Flo Health Inc. said its quality system for medical-device software has earned ISO 13485:2016 certification, a standard for device quality processes that does not approve any individual app.
The company announced the certification Nov. 11 after Scarlet assessed the processes Flo uses to develop and support software intended for medical-device use. Flo said the audit found no major issues, but its announcement did not include the certificate or audit report.
Scarlet says its ISO 13485 assessments cover quality management systems, not product conformity; Flo says Scarlet audited its system. The announcement concerns how Flo manages regulated product work; it is not a product-specific conformity finding. Scarlet also says ISO 13485 certification is not a prerequisite for CE or UKCA marking.
The United Kingdom Accreditation Service (UKAS) lists Scarlet NB UK Ltd as accredited to certify ISO 13485:2016 quality management systems. Its scope for active medical devices is limited to software as a medical device. The U.K. government separately lists Scarlet as an approved body for medical devices in Great Britain through Jan. 25, 2029. Those records establish Scarlet’s accreditation and designation; they do not identify Flo’s specific certificate.
The International Organization for Standardization (ISO) describes ISO 13485 as a quality management standard for medical-device design and manufacture and says the 2016 edition remains current. In the United States, the Food and Drug Administration’s Quality Management System Regulation took effect Feb. 2, 2026, and incorporates ISO 13485:2016 by reference for covered device quality requirements. The regulation does not establish that Flo’s app has FDA clearance or authorization.
Flo said its system runs on Ketryx, a platform for regulated product development, and that it plans to apply the same processes to regulated digital-health products in the future. The company said certification involves annual surveillance audits and recertification every three years. Scarlet’s published process describes surveillance checks at 12-month intervals and a certification cycle of no more than three years. Flo did not name a date for its next audit.
