Harder Populations, Higher Bar — Paediatric and Vulnerable Participants
A cross-cutting reading of the series — the perimeters do not change, but the evidence each one demands rises, and every rise has a rule behind it
REGULATORY OPERATIONSA DHT design validated in general adults cannot be carried across to children or adults lacking capacity without adding evidence at every perimeter at once.
The population is a multiplier, not a footnote: usability, consent, data protection and data quality all rise together, and every rise has a rule behind it. Settle the additions in the design, not at submission — discovering the gap at ethics review, or in data that cannot be analyzed, costs far more.
The perimeters do not change; the evidence each one demands does
| Perimeter | How it intensifies | Evidence needed |
|---|---|---|
| Human factors | Reduced vision, dexterity, literacy or developmental stage; a carer | Usability studies in the target population and with carers |
| Consent | Representative consent (EU) or parental permission (US); assent | Consent model by age and capacity band; re-consent at legal competence |
| Data protection | Children's data need additional conditions and safeguards | Children's-data safeguards with a DPIA (GDPR Art. 35); COPPA / ICO |
| Endpoint validation | Healthy-adult measures may not hold in the target population | Re-validation in the actual population (ICH E11(R1) / E11A) |
| Data integrity | Carer-assisted or proxy entry raises attribution questions | An attribution model for proxy entry: who acted, in the audit trail |
Vulnerability raises four obligations at once; the consent rule varies
Vulnerability raises the obligation across usability, consent, data protection and data quality at the same time — a general-adult design cannot simply be pointed at a vulnerable one.
EU: the legally designated representative consents, the minor takes part, refusal is respected, re-consent at legal competence. US: parent or guardian permits; child assents where capable.
Health data are special-category for every participant; specific here are additional protection, a DPIA, and — outside the EU — COPPA in the US and the ICO Children's Code in the UK.
A third party operating the device or entering data breaks the assumption that the person who acted is the participant — it touches consent, data integrity and usability at once.
Six moves turn the higher bar into a design a committee can approve
- 1Test usability with the real users — the target population and their carers, not a healthy-adult stand-in.
- 2Build the consent model by capacity band — representative consent or parental permission, assent where required, re-consent at competence.
- 3Settle the children's-data plan up front — lawful basis, additional safeguards, a DPIA, and COPPA or the ICO Code where they apply.
- 4Re-validate endpoints in the population — do not assume a healthy-adult measure transfers.
- 5Design the proxy attribution model — a recorded answer to who acted, in the audit trail.
- 6Bring the safeguards to the committee early — surface usability, consent and attribution plans in design, not at submission.
Regulation (EU) 536/2014 Arts 10, 31, 32 · 21 CFR 50 subpart D, 56.111(b) · ICH E6(R3) s.2.8 · ICH E11(R1), E11A · GDPR Recital 38, Arts 8, 9(1), 35 · EDPB Opinion 3/2019 · COPPA Rule (90 FR 16902) · ICO Children's Code
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call