NeuroSync, Inc.

During an inspection of your firm located in Holliston, MA, on January 6, 2025, through February 5, 2025, an investigator from the United States Food and Drug Administration (FDA) determined that your firm manufactures EYE-SYNC, consisting of a virtual reality headset and tablet computer which performs eye assessments. Under section 201(h) of the Federal Food, Drug, and Cosmetic Act (the Act), 21 U.S.C. § 321(h), these products are devices because they are intended for use in the diagnosis of disease or other conditions or in the cure, mitigation, treatment, or prevention of disease, or to affect the structure or any function of the body.

This inspection revealed that these devices are adulterated within the meaning of section 501(h) of the Act, 21 U.S.C. § 351(h), in that the methods used in, or the facilities or controls used for, their manufacture, packing, storage, or installation are not in conformity with the current good manufacturing practice requirements of the Quality System regulation found at Title 21, Code of Federal Regulations (CFR), Part 820.

We received your response, dated February 27, 2025, concerning our investigator’s observations noted on the Form FDA 483 (FDA 483), List of Inspectional Observations, that was issued to your firm. These violations include, but are not limited to, the following:

1. Failure to establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met, as required by 21 CFR 820.30(a). Specifically:

a. You failed to verify your device design to confirm that the design output meets the design input requirements, as required by 21 CFR 820.30(f). You did not implement your Design Controls, Software Design, Development and Maintenance Procedure, Section 6.4, which requires that “(b)(4).” For example:

i. Your EYE-SYNC Design Input Requirements, DIR-10101, Rev 007, includes a design requirement related to tracking performance accuracy that states, “(b)(4).” However, your TR-10332 Eye Tracking Performance Test Result – (b)(4), identifies that the average accuracy was (b)(4), and the test report was approved on August 16, 2021, even though this requirement was not met.

ii. Your EYE-SYNC Software Requirements Specification, SRS-10102, states, “If the data quality is low the users will be warned. If the data quality is insufficient, the users are alerted, and the analysis result score is not offered to the user for the given assessment.” However, you did not have any testing to verify that low quality data results in a warning to the user, and that insufficient data quality does not present a score.

b. You failed to identify, document, validate or where appropriate verify, review, and approve of design changes before their implementation, as required by 21 CFR 820.30(i). You did not implement your Design Controls, Software Design, Development and Maintenance Procedure, Section 6.7.iii, which requires that “Changes are identified, documented, validated or where appropriate verified, reviewed, and approved prior to the implementation of the change.” For example:

i. ECO 24-0033 released EYE-SYNC tablet software version 1.2.9_25_1234 to correct an issue which allowed the device to continue collecting data in the event the headset is removed, potentially resulting in the incorrect color of the data quality indicator. However, associated software testing in TR-10139, Rev 34 did not verify that version 1.2.9_25_1234 corrected this issue.

c. You failed to establish design inputs to ensure that the design requirements relating to a device are appropriate and address the intended use of the device, including the needs of the user and patient, as required by 21 CFR 820.30(c). You did not implement your Design Controls, Software Design, Development and Maintenance Procedure, Section 6.2 Requirements, which explain that design inputs “…(b)(4).”For example:

i. EYE-SYNC Design Input Requirements, DIR-10101, Rev 007, lists requirements that are not related to the current device. For example, requirement C2.3, Latch Fit, states “(b)(4),” and requirement C4.2 states “Device shall have USB (b)(4) of similar form factor to Eye Tracker Unit (ETU).” Both of these requirements are outdated and refer to Model X02 of EYE-SYNC, which was replaced by model X03 in April 2021.

d. You failed to validate your device design to ensure that devices conform to defined user needs and intended uses, as required by 21 CFR 820.30(g). For example,

i. Your Risk Management Procedure, SOP-10011, Rev 002, states that the level of risk is determined by Risk Priority Numbers (RPN) and that the design (b)(4) will use the severity and occurrence rating scales described in the procedure. However, your software (b)(4), RA-10110, Rev 006, does not use RPNs, and the impact and probability scale used to calculate inherent and residual risk are not adequately defined within SOP-10011.

We reviewed your firm response dated February 27, 2025, and concluded that it is not adequate. We understand that you opened several CAPAs to identify necessary updates to your design control processes; however, your response does not provide sufficient detail to ensure that these failures will not recur and that your current devices meet all your design control requirements. For example, your CAPA 202502053 for design change indicates that Test Reports and ECOs issued from February 4-19, 2025, will be reviewed but does not explain why older reports are not being reviewed.

Our review also noted that the EYE-SYNC system, as released to users beginning April 2021, uses either the (b)(4) or (b)(4) as the eye tracking unit of the EYE-SYNC. We encourage you to perform a thorough review of your current design to ensure any changes made to the EYE-SYNC after FDA clearances have been reviewed properly. For example, for the above hardware design change, we would expect your firm to have documentation of the appropriate verification, review, and approval of design changes before their implementation. In response to this Warning Letter, please provide a timeline of when all proposed corrective actions to your design control processes will be completed, including when you will complete a review of your current device to ensure all specified design requirements are met.

2. Failure to establish and maintain procedures for implementing corrective and preventive action, including implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems, as required by 21 CFR 820.100(a)(5). For example, CAPA 202110081 was opened on October 8, 2021, to address higher than expected assessment scores. The CAPA included a corrective action that stated, “To correct the core non-conformity, the raw data capture implementation of the eye tracker software must be updated to appropriately capture head and eye position data to accurately reflect scores within the typical range.” During the inspection, your firm indicated that a software correction to the eye tracker software had not been made.

We reviewed your firm response dated February 27, 2025, and concluded that it is not adequate. You have not provided documentation to demonstrate that you have completed a corrective action for the above CAPA.

3. Failure to establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements, as required by 21 CFR 820.50. You have not implemented your Supplier Management Procedure, SOP-10025, Rev 004. Specifically:

a. Your vendor who manufactures the EYE-SYNC’s Eye Tracker, p/n P-10114, has not been evaluated since March 15, 2022, despite your Supplier Management Procedure and Supplier Status Form, F-10093, identifying that the supplier requires (b)(4) performance evaluations.

b. Your software vendor who supplies the sensor which is placed in the Eye Tracker is not listed on your firm's Approved Supplier List and has not been approved or evaluated as per your procedure.

We reviewed your firm response dated February 27, 2025, and concluded that it is not adequate. You have not provided documentation that the above vendors have successfully completed evaluations as per your procedures.

4. Failure to establish and maintain procedures for acceptance activities. Acceptance activities include inspections, tests, or other verification activities, as required by 21 CFR 820.80(a). For example, your firm’s Release for Shipment Procedure, SOP-10029, Rev 003, describes the activities needed to release a finished device, which include "visual inspection of product to ascertain that all specified operations are completed and to detect any visible quality problems.” During the inspection, you confirmed the employee tasked with finished device inspection works (b)(4) and does not review test reports or perform a visual inspection as required by your procedure.

We reviewed your firm response dated February 27, 2025, and concluded that it is not adequate. You have not provided documentation to show that your corrective actions have been implemented to ensure visual inspection requirements are currently being performed as required by your procedure.

Our inspection also revealed that your firm’s EYE‐SYNC Eye Tracker devices are misbranded under section 502(t)(2) of the Act, 21 U.S.C. § 352(t)(2), in that your firm failed or refused to furnish material or information respecting the device that is required by or under section 519 of the Act, 21 U.S.C. § 360i, and 21 CFR Part 806 – Medical Devices; Reports of Corrections and Removals. Violations include, but are not limited to, the following:

Failure to submit any report required within 10 working days of initiating a correction or removal, as required by 21 CFR 806.10. For example, on or about September 19, 2023, your firm replaced/removed Pico 2 components of EYE‐SYNC devices. The devices would stall or freeze, resulting in a delay of diagnostic procedure or inability to assess a patient. CDRH’s risk assessment concluded the devices failing to perform as intended may cause temporary or medically reversible adverse health consequences or a remote probability of serious adverse health consequences. This action meets the definition of a medical device correction or removal initiated to reduce a risk to health posed by the device, for which you are required to submit a Report of Correction or Removal to FDA. You did not submit a Medical Device Report of Correction or Removal to FDA for this action.

Your firm’s response to Observation 12 of the FDA‐483, dated February 27, 2025, is not adequate. You have not submitted Reports of Correction or Removal to FDA as of this date.

Our inspection revealed that your devices are also misbranded within the meaning of section 502(c) of the Act, 21 U.S.C. § 352(c), because a word, statement, or other information required by or under authority of section 519 of the Act, 21 U.S.C. § 360i, to appear on the label or labeling of the devices was not prominently placed thereon with such conspicuousness (as compared with other words, statements, designs, or devices, in the labeling) and in such terms as to render it likely to be read and understood by the ordinary individual under customary conditions of purchase and use. In particular, 21 CFR 801.20(a) – which was promulgated under authority of section 519 of the Act, among other provisions – requires, with exceptions not relevant here, that the label and device package of every medical device bear a unique device identifier (UDI) that meets the requirements of 21 CFR Part 801, subpart B, and 21 CFR Part 830. The labels of the EYE-SYNC Model X03 devices do not bear such a UDI.

Specifically, the labels for EYE-SYNC Model X03 do not include a device identifier within the meaning of 21 CFR 801.3 or 830.3, and there is no UDI presented in easily readable plain-text on the label of EYE-SYNC Model X03 (see 21 CFR 801.40(a)(1)), and there is no UDI presented in machine-readable form that uses (b)(4) technology on the label of EYE-SYNC X03 (see 21 CFR 801.40(a)(2)).

Your response dated February 27, 2025, is not adequate. Your firm promised to obtain mock-ups of revised labeling for review by March 27, 2025, and to obtain UDIs for issuing agency (b)(4), update procedures to include them, and submit GUDID entries. However, you have not provided revised labels as evidence that your labels will include valid UDIs as of this date.

Your firm should take prompt action to address any violations identified in this letter. Failure to adequately address this matter may result in regulatory action being initiated by the FDA without further notice. These actions include, but are not limited to, seizure, injunction, and civil money penalties.

Other federal agencies may take your compliance with the FD&C Act and its implementing regulations into account when considering the award of federal contracts. Additionally, should FDA determine that you have Quality System regulation violations that are reasonably related to premarket approval applications for Class III devices, such devices will not be approved until the violations have been addressed. Should FDA determine that your devices or facilities do not meet the requirements of the Act, requests for Certificates to Foreign Governments (CFG) may not be granted.

Please notify this office in writing within fifteen business days from the date you receive this letter of the specific steps your firm has taken to address the noted violations, as well as an explanation of how your firm plans to prevent these violations, or similar violations, from occurring again. Include documentation of the corrections and/or corrective actions (which must address systemic problems) that your firm has taken. If your firm’s planned corrections and/or corrective actions will occur over time, please include a timetable for implementation of those activities. If corrections and/or corrective actions cannot be completed within fifteen business days, state the reason for the delay and the time within which these activities will be completed. Your firm’s response should be comprehensive and address any violations included in this Warning Letter. If you believe that your products are not in violation of the FD&C Act, include your reasoning and any supporting information for our consideration as part of your response.

Your firm’s response should be sent via email to Gina Brackett, Establishment Assessment Team 1 (EAT-1) Assistant Director at CDRHEnforcement@fda.hhs.gov. Refer to CMS case #705489 when replying. If you have any questions about the contents of this letter, please contact: Karen Archdeacon, Compliance Officer, at karen.archdeacon@fda.hhs.gov.

Finally, you should know that this letter is not intended to be an all-inclusive list of the violations at your firm’s facility. It is your firm’s responsibility to ensure compliance with applicable laws and regulations administered by FDA. The specific violations noted in this letter and in the Inspectional Observations, FDA 483, issued at the close of the inspection may be symptomatic of serious problems in your firm’s manufacturing and quality management systems. Your firm should investigate and determine the causes of any violations and take prompt actions to address any violations and bring the products into compliance.