Quality Statement

1 Overview and Scope

Ophthalytics develops and operates NSight360, a cloud-hosted Software as a Medical Device (SaMD) that supports the detection, evaluation and clinical interpretation of retinal disease from ophthalmic images. The platform comprises a common backend together with functionally related modules, namely NSight360, Ocula360, Ophthal360 and 2nd Opinion, developed, released and maintained together as a single medical device family.

The quality of the platform's outputs, the safety of patients, and the integrity of the underlying data are interdependent. We therefore treat medical device quality, software safety and data integrity as a single integrated discipline rather than as separate administrative functions.

2 Regulatory Framework

As the developer of Software as a Medical Device, Ophthalytics maintains a quality management system established in accordance with ISO 13485:2016, with ISO 9000:2015 as the supporting normative reference. The Quality Manual is the top-level document of that system.

Ophthalytics does not design, manufacture, distribute or service physical medical devices, hardware, sterile products or installation-dependent products. Requirements of ISO 13485:2016 that apply exclusively to such products are recorded as non-applicable, with justification, in the Quality Manual.

3 Quality Policy

Top management has established a Quality Policy that is communicated, understood and applied across the organisation. Everyone working under Ophthalytics is accountable for upholding it. The policy commits Ophthalytics:

Regulatory Compliance

To comply with applicable regulatory requirements for medical devices and to maintain the effectiveness of the quality management system under ISO 13485:2016.

Safe and Secure by Default

To design systems so that the safety and performance of the device, and the confidentiality and integrity of data entrusted to us, are protected by default.

Lifecycle Risk Management

To apply risk management throughout the product lifecycle as an integrated part of product realisation.

Independent Examination

To subject our own controls to independent examination and to act on what that examination finds.

Open Communication

To communicate openly and promptly with customers when our processes or their data are affected by change.

Continual Improvement

To continually improve the suitability, adequacy and effectiveness of the quality management system.

4 Quality Objectives

Top management establishes measurable quality objectives that are consistent with the Quality Policy and are tracked and reviewed at management review. The current objective areas are:

Product Conformity and Device Performance

Rate of nonconforming outputs, time to correction, and algorithmic performance against defined acceptance criteria.

Patient Safety

Number and severity of hazard-related nonconformities, and timeliness of any required regulatory reporting.

Data Integrity and Protection

Confirmed integrity or confidentiality events and the closure status of assessment findings.

CAPA Effectiveness

Proportion of corrective actions closed within the planned interval and verified as effective.

Personnel Competence

Proportion of personnel current against assigned competence requirements.

5 Medical Device File and Document Control

A Medical Device File covers the platform and its modules as a single family, containing or referencing the device description and intended use, product specifications, monitoring procedures and, where applicable, servicing records. Module-specific content is maintained as identified sub-sections of that file.

Documents and records are controlled through documented procedures governing review, approval, versioning, availability at the point of use, and protection against loss or unintended use of obsolete versions. Records are retained for at least the lifetime of the device as we define it, and not less than the periods required by the applicable regulations and by contract.

6 Risk Management

Risk management is applied across the full product lifecycle as an integrated part of product realisation, not as a separate administrative step. A risk-based approach governs the control of quality management processes and of product realisation, and the results are captured in the risk management file.

Product Security assesses security risk as an input to that file and holds the authority to withhold a release where a security acceptance criterion is not met. Feedback from production and post-production activities feeds back into risk management, monitoring and improvement, closing the loop from field experience to design.

7 Design Controls and Clinical Evaluation

Design and development is planned and controlled under ISO 13485 clause 7.3. Design plans define stages, reviews, verification, validation and transfer activities, the traceability of outputs to inputs, and the software safety classification assigned to each software item.

Verification includes unit, integration and system testing, static analysis and code review at a depth appropriate to each item's classification. Validation confirms that the product meets its intended use on representative product. Algorithmic components are validated against a defined reference standard, including performance across demographic and epidemiological subgroups representative of the intended screening population.

Automated outputs are presented to a qualified reader for review and are not acted upon as a final clinical determination without that review. This human-in-the-loop principle is designed into the workflow rather than added around it.

8 Monitoring, Feedback and Continual Improvement

Feedback, complaints and post-market information are collected, evaluated and acted upon through documented procedures. Nonconforming outputs are identified, controlled and dispositioned, and rework runs through the design change process rather than as an ad-hoc modification.

The quality management system is examined through a planned internal audit programme in which auditors do not audit their own work, and it is reviewed by top management at planned intervals for continuing suitability, adequacy and effectiveness. Corrective and preventive actions are managed to root cause and verified for effectiveness.

9 Independent Quality and Security Functions

The Quality and Product Security functions report to top management and are organisationally independent of engineering. A determination that an output fails its acceptance criteria cannot be overridden by the function that produced it.

The full Quality Manual and supporting procedures are available for review under NDA. This Statement is a public summary and is superseded by the controlled documents themselves where the two differ.