DHT Governance · Clinical Trials · MDR · IVDR · AI Act · FDA · GCP
Govern the devices your trial relies on — before an inspector does.
Use a device outside its manufacturer's intended purpose and your protocol can make it investigational, make you its manufacturer, or trigger a clinical investigation. Data-integrity and data-protection rules apply whatever its status. We assess the perimeters every device and system in your trial opens, record the decision with its reasoning, and keep that record defensible for the life of the study.
regulatory perimeters — what a device is exposed to
8
assessment products, quoted in writing before work begins
43
regulatory position papers behind the method
2–3 weeks
to a Snapshot Regulatory Impact Assessment
Nothing about the hardware changed. The protocol did. That is why we assess use, not product category.
"No obligation" is a conclusion you earn by assessing — never a starting assumption.
Sponsors and CROs deploy wearables, biosensors, point-of-care devices, connected monitors, software as a
medical device and participant-owned phones on the assumption that a device is out of scope because it is
commercially available, or because it is not the investigational product. Neither fact settles the question.
What settles it is use. The moment a device informs an endpoint, a safety decision or a
regulatory submission, obligations attach — and they do not attach one at a time. Medical device rules,
GxP and computer system validation, data protection, human factors, configuration control, economic-operator
duties and protocol design each open a perimeter, and the perimeters stack.
The same watch can carry almost no obligations in one protocol and a stack of them in the next.
Nothing about the hardware changed — the protocol did. qointa is built for exactly that problem: one decision
framework that reads EU MDR, IVDR, the EU AI Act, FDA requirements and ICH GCP together, across every class
of technology a trial actually uses.
Nothing about the hardware changed. The protocol did. That is why we assess use, not product category.
Pick a use and watch the perimeters open.
Seven perimeters. One controlled loop.
Every device in your trial is assessed against all seven. The result is a recorded, reproducible decision — not an opinion.
Medical device
Is it a device under EU MDR or IVDR, and under FDA rules? Classification, rule application and the justification behind it.
Does it fall under GCP, 21 CFR Part 11, EU GMP Annex 11 or, for EU trials, the EMA 2023 guideline on computerised systems and electronic data? Validation scope, audit trails, ALCOA+ data integrity.
Manufacturer, authorised representative, importer, distributor, or system or procedure-pack producer: which role you hold, in which jurisdiction, and what it obliges you to do.
Hardware you did not supply, or a market where the same device answers differently. Both reopen questions you may have closed. A Snapshot assesses one device in one setting; comparing several markets side by side is a wider assessment.
The model is part of the measuring system. Its version, training data and change control need the same evidence chain as the device that produced the raw signal.
Before you commission anything, run the DHT readiness scorecard. Ten minutes, no sign-up, no sales call attached to the result. It scores your programme across the same seven perimeters used above and tells you which of them are actually open — so the decision to bring anyone in is made on evidence rather than on unease.
Start with a Snapshot RIA: one device, one protocol, 2–3 weeks
The entry engagement. Defined scope, a written fee before work begins, and a stated delivery date — no work starts until you accept both.
What you provide
The device and its intended use in the study, the endpoints that depend on it, the participating countries, and who supplies and ships it. Ten minutes if you have the protocol to hand.
What you receive
A recorded decision per perimeter with its rationale, a decision register entry, the trigger list, an evidence index, and a 45-minute readout with the specialist who did the work.
What it is not
Not multiple devices or jurisdictions compared, not execution of remediation, not a regulatory filing, and not legal advice. It records a position and the reasoning behind it.
qointa is a specialist practice, not a generalist firm with a digital health page. The
people who run the assessments have sat on both sides of this problem: Phase II–IV trial
management inside pharma and CRO organisations, founding and running an integrated eClinical
platform, taking a device through EU MDR as a manufacturer, and holding accountable regulated
roles — Qualified Person, PRRC, legal representative.
That record is prior experience held by members of the team, stated as
such. qointa BV itself is young; what it inherits is the judgement, and a method that writes
down its reasoning so you are not dependent on ours.
279 sensor-based medical devices are authorised for US marketing — up from 9 a year in 2015 to 51 in 2025.
FDA’s own list runs to 279 entries with final decisions between 30 January 2015 and 22 June 2026 — 263 510(k) clearances, 13 De Novo grants and 3 PMA approvals, held by 164 companies. Authorisations rose from 9 in 2015 to 51 in 2025. Cardiovascular and neurology devices account for 188 of the 279.
These are the devices arriving in your protocol. Authorisation is not the question — what your protocol asks the device to do is.
Six service categories, delivered by people who have sat on both the sponsor side and the vendor side of this problem.
Digital Health Technologies in Trials
End-to-end DHT governance: assessment, classification, fit-for-purpose validation, logistics, data interoperability, training and inspection readiness.
Medical device software under IEC 62304, computer system validation, 21 CFR Part 11 and EU GMP Annex 11 compliance, and ALCOA+ data integrity programmes.
EU authorised representative services for non-EU manufacturers under EU MDR 2017/745 and IVDR 2017/746 — EUDAMED registration, verifying the technical documentation and keeping it available, and vigilance cooperation.
Whole-estate governance: every system, device, integration and algorithm assessed inside one reproducible framework, delivered in five gated phases you fund one at a time.
Turning the per-stakeholder assessment into a living, inspection-ready artefact in the technical file, the validation plan and the TMF — grounded in the risk-based quality management GCP already expects.
A wearable, a sensor, an app, a participant's own phone. We will tell you which regulatory perimeters it opens, what it takes to close them, and what that costs — in writing, before any work starts.
