ZYTO Technologies, Inc. MARCS-CMS 652316 — June 21, 2023

WARNING LETTER

---

• Delivery Method: VIA UNITED PARCEL SERVICE
• Product: Medical Devices

---

• Recipient: Dr. Vaughn R. Cook; Chairman and Owner/Founder; ZYTO Technologies, Inc.; 1172 W. 700 N., Suite 300; Lindon, UT 84042; United States

• Issuing Office: Division of Medical Device and Radiological Health Operations West; United States

---

WARNING LETTER
CMS 652316

June 21, 2023

Dear Dr. Cook,

During an inspection of your firm located in Lindon, UT on December 5 through 13, 2022, an investigator from the United States Food and Drug Administration (FDA) determined that your firm manufactures the ZYTO Hand Cradle Galvanic Skin Response (GSR) device and associated proprietary software used to scan a patient to identify “stressors” and “balancers.” Your website refers to using the ZYTO as part of a “journey to wellness." However, some of the “stressors” identified or diagnosed by the ZYTO Hand cradle and associated proprietary software include diseases and conditions such as Alzheimer’s disease, human immunodeficiency virus (HIV), Parkinson’s disease and melanoma, and some of the “balancers” recommended by the software represent specific treatments or mitigations for a given “stressor.” Under section 201(h) of the Federal Food, Drug, and Cosmetic Act (the Act), 21 U.S.C. 321(h), these products are devices because they are intended for use in the diagnosis of disease or other conditions or in the cure, mitigation, treatment, or prevention of disease, or are intended to affect the structure or function of the body.

Our inspection revealed that the ZYTO Hand Cradle GSR and associated proprietary software is adulterated under section 501(f)(1)(B) of the Act, 21 U.S.C. 351(f)(1)(B), because you do not have an approved application for premarket approval (PMA) in effect pursuant to section 515(a) of the Act, 21 U.S.C. 360e(a), or an approved application for an investigational device exemption (IDE) under section 520(g) of the Act, 21 U.S.C. 360j(g). The device is also misbranded under section 502(o) of the Act, 21 U.S.C. 352(o), because you did not notify the agency of your intent to introduce the device into commercial distribution, as required by section 510(k) of the Act, 21 U.S.C. 360(k). For a device requiring premarket approval, the notification required by section 510(k) of the Act, 21 U.S.C. 360(k), is deemed satisfied when a PMA is pending before the agency. 21 CFR 807.81(b). The kind of information you need to submit in order to obtain approval or clearance for your device is described on the Internet at http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/HowtoMarketYourDevice/default.htm. The FDA will evaluate the information you submit and decide whether your product may be legally marketed.

The ZYTO Hand Cradle was cleared under K111308 with the following intended use: “the measurement of galvanic skin response (GSR).” However, your firm’s promotion of the device represents a major change or modification to its intended use, for which your firm lacks clearance or approval. Thus, although originally classified as Class II under 21 CFR 882.1540, the device does not qualify for the exemption from 510(k) granted in 2019 for that generic type of device (see 84 FR 71794 (December 30, 2019)) because, among other things, the device “is intended for a use different from the intended use of a legally marketed device in that generic type of device.” See 21 CFR 882.9(a).

Further, as we informed you previously, the ZYTO associated proprietary software is a component of the ZYTO Hand Cradle and shares its classification.

In our June 11, 2015, correspondence after the Warning Letter, we stated that per 21 CFR, part 820.3(c), the definition of a component includes software intended to be included as part of a finished, packaged, labeled device. Components of a device are defined as the device itself. The letter further states “…The software, downloaded by end users for the intention of use with your device is considered a component.”

Per our Regulatory Meeting, held August 28, 2015, you were informed again that our review found that your associated proprietary software was intended to be used with the ZYTO Hand Cradle GSR device. You were informed that because the ZYTO Hand Cradle GSR and the software did not function alone but must be used together, the software was a component of the device.

This continues to be the case. For example, your website explains how the ZYTO Hand Cradle GSR and the associated proprietary software function together as follows:

“The ZYTO Hand Cradle measures the user’s galvanic skin response and sends that data directly to the ZYTO software for analysis. The [galvanic skin responses] GSR data is correlated and compared with Virtual Items in the software database.”

“Each Virtual Item represents a different physical item. Every time the software introduces a Virtual Item, a corresponding GSR reading is taken by the Hand Cradle. Each new response is measured and tracked in comparison to the GSR baseline reading.”

Our investigator documented that the virtual items are added to the library in-house using a machine referred to as the “Tower”. Your representative explained that to create a library item, your firm places the item in front of the Tower and the Tower then scans and identifies the item with a generated code from the system which it associates with the energy of that item. This becomes a virtual library item. In addition, your firm’s promotional materials indicate that the hand cradle can now perform this function as well, so that users can add their own virtual items.

Your website further states:

“ZYTO’s proprietary software analyzes GSR data for patterns of coherence—looking for the ways your GSR readings fluctuate or shift in response to each Virtual Item.”

Your proprietary software is a component of the ZYTO Hand Cradle GSR.

Your firm is promoting the ZYTO Hand Cradle GSR and associated proprietary software outside its cleared intended use.

The ZYTO Hand Cradle Galvanic Skin Response System was cleared under K111308 only to measure galvanic skin responses. Despite prior notice from FDA in your 2015 Warning Letter and some corrections made around that time, your firm has added back promotion of the ZYTO Hand Cradle GSR for use in diagnosing diseases or conditions, including determining whether someone responds to a specific allergen, and continues to predict biological responses to a wide range of virtual stimuli including homeopathic nosodes and nutritional supplements.

For example, your current website explains that first the system scans for general categories of “Biomarkers” which might be specific locations or anatomy of the body such as organs, muscles, or bones. Next, there is a subset of “Stressor” virtual items which are scanned for, including heavy metals, bacteria, parasites, viruses, electromagnetic fields, chemicals, allergens, lifestyle choices, and foods.

While a scan may consist of only a stressor Virtual Item scan to reveal which items may warrant further attention, a balancer Virtual Item scan often follows to determine which items bring the stressors into range. The website further states ZYTO software contains thousands of “Balancer” Virtual Items from over 250 health and wellness companies in these categories: supplements, essential oils, homeopathics, herbs, flower essences, or topicals.

Most importantly, your virtual item library identifies items which you describe could be stressors or balancers including, but not limited to:

• Alzheimer’s
• E. coli
• Ebola
• Fibromyalgia
• Flu
• Hepatitis (A, B, C, D, and E)
• Herpes, various forms
• Human immunodeficiency virus (HIV)
• Leukemia, various forms and related nosodes
• Lupus, various forms
• Lymphoma, Melanoma
• Parkinson’s disease
• Staphylococcus aureus
• Zika viruses
• Food allergen’s including but not limited to soy, milk, eggs, peanuts, flaxseed, and fish
• Environmental allergens including but not limited to “Bee Pollen”
• Homeopathic nosodes to above listed disease states, such as but not limited to: asthma, cholera, hepatitis, lupus, infant botulism, scarlet fever, malignant rectal polyps, uterine polyps, leukemia, polio, rabies, and Parkinson’s disease.

1. You have added disease claims back to your software library. The “stressors” identified or diagnosed by the ZYTO Hand cradle and associated proprietary software include diseases and conditions such as Alzheimer’s, HIV, Parkinson’s disease and melanoma, and the identification of these by the device amount to diagnoses. These uses fall outside the device’s cleared intended use to measure galvanic skin response and constitute a major change or modification to the device’s intended use, for which your firm lacks clearance or approval.

2. Your firm continues to market the ZYTO Hand Cradle GSR to predict biological responses to a range of virtual stimuli, as discussed in your 2015 Warning Letter. The “balancers” recommended by the software for the “stressors” represent specific treatments, mitigations, or suggestions to prevent such diseases and conditions. You’ve been notified this represents a major change or modification to the device’s intended use for which your firm lacks clearance or approval.

The promotion of the ZYTO Hand Cradle GSR and associated proprietary software in examples 1 - 2 above for use in diagnosing a disease or condition, including determining whether someone responds to a specific allergen, and predicting biological responses to a wide range of virtual stimuli, including homeopathic nosodes or nutritional supplements, fall outside the device’s cleared intended use to measure galvanic skin response and constitute major changes or modifications to the device’s intended use.

Observations Pertaining to Quality System Regulations

The December 2022 inspection also revealed that these devices are adulterated within the meaning of section 501(h) of the Act (21 U.S.C. § 351(h)), in that the methods used in, or the facilities or controls used for, their manufacture, packing, storage, or installation are not in conformity with the Current Good Manufacturing Practice (CGMP) requirements of the Quality System (QS) regulation found at Title 21, Code of Federal Regulations (CFR), Part 820. As noted above, your proprietary software which works with the ZYTO Hand Cradle GSR is a component of the ZYTO Hand Cradle GSR. Thus, it is subject to all applicable regulatory requirements, including design controls.

We received a response from Mr. Ford dated January 5, 2023, concerning our investigator’s observations noted on the Form FDA 483, List of Inspectional Observations, that was issued to you. We address this response below, in relation to each of the noted violations. While reviewing this letter, be aware FDA defines “establish” to include actions to define, document, and implement. The violations include, but are not limited to, the following:

1. Failure to adequately establish procedures for design controls, as required by 21 CFR 820.30.

A. You have not conducted design verification and validation testing per the requirements of 21 CFR 820.30(f) and 820.30(g), and your SOP-00302 Design Verification and Validation, rev D, eff 12/14/2020, for the ZYTO Hand Cradle GSR and associated proprietary software, or the device library development processes used in house and by customers.

SOP-00302 requires you to perform design verification to provide objective evidence that specified requirements have been fulfilled, to confirm that the design output meets the design input requirements, and to document results in the design history file (DHF). It also requires you to perform design validation to establish objective evidence that device specifications conform to user needs and intended use(s). The procedure states you shall include software validation and risk analysis, where appropriate, and activities shall be documented in the DHF.

i. You failed to verify or validate the ZYTO Hand Cradle GSR and associated proprietary software.

During our inspection, you provided the Hardware Verification and Validation (TR-00370, Rev. A, eff 06/03/2021) noted in DHF-00664 for the ZYTO Hand Cradle GSR. TR-00370 states these “procedures are not intended to test the engineering of the hand cradle. Instead, they focus on the software’s interactions with the hardware.” TR-00370 defines the testing procedures used to verify the hardware software user interface requirements, as specified in SRS-00288. SRS-00288 includes a (b)(4) protocol to test the (b)(4) between the software and ZYTO Hand Cradle GSR. However, your Quality Supervisor stated your firm has no documented evidence to provide to demonstrate this testing was actually performed. She further stated you have no evidence to verify that design outputs meet design inputs. Despite no evidence of conducting this testing, the DHF shows TR-00370 as “Approved” on 6/3/2021.

Your firm’s attorney stated that you have no documented validation of the virtual items in the ZYTO software.

Your firm also received a complaint of an “abnormal” or “empty” scan “where no stressors were found out of range, but many products were recommended for use.

We reviewed your response regarding observation 1 and the completion of the DHF activities and understand that you will review TR-00370 and SRS-00288 to confirm verification and validation that design outputs meet the design inputs to be completed by 6/30/23, subject to “Development availability”. We reviewed your response and determined your response is inadequate, as evidence of corrective actions to this observation were not provided. Additionally, corrective actions were not planned for completion until over six months after the inspection concluded, yet you were notified of this violation both during our August 2015 Regulatory Meeting and again during your 2019 inspection, and at that time you promised corrections.

ii. You failed to validate the ZYTO Tower or Hand Cradle GSR for addition of virtual library items.

The Tower is used in-house for the transmission, interpretation, and creation of virtual library items. This has not been validated. Currently, your firm has directed customers to use the ZYTO Hand Cradle GSR to add new virtual library items for biological preference prediction. We observed your firm’s promotional materials indicate you have replicated the prior functionality of the Tower with what you describe as an antenna inside the ZYTO Hand Cradle GSR. Your website contains videos with instructions (in both the Immunity Biosurvey and the Digestive Biosurvey) on how to use the ZYTO Hand Cradle GSR to perform the same function as the Tower by your clients. This use of the ZYTO Hand Cradle GSR for the transmission, interpretation, and creation of virtual library items has also not been validated.

During our inspection, your firm’s attorney stated you have no documented validation of use of the Tower to identify and add virtual items to the library. He further stated there would be no way to test the process used to input these virtual items.

We reviewed your response specific to the validation of “ZYTO 5 Software and the EVOX phrases” and documentation of virtual items (currently done in house by the Tower) and determined it is inadequate as your recent response states “Documentation for the virtual items in the ZYTO 5 Software and the EVOX phrases is not necessary as the process of creating them is definitional—the unique identifier virtual item name is created (b)(4).” We do not agree that documentation demonstrating validation for the virtual items in the ZYTO 5 Software is unnecessary. Medical devices and software controlling them require design validation under 21 CFR Part 820.30.

B. You have not conducted design reviews as required by 21 CFR 820.30(e), and your procedure, SOP-00301 Design Control and Project Management, rev K, eff 12/21/2020.

Your procedure describes design reviews as a documented, comprehensive, systematic examination of a design to evaluate the adequacy of the design requirements, to evaluate the capability of the design to meet these requirements and to identify problems at appropriate stages of the process. Your procedure also states that these should be documented in the DHF.

The DHF for the ZYTO Hand Cradle GSR, DHF-00664, shows the Design Review is “in process” with no associated file or date. The DHF is signed as approved as of 6/8/2021; however, you do not have a documented design review as required by 21 CFR 820.30(e). You have been marketing this product since at least 2019 with no evidence that this design review requirement has been met.

We reviewed your response and determined your response is inadequate as it does not address why the design review was not completed, why the DHF was signed and approved when the design reviews showed as “In Progress”, and corrective actions are not planned for completion until 6/30/2023, yet you were notified of this violation in 2019 and promised corrections at that time.

2. Failure to adequately establish procedures for corrective and preventive action, as required by 21 CFR 820.100(a).

A. You failed to identify the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems.

Specifically, your Corrective and Preventive Actions (CAPA) procedure, SOP-01002, requires assignees to investigate the identified issue(s) to uncover and eliminate potential causes as identified in the CAPA and document their activities. You failed to implement the requirements of your procedure. For example, CAPA records 091719001 and 052720001 were opened based on customer complaints. The related ZYTO Hand Cradle GSRs were replaced, and the records state NCR testing was conducted but neither record shows the cause of the ZYTO Hand Cradle GSR shocking the patient / user or what action should be taken to prevent recurrence. In your uncontrolled testing record titled “Subject Hand Cradle: (b)(4) Hand Cradle Tested” tied to a related complaint serial number, you confirmed a user was shocked during your own internal testing. Yet still no investigation was performed to see what caused the ZYTO Hand Cradle GSR to shock patients / users. Instead, the record states the customer account was terminated, and therefore no follow up is needed. The other CAPA associated complaint record says the customer was happy with their replacement; however, replacing one ZYTO Hand Cradle GSR with another does not address the need to identify the nonconformity or underlying quality problem causing the ZYTO Hand Cradle GSR to shock patients / users, or the need to identify the action(s) needed to correct and prevent recurrence, which are required by 21 CFR 820.100(a)(2) and (3), respectively.

B. You failed to verify or validate the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device.

Additionally, SOP-01002 requires CAPA investigations to address and monitor the effectiveness of the actions taken. You failed to implement the requirements of your procedure. For example, six CAPA records were opened as a result of past FDA observations in 2019. Despite having dates and initials documented, all six of these are blank or show “ongoing work” in the verification of effectiveness column regarding what action needs to be taken to ensure effectiveness and no adverse effect of corrective action, in accordance with the SOP and 21 CFR 820.100(a)(4).

We reviewed your response and we cannot determine its adequacy as your corrective actions, including root cause analysis and verification of effectiveness, are in progress and not planned for completion until 6/30/2023, yet you were notified of this violation in 2019.

3. Failure to adequately establish procedures for complaint handling per the requirements of 21 CFR Part 820.198, including an evaluation to determine reportability under 21 CFR Part 803 (Medical Device Reporting), and to document complaint investigations or a record including the reason when no investigation is performed.

Specifically, your SOP-01980, Complaint and MDR System, rev G, eff 8/19/2021, in accordance with 21 CFR 820.198(a)(3), requires an evaluation of complaints to determine whether a medical device report (MDR) is required. Additionally, 21 CFR Part 820.198(b) requires evaluation of complaints to determine whether an investigation is necessary and a record of justification if a complaint does not require investigation.

At least four complaints reviewed during our inspection which were handled using your current complaint handling software and under the current SOP did not include either a documented investigation or a justification for lack thereof and did not include any documented MDR determination. These were complaints of the ZYTO Hand Cradle GSR not scanning, hardware connectivity issues causing the device not to perform scans, and the hand cradle not connecting with some clients which meet both FDA’s definition of a complaint under 21 CFR Part 820.3(b) as well as your procedure’s definition. Additionally, complaints under your previous complaint handling software system related to shocking of patients and users were observed without documented investigations or a written justification.

Section 8.2.2 of the current SOP specifically excludes libraries and biosurveys from the complaint handling process. Since these are functions of the software that controls the ZYTO Hand Cradle GSR, related complaints should be documented, reviewed, and evaluated and, if necessary, investigated per the regulatory requirements set forth in 21 CFR 820.198.

We have reviewed your response which states you will update procedures to ensure all complaints for the ZYTO Hand Cradle GSR hardware and software will undergo root cause analysis, define types of complaints that should require an MDR Questionnaire, and define instructions on how to do so in your new system. We have concluded that your response is inadequate because your corrective actions do not include a retrospective review of cases outside those identified by our Investigator, and corrective actions are not planned for completion until 6/30/2023, yet you were notified of this violation in 2019 and promised corrections at that time.

4. Failure to adequately establish a procedure to ensure DHRs are maintained to demonstrate the device is manufactured in accordance with the DMR, per the requirements of 21 CFR Part 820.184.

Specifically, your SOP-01840, Device History Record (DHR) Procedure, rev L, eff 6/15/2020, states that samples of labels and labeling will be verified in the approved folder of the Document Management System, but does not require inclusion in the DHR of the primary identification label and labeling used for each production unit or the unique device identifier (UDI), or the location of the label, labeling or UDI. 21 CFR 820.184 requires that the DHR include or refer to the location of these items. All 11 DHRs reviewed during our recent inspection were missing this information.

The adequacy of your firm’s response cannot be determined at this time as no evidence of corrective actions has been provided.

5. Failure to develop, maintain, and implement written labeling procedures to control UDI labeling activities pursuant to 21 CFR 820.120.

Specifically, your primary label includes an UDI, yet your firm has not established and maintained procedures to control labeling activities to include performing a labeling inspection to ensure the correct UDI is present. Your Quality Supervisor told our investigator that you do not have any UDI procedures and your SOP-01201 Labeling and Packaging Controls, Rev D, eff 12/21/2020, does not include UDI.

We are requesting that you submit to oradevices3firmresponse@fda.hhs.gov on the schedule below, certification by an outside expert consultant that he/she has conducted an audit of your establishment's manufacturing and quality assurance systems relative to the requirements of the device quality systems (QS) regulation (21 CFR, Part 820). You should also submit a copy of the consultant's report, and certification by your establishment's Chief Executive Officer (if other than yourself) that he or she has reviewed the consultant's report and that your establishment has initiated or completed all corrections called for in the report. The initial certifications of audit and corrections and subsequent certifications of updated audits and corrections (if required) should be submitted to this office by the following dates:

• Initial certifications by consultant and establishment – 12/21/2023
• Subsequent certifications – 12/23/2024 and 12/22/2025

Your firm should take prompt action to address any violations identified in this letter. The ZYTO Hand Cradle GSR is adulterated and misbranded, and we request that you immediately cease any marketing of this product and its accessories. Failure to adequately address this matter may result in regulatory action being initiated by the FDA without further notice. These actions include, but are not limited to, seizure, injunction, and civil money penalties.

Other federal agencies may take your compliance with the FD&C Act and its implementing regulations into account when considering the award of federal contracts. Additionally, should FDA determine that you have Quality System regulation violations that are reasonably related to premarket approval applications for Class III devices, such devices will not be approved until the violations have been addressed. Should FDA determine that your devices or facilities do not meet the requirements of the Act, requests for Certificates to Foreign Governments (CFG) may not be granted.

Please notify this office in writing within fifteen (15) working days from the date you receive this letter of the specific steps you have taken to correct the noted violations, as well as an explanation of how you plan to prevent these violations, or similar violations, from occurring again. Include documentation of the corrective action (which must address systemic problems) you have taken. If your planned corrections will occur over time, please include a timetable for implementation of those corrections. If corrective action cannot be completed within 15 working days, state the reason for the delay and the time within which the corrections will be completed. Your firm’s response should be comprehensive and address any violations included in this Warning Letter. If you believe that your products are not in violation of the FD&C Act, include your reasoning and any supporting information for our consideration as part of your response. This letter notifies you of our findings and provides you an opportunity to address the above deficiencies.

Your firm’s response should be sent to: Jessica Mu, Director of Compliance Branch, at oradevices3firmresponse@fda.hhs.gov. Refer to CMS 652316 when replying. If you have any questions about the contents of this letter, please contact: Lauren Priest at Lauren.Priest@fda.hhs.gov.

Finally, you should know that this letter is not intended to be an all-inclusive list of the violation(s) at your facility. It is your responsibility to ensure compliance with applicable laws and regulations administered by FDA. The specific violation(s) noted in this letter and in the Inspectional Observations, FDA 483, issued at the closeout of the inspection may be symptomatic of serious problems in your firm’s manufacturing and quality assurance systems. Your firm should investigate and determine the causes of the violation(s) and take prompt actions to correct the violation(s) and to bring your products into compliance.

Sincerely,
/S/

CAPT Nina Mezu‐Nwaba, Deputy Director
Office of Health Technology 5 – Office of
Neurological and Physical Medical Devices
Office of Product Evaluation and Quality
Center for Devices and Radiological Health

/S/

Shari J. Shambaugh, Program Division Director
Office of Medical Device and Radiological Health
Division 3

Cc: Ms. Kami J. Howard, President and CEO