rights of the third parties to use or

disclose our confidential information, including our trade secrets. Despite the contractual provisions

employed when working with third parties, the need to share trade secrets and other confidential

information increases the risk that such trade secrets become known by our competitors, are

inadvertently incorporated into the technology of others, or are disclosed or used in violation of these

agreements. Given that our proprietary Heartflow Platform is based, in part, on our know-how and trade

secrets, a competitor’s discovery of our trade secrets or other unauthorized use or disclosure could have

an adverse effect on our business, financial condition, results of operations and prospects.

In addition, these agreements typically restrict the ability of our advisors, employees, third-party

contractors and consultants to publish data potentially relating to our trade secrets. Despite our efforts to

protect our trade secrets, we may not be able to prevent the unauthorized disclosure or use of our

technical know-how or other trade secrets by the parties to these agreements. Moreover, we cannot

guarantee that we have entered into such agreements with each party that may have or have had access

to our confidential information or proprietary technology and processes. Monitoring unauthorized uses

and disclosures is difficult, and we do not know whether the steps we have taken to protect our

proprietary technologies will be effective. If any of the collaborators, scientific advisors, employees,

contractors and consultants who are parties to these agreements breaches or violates the terms of any of

these agreements, we may not have adequate remedies for any such breach or violation, and we could

lose our trade secrets as a result. Moreover, if confidential information that is licensed or disclosed to us

by our partners, collaborators, or others is inadvertently disclosed or subject to a breach or violation, we

may be exposed to liability to the owner of that confidential information. Enforcing a claim that a third

party illegally obtained and is using our trade secrets, like patent litigation, is expensive and time

consuming, and the outcome is unpredictable. In addition, courts outside the United States are

sometimes less willing to protect trade secrets, and we may need to share our trade secrets and

proprietary know-how with current or future partners, collaborators, contractors and others located in

countries at heightened risk of theft of trade secrets, including through direct intrusion by private parties or

foreign actors, and those affiliated with or controlled by state actors.

Obtaining and maintaining our patent protection depends on compliance with various procedural,

document submission, fee payment and other requirements imposed by governmental patent

agencies, and our patent protection could be reduced or eliminated for noncompliance with these

requirements.

The U.S. Patent and Trademark Office (“USPTO”) and various foreign governmental patent agencies

require compliance with a number of procedural, documentary, fee payment and other similar provisions

during the patent application process. In addition, periodic maintenance fees, renewal fees, annuity fees,

and various other government fees on patents and/or applications will be due to be paid to the USPTO

and various governmental patent agencies outside of the United States over the lifetime of our patents

and/or applications and any patent rights we may obtain in the future. We have systems in place to

remind us to pay these fees, and we employ outside firms to remind us to pay annuity fees due to patent

agencies on our patents and pending patent applications. In many cases, an inadvertent lapse can be

cured by payment of a late fee or by other means in accordance with the applicable rules. However, there

are situations in which noncompliance can result in abandonment or lapse of the patent or patent

application, resulting in partial or complete loss of patent rights in the relevant jurisdiction. In such an

event, our competitors might be able to enter the relevant market, which would have an adverse effect on

our business. Noncompliance events that could result in abandonment or lapse of a patent or patent

application include failure to respond to official actions within prescribed time limits, non-payment of fees

and failure to properly legalize and submit formal documents.

Changes in patent law, precedents and policies in the United States and other jurisdictions could

diminish the value of patents in general, thereby impairing our ability to protect our products.

Our ability to obtain patents is highly uncertain because, to date, some legal principles remain unresolved,

and there has not been a consistent policy regarding the breadth or interpretation of claims allowed in

patents in the United States. Furthermore, the specific content of patents and patent applications that are

necessary to support and interpret patent claims is highly uncertain due to the complex nature of the

relevant legal, scientific, and factual issues. The United States Supreme Court has ruled on several

patent cases in recent years, either narrowing the scope of patent protection available in certain

circumstances or weakening the rights of patent owners in certain situations. Changes in either the patent

laws or interpretations of patent laws in the United States or other jurisdictions may diminish the value of

our intellectual property. In the United States, in certain circumstances, court rulings may narrow the

scope of patent protection and weaken the rights of patent owners. We cannot predict how decisions by

the courts, the U.S. Congress, the USPTO or changes in the patent laws of other jurisdictions may impact

the value of our patents. Changes in the laws, regulations, precedents and procedures governing patents

could have a material adverse effect on our existing patent portfolio and our ability to protect and enforce

our intellectual property in the future, which could have a material adverse effect on our business,

Further, patent coverage in medical devices and technologies is a subject of evolution and differences

between countries. This is especially true of the definition of patentable subject matter which affects both

computer-related inventions and biological inventions. This evolution may cause current granted patents

to be considered non-patent eligible or prevent us from protecting future inventions. U.S. Supreme Court

and Federal Circuit Court decisions interpreting and/or limiting the scope of patentable subject matter

under 35 U.S.C. § 101, in addition to examination guidelines from the USPTO, have made it more difficult

for patentees to obtain and/or maintain patent claims in the United States that are directed to medical

technologies involving computer-implemented applications. Several precedential decisions regarding

patentable subject matter are of particular relevance to patents in the computer-implemented applications

space. Our efforts to seek patent protection for our technologies and products may be impacted by the

evolving case law and guidance or procedures issued by the USPTO or authorities in other jurisdictions

based on such evolving case law.

Similarly, changes in patent laws and regulations in other countries or jurisdictions, changes in the

governmental bodies that enforce them or changes in how the relevant governmental authority enforces

patent laws or regulations may weaken our ability to obtain new patents or to enforce patents that we may

obtain in the future. For example, the complexity and uncertainty of European patent laws have also

increased in recent years. In Europe, a new unitary patent system took effect June 1, 2023, which

significantly impacts European patents, including those granted before the introduction of the new unitary

patent system. Under the unitary patent system, European applications have the option, upon grant of a

patent, of becoming a Unitary Patent which will be subject to the jurisdiction of the Unitary Patent Court

(“UPC”). As the UPC is a new court system, there is limited precedent for the court, increasing the

uncertainty of any litigation. Patents granted before the implementation of the UPC have the ability to opt

out of the jurisdiction of the UPC and remain as national patents in the UPC countries. The UPC will

provide our competitors with a new forum to centrally revoke European patents and allow for the

possibility of a competitor to obtain pan-European injunctions, since patents that remain under the

jurisdiction of the UPC will be potentially vulnerable to a single UPC-based revocation challenge that, if

successful, could invalidate the patent in all countries who are signatories to the UPC. We cannot predict

with certainty the long-term effects of any potential changes.

Further, the laws of some foreign countries do not protect proprietary rights to the same extent or in the

same manner as the laws of the United States and Europe. As a result, we may encounter significant

problems in protecting and defending our intellectual property both in the United States and abroad. For

example, if the issuance in a given country of a patent covering an invention is not followed by the

issuance in other countries of patents covering the same invention, or if any judicial interpretation of the

validity, enforceability or scope of the claims or the written description or enablement, in a patent issued in

one country is not similar to the interpretation given to the corresponding patent issued in another country,

our ability to protect our intellectual property in those countries may be limited. Changes in either patent

laws or in interpretations of patent laws in the United States and other countries may materially diminish

the value of our intellectual property or narrow the scope of our patent protection.

In addition, on September 16, 2011, the Leahy-Smith America Invents Act (the “Leahy-Smith Act”) was

signed into law. The Leahy-Smith Act includes a number of significant changes to U.S. patent law.

Assuming that other requirements for patentability are met, prior to March 16, 2013, in the United States,

the first to invent the claimed invention was entitled to the patent, while outside the United States, the first

to file a patent application was entitled to the patent. On or after March 16, 2013, under the Leahy-Smith

Act, the United States transitioned to a first inventor to file system in which, assuming that other

requirements for patentability are met, the first inventor to file a patent application will be entitled to the

patent on an invention regardless of whether a third party was the first to invent the claimed invention.

Under this system, a third party that files a patent application in the USPTO before us could be awarded a

patent covering an invention of ours even if we had made the invention before it was made by such third

party. Since patent applications in the United States and most other countries are confidential for a period

of time after filing or until issuance, we cannot be certain that we or our licensors were the first to either (i)

file any patent application related to our products or (ii) invent any of the inventions claimed in our or our

licensors’ patents or patent applications.

The Leahy-Smith Act also changed the way patent applications are prosecuted, including by allowing

third-party submission of prior art to the USPTO during patent prosecution and additional procedures to

challenge the validity of a patent by USPTO administered post-grant proceedings to attack the validity of

a patent. Because of a lower evidentiary standard in USPTO proceedings compared to the evidentiary

standard in U.S. federal courts necessary to invalidate a patent claim, a third party could potentially

provide evidence in a USPTO proceeding sufficient for the USPTO to hold a claim invalid even though the

same evidence might not be sufficient to invalidate the claim if presented in a federal court action.

Accordingly, third parties may use USPTO proceedings to invalidate our patent claims that would not have

been invalidated if first challenged in a district court action. Therefore, the Leahy-Smith Act and its

implementation could increase the uncertainties and costs surrounding the prosecution of our patent

applications and the enforcement or defense of our issued patents, which could have a material adverse

effect on our business, financial condition, results of operations and prospects.

We may not be able to adequately protect our intellectual property rights throughout the world.

Our patent portfolio includes patents and patent applications in countries outside of the United States,

including Japan, Korea, China, Canada, Australia, Israel, India and countries in Europe. The requirements

for patentability differ from country to country, the breadth of allowed patent claims can be inconsistent,

the scope of coverage provided by these patents varies and the laws of some foreign countries may not

protect our intellectual property rights to the same extent as laws in the United States. In addition, filing,

prosecuting and defending patents on our products in all countries throughout the world would be

prohibitively expensive. For those countries where we do not have granted patents, we may not have any

ability to prevent the unauthorized sale of our products.

In addition, we may decide to abandon national and regional patent applications before they are granted.

The examination of each national or regional patent application is an independent proceeding. As a result,

patent applications in the same family may issue as patents in some jurisdictions, such as in the United

States, but may issue as patents with claims of different scope or may even be refused in other

jurisdictions. It is also quite common that, depending on the country, the scope of patent protection may

vary for the same product or technology. For example, certain jurisdictions do not allow for patent

protection with respect to methods of treatment.

Consequently, we may not be able to prevent third parties from practicing our inventions in all countries

outside the United States. Competitors may use our technologies in jurisdictions where we have not

obtained patent protection to develop their own products and, further, may export otherwise infringing

products to territories in which we have patent protection that may not be sufficient to terminate infringing

activities. Accordingly, our efforts to enforce our intellectual property and proprietary rights around the

world may be inadequate to obtain a significant commercial advantage from the intellectual property that

we develop or license.

Many countries have compulsory licensing laws under which a patent owner may be compelled to grant

licenses to third parties, government agencies or government contractors. In these countries, the patent

owner may have limited remedies, which could materially diminish the value of such patent. If we or any

of our licensors is forced to grant a license to third parties with respect to any patents relevant to our

business, our competitive position may be impaired, and our business, financial condition, results of

operations and prospects may be adversely affected.

We do not seek or have patent rights in certain foreign countries in which a market may exist. Accordingly,

our efforts to protect our intellectual property rights in such countries may be inadequate, which may have

an adverse effect on our ability to successfully commercialize our products in all of our expected

significant foreign markets. Moreover, in foreign jurisdictions where we do have patent rights, proceedings

to enforce such rights could result in substantial costs and divert our efforts and attention from other

aspects of our business, could put our patents at risk of being invalidated or interpreted narrowly, and

could put our patent applications at risk of not issuing. Additionally, such proceedings could provoke third

parties to assert claims against us. We may not prevail in any lawsuits that we initiate, and the damages

or other remedies awarded, if any, may not be commercially meaningful. Thus, we may not be able to

stop a competitor from marketing and selling in foreign countries products that are the same as or similar

to our products, and our competitive position in the international market would be harmed.

We may be involved in lawsuits to protect or enforce our patents or other intellectual property, or

the patents of our licensors, which could be expensive, time consuming and unsuccessful.

Competitors or other third parties may infringe, misappropriate or otherwise violate our owned or licensed

patents, trade secrets or other intellectual property. To counter infringement or unauthorized use, we may

be compelled to file infringement or misappropriation claims, which can be expensive and time

consuming. We do not carry intellectual property insurance that would cover such claims. In certain

circumstances it may not be practicable or cost effective for us to enforce our intellectual property rights

fully, particularly in certain developing countries or where the initiation of a claim might harm our business

relationships. If we initiate legal proceedings against a third party to enforce a patent covering our

products, the defendant could counterclaim that our patent(s) are invalid and/or unenforceable. In patent

litigation in the United States, counterclaims alleging invalidity and/or unenforceability are common, and

there are numerous grounds upon which a third party can assert invalidity or unenforceability of a patent.

In an infringement proceeding, a court may decide that a patent we own or license is not valid, is

unenforceable or is not infringed, or may refuse to stop the other party from using the technology at issue

on the grounds that our patents do not cover the technology in question. The outcome following legal

assertions of invalidity and unenforceability is unpredictable. With respect to the validity question, for

example, we cannot be certain that there is no invalidating prior art. If a defendant were to prevail on a

legal assertion of invalidity and/or unenforceability, we may lose some, and perhaps all, of the patent

protection covering our products. An adverse result in any litigation or defense proceeding could put one

or more of our patents at risk of being invalidated or interpreted narrowly, could put our patent

applications at risk of not issuing and could have a material adverse impact on our business.

Our defense of litigation may fail and, even if successful, may result in substantial costs and distract our

management and other employees. Even if we establish infringement, the court may decide not to grant

an injunction against further infringing activity and instead award only monetary damages, which may or

may not be an adequate remedy. For example, the amount of any monetary damages may be inadequate

to compensate us for damage as a result of the infringement and the proceedings. We may not be able to

prevent, alone or with our suppliers, misappropriation of intellectual property rights important to our

business, particularly in countries where the laws may not protect those rights as fully as in the United

States.

Furthermore, because of the substantial amount of discovery required in connection with intellectual

property litigation, there is a risk that some of our confidential information could be compromised by

disclosure during this type of litigation. There could also be public announcements of the results of

hearings, motions or other interim proceedings or developments. If securities analysts or investors

perceive these results to be negative, it could have an adverse effect on the price of our common stock.

Third-party defendants may challenge any patent we own or in-license through adversarial proceedings in

the issuing offices, which could result in the invalidation or unenforceability of some or all of the relevant

patent claims. If a third party asserts a substantial new question of patentability against any claim of a

U.S. patent we own or license, the USPTO may grant a request for reexamination, which may result in a

loss of scope of some claims or a loss of the entire patent. The adoption of the Leahy-Smith Act has

established additional opportunities for third parties to invalidate U.S. patent claims, including inter partes

review and post grant review, on the basis of lower legal standards than reexamination and additional

grounds. Outside of the United States, patents we own or license may become subject to patent

opposition or similar proceedings, which may result in loss of scope of some claims or loss of the entire

patent. Participation in adversarial proceedings is very complex, expensive and may divert our

management’s attention from our core business and may result in unfavorable outcomes that could

adversely affect our ability to prevent third parties from competing with us.

We may be subject to claims challenging the inventorship or ownership of our patents and other

intellectual property rights or alleging that we have violated the intellectual property rights or

other proprietary rights of third parties.

Our commercial success depends, in part, upon our ability to develop, manufacture, market and sell our

products and use our proprietary technologies without infringing the proprietary rights and intellectual

property of third parties. The medical device industry is characterized by extensive and complex litigation

regarding patents and other intellectual property rights. We may be exposed to, or threatened with, future

litigation by third parties having patent or other intellectual property rights alleging that our products or

proprietary technologies infringe on their intellectual property rights. There is a risk that third parties may

choose to engage in litigation with us to enforce or to otherwise assert their patent rights against us. Even

if we believe such claims are without merit, a court of competent jurisdiction could hold that these third-

party patents are valid, enforceable and infringed, which could have a negative impact on our ability to

commercialize our products. This includes litigation, or threatened litigation, with non-practicing entities

that have no relevant product revenue and against whom our own patent portfolio may have no deterrent

effect. The legal threshold for initiating litigation or contested proceedings is low, so that even lawsuits or

proceedings with a low probability of success might be initiated and require significant resources to

defend.

We may also be subject to claims that former employees, collaborators or other third parties have an

ownership interest in our patent rights or other intellectual property, for example, based on conflicting

obligations of consultants or others who are involved in developing our products. Although it is our policy

to require our employees and contractors who may be involved in the conception or development of

intellectual property to execute agreements assigning such intellectual property to us, we may be

unsuccessful in executing such an agreement with each party who, in fact, conceives or develops

intellectual property that we regard as our own, and we cannot be certain that our agreements with such

parties will be upheld in the face of a potential challenge, or that they will not be breached, for which we

may not have an adequate remedy. The assignment of intellectual property rights may not be self-

executing or the assignment agreements may be breached, and litigation may be necessary to defend

against these and other claims challenging inventorship or ownership. If we fail in defending any such

claims, in addition to paying monetary damages, we may lose valuable intellectual property rights, such

as exclusive ownership of, or right to use, valuable intellectual property. Such an outcome could have a

material adverse effect on our business. Even if we are successful in defending against such claims,

litigation could result in substantial costs and be a distraction to management and other employees.

We employ individuals who were previously employed at other medical technology companies. In

addition, we use publications that are subject to copyright, as well as proprietary information and

materials from third parties in our research. Some of the information and materials we use from third

parties may be subject to agreements that include restrictions on use or disclosure. Although we strive to

ensure proper safeguards, we cannot guarantee strict compliance with such agreements, nor can we be

sure that our employees, consultants and advisors do not use proprietary information, materials or know-

how of others in their work for us. In addition, we may be subject to claims that we or our employees,

consultants or independent contractors have inadvertently or otherwise used or disclosed alleged trade

secrets or other proprietary information of former employers or other third parties. Although we have

procedures in place that seek to prevent our employees and consultants from using the intellectual

property, proprietary information, know-how or trade secrets of others in their work for us, we may in the

future be subject to claims that we caused an employee to breach the terms of his or her non-competition

or non-solicitation agreement, or that we or these individuals have, inadvertently or otherwise, used or

disclosed the alleged trade secrets or other proprietary information of a former employer or competitor.

We may also be subject to claims that former employers or other third parties have an ownership interest

in our future patents. In addition, we may be subject to claims that we are infringing other intellectual

property rights, such as trademarks or copyrights, and to the extent that our employees, consultants or

contractors use intellectual property or proprietary information owned by others in their work for us,

disputes may arise as to the rights in related or resulting know-how and inventions. Litigation may be

necessary to defend against these claims. There is no guarantee of success in defending these claims,

and even if we are successful, litigation could result in substantial cost and be a distraction to our

management and other employees.

An unfavorable outcome for any such claim could require us to cease using the related technology or to

attempt to license rights to it from the prevailing party. Our business could be harmed if the prevailing

party does not offer us a license on commercially reasonable terms.

If a third party claims that we infringe its intellectual property rights, we may face a number of issues,

including:

•infringement and other intellectual property claims which, regardless of merit, may be expensive and

time consuming to litigate and may divert our management’s attention from our core business;

•substantial damages for infringement, which we may have to pay if a court decides that the product at

issue infringes or violates the third party’s rights, and if the court finds that the infringement was

willful, we could be ordered to pay treble damages and the patent owner’s attorneys’ fees;

•a court prohibiting us from selling or licensing the product unless the third-party licenses its product

rights to us, which it is not required to do;

•if a license is available from a third party, we may have to pay substantial royalties, upfront fees or

grant cross licenses to intellectual property rights for our products; and

•redesigning our products or processes so they do not infringe, which may not be possible or may

require substantial monetary expenditures and time.

In order to successfully challenge the validity of a U.S. patent in federal court, we would need to

overcome a presumption of validity. As this burden is a high one requiring us to present clear and

convincing evidence as to the invalidity of any such U.S. patent claim, there is no assurance that a court

of competent jurisdiction would invalidate the claims of any such U.S. patent. Foreign courts will have

similar burdens to overcome in order to successfully challenge a third-party claim of patent infringement.

Some of our competitors may be able to sustain the costs of complex patent litigation more effectively

than we can because they have substantially greater resources. In addition, any uncertainties resulting

from the initiation and continuation of any litigation could have an adverse effect on our ability to raise

additional funds or on our business, financial condition, results of operations and prospects.

The terms of our patents may not be sufficiently long to effectively protect our products and

Patents have a limited lifespan. In the United States, the natural expiration of a patent is generally 20

years after its first effective non-provisional filing date, but can be shorter due to terminal disclaimers or

similar term reductions in other jurisdictions. Although various extensions may be available, the term of a

patent, and the protection it affords, is limited. Even if patents covering our technologies or products are

obtained, once the patent term has expired, we may be open to competition. In addition, although upon

issuance in the United States, a patent’s term can be increased based on certain delays caused by the

USPTO, this increase can be reduced or eliminated based on certain delays caused by the patent

applicant during patent prosecution. Given the amount of time required for the development, testing and

regulatory review of products, patents protecting such potential products might expire before or shortly

after such products are commercialized. If we do not have sufficient patent life to protect our technologies

and products, our business, financial condition, results of operations and prospects will be adversely

affected.

If we do not obtain additional protection under the Hatch-Waxman Amendments or similar foreign

legislation, our business may be materially affected.

Depending upon the timing, duration and specifics of FDA marketing approval for our future products, one

or more of our U.S. patents may be eligible for limited patent term restoration under the Drug Price

Competition and Patent Term Restoration Act of 1984 (the “Hatch-Waxman Amendments”). The Hatch-

Waxman Amendments permit a patent term extension of up to five years beyond the normal expiration of

the patent as compensation for patent term lost during product development and the FDA regulatory

review process, which is limited to the approved indication (or any additional indications approved during

the period of extension). This extension is limited to one patent that covers the approved product, the

approved use of the product, or a method of manufacturing the product. A patent term extension cannot

extend the remaining term of a patent beyond a total of 14 years from the date of product approval, and

only those claims covering such approved product, a method for using it or a method for manufacturing it

may be extended. However, the applicable authorities, including the FDA and the USPTO in the United

States, and any equivalent regulatory authority in other countries or areas, may not agree with our

assessment of whether such extensions are available and may refuse to grant extensions to our patents,

or may grant more limited extensions than we request. We may not be granted an extension because of,

for example, failing to apply within applicable deadlines, failing to apply prior to expiration of relevant

patents or otherwise failing to satisfy applicable requirements. Moreover, the applicable time period or

scope of patent protection afforded could be less than we request. If we are unable to obtain patent term

extension or restoration of the term of any such extension is less than we request, our competitors may

obtain approval for competing products following our patent expiration, and our ability to generate

revenues may be adversely affected.

Open-source software licenses often impose unanticipated or unclear restrictions on us or could

expose us to litigation, and using open-source software has inherent risks, any of which could

impair our ability to successfully commercialize the Heartflow Platform.

Our technology platform implements software modules licensed to us by third parties under “open source”

licenses. The terms of many open source licenses have not been interpreted by U.S. courts, and there is

a risk that these licenses could be construed in ways that could impose unanticipated conditions or

restrictions on our ability to commercialize our products. Moreover, we cannot be certain that our

processes for controlling our use of open-source software in connection with our products will be

effective. From time to time, we may face claims from third parties asserting ownership of, or demanding

release of, the open-source software or derivative works that we developed using such software (which

could include our proprietary source code), or otherwise seeking to enforce the terms of the applicable

open source license. These claims could result in litigation. If we are held to have breached the terms of

an open source software license, we could be required to seek licenses from third parties to continue

offering our products on terms that are not economically feasible, to re-engineer our proprietary code, to

discontinue the sale of our products if re-engineering could not be accomplished on a timely or cost

effective basis, or to make generally available, in source code form, our proprietary code, any of which

could adversely affect our business, financial condition, results of operations and prospects.

The use of open-source software may entail greater risks than the use of third-party commercial software,

as open source licensors generally do not provide warranties or other contractual protections regarding

infringement or the quality or ownership of the code. Many of these risks cannot be eliminated, and could,

if not properly addressed, negatively affect our business. We cannot be sure that all open source software

is submitted for approval prior to use in connection with our products.

In addition, some open-source licenses contain requirements that we make available source code for

modifications or derivative works we create based upon the type of open-source software we use. If we

combine our proprietary software with open-source software in a certain manner, we could, under certain

open-source licenses, be required to release portions of the source code of our proprietary software to the

public. This would allow our competitors to create similar products with less development effort and time

and ultimately could result in a loss of sales for us.

Intellectual property rights do not necessarily address all potential threats to our competitive

advantage.

The degree of future protection afforded by our intellectual property rights is uncertain because

intellectual property rights have limitations and may not adequately protect our business or permit us to

maintain our competitive advantage. The following examples are illustrative:

•others may be able to make products that are similar to or otherwise competitive with our potential

products but that are not covered by the claims of our current or future patents;

•an in-license necessary for the manufacture, use, sale, offer for sale or importation of one or more of

our potential products may be terminated by the licensor;

•we or future collaborators might not have been the first to make the inventions covered by our issued

or future issued patents or our pending patent applications;

•we or future collaborators might not have been the first to file patent applications covering certain of

our inventions;

•others may independently develop similar or alternative technologies or duplicate any of our

technologies without infringing our intellectual property rights;

•it is possible that our pending patent applications will not lead to issued patents;

•issued patents that we own or in-license may be held invalid or unenforceable as a result of legal

challenges by our competitors;

•issued patents that we own or in-license may not provide coverage for all aspects of our new potential

products in all countries;

•our competitors might conduct research and development activities in countries where we do not

have patent rights and then use the information learned from such activities to develop competitive

products for sale in our major commercial markets;

•we may not develop additional proprietary technologies that are patentable; and

•the patents of others may have an adverse effect on our business.

Should any of these events occur, they could significantly harm our business, results of operations and

prospects.

Risks Related to Financing and Tax Matters

We may require additional capital to support business growth, and this capital might not be

available on terms favorable to us, or at all, and may dilute ownership of our common stock for

our stockholders, including purchasers of common stock.

We intend to continue to make investments to support our business growth and may require additional

funds to respond to business challenges and opportunities, including the need to develop new products,

enhance our existing products, enhance our operating infrastructure, potentially expand internationally

and potentially acquire complementary businesses and technologies. In order to achieve these objectives,

we may make future commitments of capital resources. Accordingly, we may need to engage in equity or

debt financings to secure additional funds. If we raise additional funds through further issuances of equity

or convertible debt securities, our stockholders, including any purchasers of common stock, could suffer

significant dilution, and any new equity securities we issue could have rights, preferences and privileges

superior to those of holders of our common stock. Further, if additional financing is needed, we may not

be able to obtain additional financing on terms favorable to us or at all. Our inability to obtain adequate

financing or financing on terms satisfactory to us, when we require it, could significantly limit our ability to

continue supporting our business growth and responding to business challenges and opportunities.

Our operating results may fluctuate significantly, which makes our future operating results

difficult to predict and could cause our operating results to fall below expectations or any

guidance we may provide.

Our quarterly revenue and results of operations may fluctuate from quarter to quarter due to, among

others, the following reasons:

•the level of physicians’ acceptance and adoption of our products, and changes in the rates at which

physicians order our Heartflow FFRCT Analysis or the percentage of CCTA scans for which our

Heartflow FFRCT Analysis is ordered;

•determinations, including the timing of determinations, by payors concerning coverage and

reimbursement of our products;

•changes in coverage amounts or government and payors’ reimbursement policies;

•the timing, expense and results of research and development activities, clinical trials and any

additional regulatory approvals;

•changes in AHA or ACC guidelines, or guidelines in other countries, that lower support for our

products or elevate alternative products as the preferred pathway for diagnosis and management of

CAD;

•fluctuations in our expenses associated with expanding our commercial operations and operating as

a public company;

•patients meeting their annual health insurance deductible later in the calendar year;

•the introduction of new products and technologies by our competitors;

•changes in our pricing policies or in the pricing policies of our competitors;

•the productivity of our sales and marketing teams, and their ability to identify physicians who

consistently refer appropriate patients for CCTAs in accordance with AHA and ACC guidelines;

•quality problems with our products or the Heartflow Platform; and

•the impact of catastrophic events such as a pandemic, cybersecurity events, global business, political

and economic instability, including domestic and global inflationary trends, interest rate volatility, and

uncertainty with respect to the federal debt ceiling and budget and potential government shutdowns

related thereto.

Because of these and other factors, it is likely that in some future period our operating results will not

meet investor expectations or those of public market analysts. Any unanticipated change in revenue or

operating results is likely to cause our stock price to fluctuate. New information may cause investors and

analysts to revalue our business, which could cause a decline in our stock price.

We are subject to risks associated with currency fluctuations, and changes in foreign currency

exchange rates could impact our results of operations.

The vast majority of our revenue and the majority of our expense and capital purchasing activities through

the nine months ended September 30, 2025 were transacted in U.S. dollars. Approximately 7% and 8% of

our revenue for the three months ended September 30, 2025 and 2024, respectively, and approximately

8% and 9% of our revenue for the nine months ended September 30, 2025 and 2024, respectively, was

generated from customers outside the United States. However, because a portion of our operations

consists of business activities outside of the United States, we have foreign currency operating expenses

as well as asset and liability balances. During the nine months ended September 30, 2025, we were

exposed to foreign currency risks in connection with our non-U.S. operations, and we anticipate that, over

time, an increasing portion of our international agreements may provide for payment denominated in

foreign currencies. Changes in the exchange rates between such foreign currencies and the U.S. dollar

could therefore materially impact our reported results of operations and distort period-to-period

comparisons. Fluctuations in foreign currency exchange rates also impact the reporting of our receivables

and payables in non-U.S. currencies. As a result of such foreign currency fluctuations, it could be more

difficult to detect underlying trends in our business and results of operations. In addition, to the extent that

fluctuations in currency exchange rates cause our results of operations to differ from our expectations or

the expectations of our investors, the trading price of our common stock could be adversely affected.

We do not currently engage in currency hedging activities to limit the risk of exchange rate fluctuations. In

the future, we may engage in exchange rate hedging activities in an effort to mitigate the impact of

exchange rate fluctuations but we may not be successful in doing so. If our hedging activities are not

effective, changes in currency exchange rates may have a more significant impact on our results of

operations.

Our ability to use our net operating losses and tax credits to offset future taxable income and

taxes may be subject to certain limitations.

As of December 31, 2024, we had net operating loss (“NOL”) carryforwards of approximately $542.9

million and $435.5 million for federal and state income tax purposes, respectively, which may be utilized

against future federal and state income taxes. Federal NOL carryforwards we generated in tax years

through December 31, 2017 generally may be carried forward for 20 years and may fully offset taxable

income in the year utilized, and federal NOLs we generated in tax years beginning after December 31,

2017 generally may be carried forward indefinitely but may only be used to offset 80% of our taxable

income annually for tax years beginning after December 31, 2017.

In general, under Section 382 of the Internal Revenue Code of 1986, as amended (the “Code”), a

corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its pre-

change NOL carryforwards and other tax attributes, such as research and development tax credits, to

offset future taxable income and taxes. In general, an ownership change occurs if the aggregate stock

ownership of certain stockholders, generally stockholders beneficially owning five percent or more of our

common stock, applying certain look through and aggregation rules, increases by more than 50% over

such stockholders’ lowest percentage ownership during the testing period, generally three years.

Purchases of our common stock in amounts greater than specified levels, which will be beyond our

control, could create a limitation on our ability to utilize our NOL carryforwards for tax purposes in the

future. We completed a Section 382 study of our historic ownership changes through December 31, 2024

and no significant limitations were identified. In addition, future issuances or sales of our stock, including

certain transactions involving our stock that are outside of our control, could result in future “ownership

changes.” “Ownership changes” that have occurred in the past or that may occur in the future could result

in the imposition of an annual limit on the amount of pre-ownership change NOL carryforwards and other

tax attributes we can use to reduce our taxable income, potentially increasing and accelerating our liability

for income taxes, and also potentially causing those tax attributes to expire unused.

If we are limited in our ability to use our NOL and tax credit carryforwards in future years in which we have

taxable income, we will pay more taxes than if we were able to fully utilize our NOL and tax credit

carryforwards, and we could be required to pay taxes earlier than we would otherwise be required, which

could cause such NOLs to expire unused. This could adversely affect our results of operations.

Furthermore, we may not be able to generate sufficient taxable income to utilize our pre-2018 NOLs

before they expire beginning in 2030. If any of these events occur, we may not derive some or all of the

expected benefits from our NOLs, and our business, financial condition, results of operations and

prospects may be adversely affected as a result.

Our international operations subject us to potentially adverse tax consequences.

We currently report our taxable income in various jurisdictions based upon our business operations in

those jurisdictions, including in the United States, United Kingdom, and Japan. We may in the future be

subject to reporting requirements in other foreign jurisdictions. The international nature and organization

of our business activities are subject to complex transfer pricing regulations administered by taxing

authorities in various jurisdictions. The relevant taxing authorities may disagree with our determinations

as to the income and expenses attributable to specific jurisdictions. If such a disagreement were to occur,

and our position were not sustained, we could be required to pay additional taxes, interest and penalties,

which could result in one time tax charges, higher effective tax rates, reduced cash flows and lower

overall profitability of our operations. We believe that our consolidated financial statements reflect

adequate reserves to cover such a contingency, but there can be no assurances in that regard.

Our effective tax rate may vary significantly from period to period.

Various internal and external factors may have favorable or unfavorable effects on our future effective tax

rate. These factors include, but are not limited to, changes in tax laws, regulations or rates, both within

and outside the United States, structural changes in our business, new accounting pronouncements or

changes to existing accounting pronouncements, non-deductible goodwill impairments, changing

interpretations of existing tax laws or regulations, changes in the relative proportions of revenue and

income before taxes in the various jurisdictions in which we operate that have different statutory tax rates,

the future levels of tax benefits of equity-based compensation, changes in overall levels of pretax

earnings or changes in the valuation of our deferred tax assets and liabilities. Additionally, we could be

challenged by state and local tax authorities as to the propriety of our sales tax compliance, and our

results could be materially impacted by these compliance determinations.

In addition, our effective tax rate may vary significantly depending on the market price of our common

stock. The tax effects of the accounting for share-based compensation may significantly impact our

effective tax rate from period to period. In periods in which the market price of our common stock is higher

than the grant price of the share-based compensation vesting in that period, we will recognize excess tax

benefits that will decrease our effective tax rate. In future periods in which our stock price is lower than

the grant price of the share-based compensation vesting in that period, our effective tax rate may

increase. The amount and value of share-based compensation issued relative to our earnings in a

particular period will also affect the magnitude of the impact of share-based compensation on our effective

tax rate. These tax effects are dependent on the market price of our common stock, which we do not

control, and a decline in our stock price could significantly increase our effective tax rate and adversely

affect our financial condition.

Taxing authorities may successfully assert that we should have collected or in the future should

collect sales and use, value added or similar taxes, and we could be subject to tax liabilities with

respect to past or future sales, which could adversely affect our results of operations.

We do not collect sales and use, value added and similar taxes in all jurisdictions in which we have sales,

based on our belief that such taxes are not applicable or that we are not required to collect such taxes

with respect to the jurisdiction. Sales and use, value added and similar tax laws and rates vary greatly by

jurisdiction. Certain jurisdictions in which we do not collect such taxes may assert that such taxes are

applicable, which could result in tax assessments, penalties and interest, and we may be required to

collect such taxes in the future. Such tax assessments, penalties and interest or future requirements may

adversely affect our results of operations.

Risks related to our common stock

There may not be a sustainable trading market for our common stock.

Prior to our IPO, there was no public market for our common stock. It is possible that an active trading

market will not develop or, if developed, that any market will not be sustained, which would make it

difficult for you to sell your shares of common stock at an attractive price or at all. An inactive market may

also impair our ability to raise capital, to attract and motivate our employees through equity incentive

awards and our ability to acquire businesses, brands, assets or technologies by using shares of our

common stock as consideration.

The market price of our common stock may be volatile, which could cause the value of your

investment to decline and could result in substantial losses for investors.

The market price of our common stock may be highly volatile and could be subject to wide fluctuations

due to a variety of factors, some of which may be beyond our control, including:

•changes in analysts’ estimates, investors’ perceptions, recommendations by securities analysts or our

failure to achieve analysts’ estimates;

•quarterly variations in our or our competitors results of operations;

•periodic fluctuations in our revenue, which could be due in part to the way in which we recognize

revenue;

•the financial projections we may provide to the public, any changes in these projections or our failure

to meet these projections;

•future sales of our common stock or other securities, by us or our stockholders, as well as the

expiration of lock-up agreements;

•the trading volume of our common stock;

•general economic, industry, market conditions and other factors unrelated to our operating

performance or the operating performance of our competitors, including inflation, interest rate

volatility, and uncertainty with respect to the federal debt ceiling and budget and potential government

shutdowns related thereto;

•changes in reimbursement by current or potential payors;

•changes in operating performance and stock market valuations of other technology companies

generally, or those in the medical device industry in particular;

•actual or anticipated changes in regulatory oversight of our products;

•the results of our clinical trials;

•the loss of key personnel, including changes in our board of directors and management;

•legislation or regulation of our market;

•lawsuits threatened or filed against us, including litigation by current or former employees alleging

wrongful termination, whistleblower or other claims;

•the announcement of new products or product enhancements by us or our competitors;

•developments in our industry; and

•other factors described in this “Risk Factors” section and elsewhere in this Quarterly Report on Form

10-Q.

In recent years, the stock markets generally have experienced extreme price and volume fluctuations that

have often been unrelated or disproportionate to the operating performance of listed companies. Broad

market and industry factors may significantly affect the market price of our common stock, regardless of

our actual operating performance.

We are an emerging growth company, and the reduced reporting requirements applicable to

emerging growth companies could make our common stock less attractive to investors.

We are an “emerging growth company,” as defined in the JOBS Act. We will remain an “emerging growth

company” until the earliest to occur of:

•the last day of the fiscal year during which our total annual revenue equals or exceeds $1.235 billion

(subject to adjustment for inflation);

•December 31, 2030;

•the date on which we have, during the previous three-year period, issued more than $1 billion in non-

convertible debt; or

•the date on which we are deemed to be a “large accelerated filer” under the Exchange Act.

As a result of our “emerging growth company” status, we may take advantage of exemptions from various

reporting requirements that would otherwise be applicable to public companies including, but not limited

to, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy

statements and exemptions from the requirements of holding a nonbinding advisory vote on executive

compensation and stockholder approval of any golden parachute payments not previously approved.

Investors may find our common stock less attractive because we may rely on these exemptions. If some

investors find our common stock less attractive as a result, there may be a less active trading market for

our common stock and the market price of our common stock may be adversely affected and more

volatile.

We incur increased costs and are subject to additional regulations and requirements as a result of

becoming a public company, which could lower our profits or make it more difficult to run our

As a public company, we incur significant legal, accounting and other expenses that we have not incurred

as a private company, including costs associated with public company reporting requirements. We have

also incurred and will continue to incur costs associated with the Sarbanes-Oxley Act and related rules

implemented by the SEC and the listing requirements of the Nasdaq Global Select Market. The expenses

generally incurred by public companies for reporting and corporate governance purposes have been

increasing. We expect these rules and regulations to increase our legal and financial compliance costs

and to make some activities more time-consuming and costly, although we are currently unable to

estimate these costs with any degree of certainty. These laws and regulations also could make it more

difficult or costly for us to obtain certain types of insurance, including director and officer liability

insurance, and we may be forced to accept reduced policy limits and coverage or incur substantially

higher costs to obtain the same or similar coverage. These laws and regulations could also make it more

difficult for us to attract and retain qualified persons to serve on our board of directors, on our board

committees or as our executive officers. Furthermore, if we are unable to satisfy our obligations as a

public company, we could be subject to delisting of our common stock, fines, sanctions, other regulatory

action and potentially civil litigation.

If we are unable to design, implement and maintain effective internal control over financial

reporting in the future, investors may lose confidence in the accuracy and completeness of our

financial reports and the market price of our common stock may decline.

As a public company, we are required to maintain internal control over financial reporting and to report

any material weaknesses in such internal controls. In addition, beginning with our second annual report

on Form 10-K, we will be required to furnish a report by management on the effectiveness of our internal

control over financial reporting, pursuant to the rules and regulations of the SEC regarding compliance

with Section 404 of the Sarbanes-Oxley Act. The process of designing, implementing and testing the

internal control over financial reporting required to comply with this obligation is time consuming, costly

and complicated. We have in the past and may in the future identify control deficiencies, including

material weaknesses in our internal control over financial reporting. In connection with the preparation of

our consolidated financial statements, material weaknesses in our internal control over financial reporting

were identified as of and prior to December 31, 2023, which were remediated in connection with the

preparation of our consolidated financial statements as of and for the year ended December 31, 2024.

Any failure to maintain effective internal control over financial reporting could severely inhibit our ability to

accurately report our financial condition, results of operations or cash flows. Further, if we identify one or

more material weaknesses in our internal control over financial reporting, if we are unable to comply with

the requirements of Section 404 of the Sarbanes-Oxley Act in a timely manner or if we and, if required,

our auditors, are unable to assert that our internal control over financial reporting is effective, investors

may lose confidence in the accuracy and completeness of our financial reports and the market price of

our common stock could decline, and we could also become subject to investigations by the stock

exchange on which our common stock is listed, the SEC or other regulatory authorities, which could

require additional financial and management resources. Failure to remedy any material weakness in our

internal control over financial reporting, or to implement or maintain other effective control systems

required of public companies, could also restrict our future access to the capital markets.

Our disclosure controls and procedures may not prevent or detect all errors or acts of fraud.

We are subject to the periodic reporting requirements of the Exchange Act. Our disclosure controls and

procedures are designed to reasonably ensure that information required to be disclosed by us in reports

we file or submit under the Exchange Act is accumulated and communicated to management and

recorded, processed, summarized and reported within the time periods specified in the rules and forms of

the SEC. We believe that our disclosure controls and procedures as well as internal control over financial

reporting, no matter how well conceived and operated, can provide only reasonable, not absolute,

assurance that the objectives of the control system are and will be met. These inherent limitations include

the realities that judgments in decision making can be faulty and that breakdowns can occur because of

simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons,

by collusion of two or more people or by an unauthorized override of the controls. Accordingly, because of

the inherent limitations in our control system, misstatements due to error or fraud may occur and not be

detected.

If our estimates or judgments relating to our critical accounting policies are based on

assumptions that change or prove to be incorrect, our operating results could fall below our

publicly announced guidance or the expectations of securities analysts and investors, resulting in

a decline in the market price of our common stock.

The preparation of financial statements in conformity with accounting principles generally accepted in the

United States (“GAAP”) requires management to make estimates and assumptions that affect the

reported amounts of assets, liabilities, revenue, expenses and related disclosures. We base our estimates

on historical experience and various other factors that we believe are reasonable under the

circumstances, the results of which form the basis for making judgments about the carrying value of

assets and liabilities that are not readily apparent from other sources. Actual results may differ from these

estimates under different assumptions or conditions and any such differences may be material. If our

assumptions change or if actual circumstances differ from our assumptions, our operating results may be

adversely affected and could fall below our publicly announced guidance or the expectations of analysts

and investors, resulting in a decline in the market price of our common stock.

Our principal stockholders and management own a significant percentage of our stock and will be

able to exert significant control over matters subject to stockholder approval.

As of October 31, 2025, our executive officers, directors, owners of more than 5% of our capital stock and

their respective affiliates beneficially owned approximately 40.9%of our outstanding shares. Therefore,

these stockholders will have the ability to influence us through this ownership position. These

stockholders may be able to determine all matters requiring stockholder approval. For example, these

stockholders may be able to control elections of directors, amendments of our organizational documents,

or approval of any merger, sale of assets or other major corporate transaction. This may prevent or

discourage unsolicited acquisition proposals or offers for our common stock that you may feel are in your

best interest as one of our stockholders.

A significant portion of our total outstanding shares is restricted from immediate resale but may

be sold into the market in the near future, and any sales of a substantial number of shares of our

common stock in the public market could cause our stock price to decline significantly, even if

our business is doing well.

Sales of a substantial number of shares of our common stock in the public market could occur at any

time. These sales, or the perception in the market that the holders of a large number of shares of our

common stock intend to sell shares, could reduce the market price of our common stock. If our existing

stockholders sell, or indicate an intention to sell, substantial amounts of our common stock in the public

market after the lock-up agreements, market standoff and other legal restrictions on resale in place at the

time of the IPO lapse, the trading price of our common stock could decline and such decline may be

significant. As of October 31, 2025, we had outstanding a total of 85,158,719 shares of common stock. Of

these shares, all of the shares of our common stock sold in our IPO, were freely tradable, without

restriction, in the public market immediately following our IPO, other than shares purchased by our

“affiliates” (as such term is defined in Rule 144 under the Securities Act).

We and each of our directors, our executive officers and substantially all of our other securityholders have

entered into lock-up agreements with the underwriters prior to the completion of our IPO or are subject to

market standoff arrangements for a period of 180 days commencing on the date of our IPO. After the

expiration of the lock-up agreements and market standoff arrangements, as of October 31, 2025, up to

approximately 66.0 million additional shares of common stock will be eligible for sale in the public market,

approximately 47.6% ofwhich shares are owned by directors, executive officers and other owners of

more than 5% of our outstanding common stock, stock options, warrants and securities convertible into

our common stock and will be subject to Rule 144 under the Securities Act.

Based upon the number of shares outstanding as of October 31, 2025, the holders of approximately 55.8

million shares of our common stock, or approxima tely 66% of our total outstanding common stock, will be

entitled to rights with respect to the registration of their shares under the Securities Act, subject to the

lock-up agreements and market standoff restrictions described above. Registration of these shares under

the Securities Act would result in the shares becoming freely tradable without restriction under the

Securities Act, except for shares purchased by affiliates. Any sales of securities by these stockholders or

any perception that these shares may be sold could reduce the market price of our common stock, which

price decline may be significant. In addition, a security holder who is not subject to market standoff

restrictions with us nor a lock-up agreement with the underwriters may be able to sell, short sell, transfer,

pledge or otherwise dispose of their equity interests at any time.

Our amended and restated certificate of incorporation provides that the Court of Chancery of the

State of Delaware (or, if such court does not have jurisdiction, Delaware federal district court) is

the exclusive forum for certain disputes between us and our stockholders, which could limit our

stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors,

officers or employees.

Our amended and restated certificate of incorporation provides that, unless we consent in writing to the

selection of an alternative forum, the Court of Chancery of the State of Delaware (or, in the event that the

Court of Chancery does not have jurisdiction, the federal district court for the District of Delaware) are the

exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a

claim of breach of fiduciary duty owed by any of our current or former directors, officers, employees or

stockholders to us or to our stockholders, any action asserting a claim against us arising pursuant to the

Delaware General Corporation Law, our amended and restated certificate of incorporation, or our

amended and restated bylaws (as either may be amended from time to time) or as to which the Delaware

General Corporation Law confers jurisdiction on the Delaware Court of Chancery, or any action asserting

a claim against us that is governed by the internal affairs doctrine of the State of Delaware. Our amended

and restated certificate of incorporation also provides that the federal district courts of the United States is

the exclusive forum for the resolution of any complaint asserting a cause of action arising under the

Securities Act. Further, our amended and restated certificate of incorporation provides that the foregoing

choice of forum provisions do not apply to suits brought to enforce any liability or duty created by the

Exchange Act, or any other claim for which the federal courts of the United States have exclusive

jurisdiction.

Our amended and restated certificate of incorporation also provides that any person or entity purchasing

or otherwise acquiring or holding any interest in any of our securities shall be deemed to have notice of

and consented to the foregoing provisions of the amended and restated certificate of incorporation.

Although our amended and restated certificate of incorporation contains the choice of forum provision

described above, it is possible that a court could find that such a provision is inapplicable for a particular

claim or action or that such provision is unenforceable.

We believe these provisions may benefit us by providing increased consistency in the application of

Delaware law and federal securities laws by chancellors and judges, as applicable, particularly

experienced in resolving corporate disputes, efficient administration of cases on a more expedited

schedule relative to other forums, and protection against the burdens of multi-forum litigation. However,

this choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it

finds favorable for disputes with us or any of our directors, officers, other employees or stockholders,

which may discourage lawsuits with respect to such claims, although our stockholders will not be deemed

to have waived our compliance with federal securities laws and the rules and regulations thereunder.

Furthermore, the enforceability of similar choice of forum provisions in other companies’ certificates of

incorporation has been challenged in legal proceedings, and it is possible that a court could find these

types of provisions to be inapplicable or unenforceable. While Delaware courts have determined that such

choice of forum provisions are facially valid, a stockholder may nevertheless seek to bring a claim in a

venue other than those designated in the exclusive forum provisions, and there can be no assurance that

such provisions will be enforced by a court in those other jurisdictions. If a court were to find the choice of

forum provision that will be contained in our amended and restated certificate of incorporation to be

inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such

action in other jurisdictions, which could adversely affect our business, financial condition, results of

operations and prospects.

General Risk Factors

We have broad discretion in the use of net proceeds to us from our IPO and may not use them

effectively.

In connection with the completion of our IPO, we were obligated to use certain of the net proceeds from

our IPO to repay $55.0 million of the indebtedness outstanding under the 2024 Credit Agreement and to

pay approximately $5.8 million of fees in connection therewith. In addition, in August 2025, we prepaid in

full all remaining outstanding indebtedness, comprising an aggregate principal amount of $60.1 million

plus accrued interest of $1.0 million, under the 2024 Credit Agreement. We expect to use the remainder

to fund our sales and marketing efforts, fund research and product development activities and for other

general corporate purposes, including working capital, operating expenses, and capital expenditures. We

may also use a portion of the net proceeds from our IPO to acquire complementary businesses, products,

services, or technologies.

We periodically evaluate strategic opportunities; however, we have no current understandings or

commitments to enter into any such acquisitions or make any such investments. The expected use of our

IPO net proceeds represents our intentions based upon our present plans and business conditions. We

cannot predict with certainty all of the particular uses for the proceeds from our IPO or the amounts that

we will actually spend on the uses set forth above. The timing and amount of our actual expenditures will

be based on many factors, including cash flows from operations and the anticipated growth of our

If we do not use the net proceeds that we received from our IPO effectively, our business, financial

condition, results of operations and prospects could be harmed, and the market price of our common

stock could decline. Pending their use, we are investing our IPO net proceeds in a variety of capital-

preservation investments, including government securities and money market funds. These investments

may not yield a favorable return to our investors.

We do not intend to pay dividends in the foreseeable future. As a result, your ability to achieve a

return on your investment will depend on appreciation in the market price of our common stock.

We have never declared or paid cash dividends on our capital stock. We currently intend to retain all

available funds and any future earnings, if any, to fund the development and expansion of our business,

and we do not anticipate paying any cash dividends in the foreseeable future. Any future determinations

regarding the declaration and payment of dividends, if any, will be at the discretion of our board of

directors, subject to applicable law, and will depend upon then-existing conditions, including our financial

condition, results of operations, contractual restrictions, general business conditions, capital

requirements, and other factors our board of directors may deem relevant. Our ability to pay cash

dividends on our capital stock in the future may also be limited by the terms of any preferred securities we

may issue or agreements governing any additional indebtedness we may incur.

If our operating and financial performance in any given period does not meet any guidance that

we provide to the public, the market price of our common stock may decline.

We may, but are not obligated to, provide public guidance on our expected operating and financial results

for future periods. Any such guidance will be comprised of forward-looking statements subject to the risks

and uncertainties described in this Quarterly Report on Form 10-Q, including in the section titled “Risk

Factors” and in our future public filings and public statements. Our actual results may not always be in line

with or exceed any guidance we have provided, especially in times of economic uncertainty. If actual

circumstances differ from those in our assumptions, our operating and financial results could fall below

our publicly announced guidance or the expectations of investors. If, in the future, our operating or

financial results for a particular period do not meet any guidance we provide or the expectations of

investment analysts or investors generally, or if we reduce our guidance for future periods, the market

price of our common stock may decline. Even if we do issue public guidance, there can be no assurance

that we will continue to do so in the future.

If securities or industry analysts issue an adverse or misleading opinion regarding our stock, or if

they cease coverage of us or fail to publish reports on us regularly, our stock price and trading

volume could decline.

The trading market for our common stock relies in part on the research and reports that industry or

securities analysts publish about us or our business. We do not control these analysts. If any of the

analysts who cover us downgrade their evaluations of our stock or issue an adverse opinion regarding us,

our business model, our intellectual property or our stock performance, or if our results of operations fail

to meet the expectations of analysts, our stock price would likely decline. If one or more of these analysts

cease coverage of us or fail to publish reports on us regularly, we could lose visibility in the financial

markets, which in turn could cause our stock price or trading volume to decline.

attention.

In the past, following periods of volatility in the overall market and the market price of a company’s

securities, securities class action litigation has often been instituted against these companies. Because of

the potential volatility of our stock price, we may become the target of securities litigation in the future.

These events may also result in or be concurrent with investigations by the SEC. We may be exposed to

such litigation or investigation even if no wrongdoing occurred. Such litigation, if instituted against us,

could result in substantial costs and a diversion of our management’s attention and resources, which

could seriously harm our business.

Provisions in our charter documents and under Delaware law could discourage a takeover that

stockholders may consider favorable and may lead to entrenchment of management.

Our amended and restated certificate of incorporation and our amended and restated bylaws contain

provisions that could delay or prevent changes in control or changes in our management without the

consent of our board of directors. These provisions include the following:

•a classified board of directors with three-year staggered terms, which may delay the ability of

stockholders to change the membership of a majority of our board of directors;

•our directors may be removed by our stockholders only for cause;

•no cumulative voting in the election of directors, which limits the ability of minority stockholders to

elect director candidates;

•the exclusive right of our board of directors to change the size of the board of directors and to elect a

director to fill a new directorship created by the expansion of the board of directors or a vacancy

created by the resignation, death or removal of a director, which prevents stockholders from being

able to change the board’s size or fill new directorships and vacancies on our board of directors;

•the ability of our board of directors to authorize the issuance of shares of preferred stock and to

determine the price and other terms of those shares, including preferences and voting rights, without

stockholder approval, which could be used to significantly dilute the ownership of a hostile acquiror or

adopt a stockholder rights plan;

stockholder approval;

•the required approval of at least sixty-six and two-thirds percent (66-2/3%) of the voting power of all

then-outstanding shares of capital stock entitled to vote generally in the election of directors to

remove directors or to adopt, amend, alter or repeal our amended and restated bylaws and certain

provisions of our amended and restated certificate of incorporation;

•a prohibition on stockholder action by written consent, which forces stockholder action to be taken at

an annual or special meeting of our stockholders;

•the requirement that a special meeting of stockholders may be called only by our secretary at the

request of our board of directors, the chairman of our board of directors, or our chief executive officer,

which may delay the ability of our stockholders to force consideration of a proposal or to take action,

including the removal of directors; and

•advance notice procedures that stockholders must comply with in order to nominate candidates to our

board of directors or to propose matters to be acted upon at a stockholders’ meeting, which may

discourage or deter a potential acquiror from conducting a solicitation of proxies to elect the acquiror’s

own slate of directors or otherwise attempting to obtain control of us.

We are also subject to the anti-takeover provisions contained in Section 203 of the Delaware General

Corporation Law (“Section 203”). Under Section 203, a corporation may not, in general, engage in a

business combination (as defined in Section 203) with any interested stockholder (generally defined by

Section 203 to include holders of 15% or more of our capital stock) unless the interested stockholder has

held the stock for three years or, among other exceptions and exclusions, the board of directors has

approved the business combination transaction or the transaction that resulted in the stockholder

becoming an interested stockholder.