1
Data Architecture & Privacy
IOLDx Clinical is currently deployed as a client-side web application hosted on AWS CloudFront/S3. This is an intentional architectural decision for the early-access phase:
- No patient data leaves the browser. Biometric inputs (axial length, keratometry, ACD) are processed entirely in JavaScript on the user's device.
- No backend database. Session outcomes are stored in
localStorage— scoped to the user's browser, never transmitted. - No user accounts required. No login means no identity data collected.
- Claude Vision API is used only for biometer image parsing (Scan Report import). Images are sent to Anthropic's API via a Lambda proxy. No images are stored or logged.
Privacy by design: A surgeon entering a patient's AL=24.2mm and K=44.5D generates no identifiable health information. IOLDx Clinical does not collect names, DOB, MRN, or any PHI as defined under HIPAA.
Data Storage
Browser localStorage only
✓ No server-side storage
✓ No server-side storage
Data Transmission
Biometer images → Lambda → Claude API (optional)
⚠ Images not retained
⚠ Images not retained
CDN / Hosting
AWS CloudFront + S3
✓ HTTPS enforced, TLS 1.2+
✓ HTTPS enforced, TLS 1.2+
Analytics
Google Analytics 4 (page views only)
✓ No PII collected
✓ No PII collected
2
FDA Regulatory Classification
IOLDx Clinical is a clinical decision support (CDS) tool intended for use by licensed ophthalmic surgeons. Under the 21st Century Cures Act and FDA's 2019 CDS guidance, software that:
- Is not intended to replace clinical judgment
- Displays the basis for its recommendations so clinicians can independently review
- Is used by qualified healthcare professionals
...is classified as non-device CDS and does not require 510(k) clearance.
Current intended use: IOLDx Clinical is intended to assist qualified ophthalmic surgeons in reviewing published defocus curve data and calculating estimated IOL power targets. All outputs must be independently verified by the treating surgeon before clinical use. The software does not perform surgery, does not control medical devices, and does not provide a diagnosis.
All IOL defocus curve data is sourced from FDA Summary of Safety and Effectiveness Data (SSED) or peer-reviewed literature. Sources are labeled on each IOL card.
| Regulation | Applicability | Status |
|---|---|---|
| FDA 21 CFR Part 11 (Electronic Records) | Applies to records submitted to FDA. IOLDx does not submit records to FDA. | Not Applicable |
| FDA 510(k) Medical Device | Non-device CDS under 21st Century Cures Act — does not replace clinical judgment | Exempt |
| FDA CDS Guidance (2019) | Displays basis for recommendations; used by qualified professionals | Compliant |
| HIPAA Privacy Rule | No PHI collected or transmitted in current deployment | Not Applicable (v1) |
| HIPAA Security Rule | Required for enterprise cloud deployment with stored PHI | Roadmap |
| SOC 2 Type II | Required for enterprise SaaS with institutional contracts | Roadmap |
| GDPR (EU) | No personal data collected from EU users in current deployment | Compliant (v1) |
3
Scalability & Cloud Architecture Roadmap
The current deployment is intentionally lightweight for early validation. The enterprise architecture roadmap is designed to support acquisition-level scale:
Current (v1 — Early Access)
✓ AWS CloudFront + S3 CDN
✓ AWS Lambda API proxy
✓ Flutter Web (cross-platform)
✓ Client-side only (no DB)
— No user accounts
— Local storage only
✓ AWS Lambda API proxy
✓ Flutter Web (cross-platform)
✓ Client-side only (no DB)
— No user accounts
— Local storage only
Enterprise Roadmap (v2)
→ Supabase / PostgreSQL cloud DB
→ Auth0 / Supabase Auth (SSO-ready)
→ HIPAA BAA with cloud provider
→ Role-based access (surgeon/admin)
→ Practice-level outcomes dashboard
→ HL7 FHIR export capability
→ Auth0 / Supabase Auth (SSO-ready)
→ HIPAA BAA with cloud provider
→ Role-based access (surgeon/admin)
→ Practice-level outcomes dashboard
→ HL7 FHIR export capability
For Alcon enterprise integration: IOLDx Clinical's Flutter Web architecture supports direct embedding into existing web portals. The API layer is designed for ARGOS/Lenstar CSV import and could be extended to support SMARTCataract or NGENUITY data export with standard REST endpoints. Timeline: 60–90 days for enterprise API integration post-agreement.
4
Clinical Data Sources & Methodology
All defocus curve data used in IOLDx Clinical is sourced from publicly available regulatory submissions and peer-reviewed literature. No proprietary or confidential manufacturer data is used.
| IOL | Data Source | Type |
|---|---|---|
| Clareon PanOptix (TFNT00) | FDA SSED PMA P930014/S131 | FDA SSED |
| Clareon Vivity (DFT015/DFW015) | FDA SSED PMA P930014/S152 | FDA SSED |
| AcrySof IQ Monofocal | FDA SSED PMA P930014 | FDA SSED |
| Clareon Monofocal | FDA SSED PMA P930014/S148 | FDA SSED |
| TECNIS Symfony (ZXR00) | FDA SSED PMA P060040/S050 | FDA SSED |
| TECNIS Synergy (DFR00V) | FDA SSED PMA P060040/S079 | FDA SSED |
| IC-8 Apthera | FDA SSED PMA P200037 | FDA SSED |
| Additional IOLs (6) | Peer-reviewed literature + manufacturer data | Generated |
Generated data methodology: For IOLs without publicly available FDA SSED defocus curve data, curves are generated using published clinical study mean logMAR values at standard defocus steps (0, −0.5, −1.0, −1.5, −2.0, −2.5, −3.0 D) from peer-reviewed sources. These are clearly labeled "Generated" in the interface. Surgeons should verify against current manufacturer specifications.
5
Enterprise Inquiries & Compliance Documentation
For enterprise deployment, institutional licensing, HIPAA Business Associate Agreement (BAA), or Alcon integration discussions:
Developer Contact
Balamurali Vasudevan, BSOptom, PhD, MBA
Optometrist & Clinical Technologist
balamuralivasudevan@gmail.com
Optometrist & Clinical Technologist
balamuralivasudevan@gmail.com
Available Documentation
✓ Intended Use Statement
✓ Data Flow Diagram
✓ Source code (on request)
→ BAA template (on request)
→ SOC 2 readiness assessment
✓ Data Flow Diagram
✓ Source code (on request)
→ BAA template (on request)
→ SOC 2 readiness assessment