When the Instrument Is Their Own Phone
A paper about the participant’s position on a bring-your-own-device trial — written for the sponsor, sites and vendors who must discharge the obligations that anchor to them
REGULATORY OPERATIONSOn BYOD the participant and their own phone become part of the instrument — and every obligation that follows anchors to the person, not to trial hardware.
The study team, not the participant, discharges those obligations: usability on the handset they hold, eConsent bound to the right person, lawful processing of special-category health data, and attribution of every entry. Beneath all four: a sponsor-provided device must be available, so no one is excluded for lacking a phone.
Four obligations anchor to the participant; the team discharges all
| Perimeter | What it means for the participant | Study-team action and evidence |
|---|---|---|
| Human factors | Usability for their real device and capability | Test across the real device and OS range; offer a sponsor device |
| Consent | Valid, informed eConsent bound to the participant | Evidence eConsent bound to the right person, incl. remote identity |
| Data protection | Lawful basis, transparency and rights over special-category data | Record lawful basis and Art. 9 condition; erasure within Art. 17(3) |
| Data integrity | Attribution of entries to the right participant | Evidence attribution, including for assisted or proxy entry |
Four obligations anchor to the participant; none can be delegated to them
On BYOD the participant's hardware and settings shape the data; the handset you did not choose sets the floor for data quality, and the interface you validated is not the one everyone sees.
Use-error and non-adherence become missing or wrong data — and when a carer enters data, the audit trail must show who acted, which the standard self-entry model does not.
Lawful basis, transparency and data-subject rights attach to the person — but erasure only within the limits trial law sets (GDPR Art. 17(3); CTR Art. 28(3)).
Identity is the weak point when consent is electronic and remote; the signer must be confirmed as the participant or their legally authorised representative.
Six actions keep BYOD data usable and attributable
- 1Test usability on real devices so the interface each participant actually sees is the one you validated against.
- 2Bind eConsent to the right person so remote, electronic consent is valid and informed, not merely acknowledged.
- 3Handle data rights accurately — record the lawful basis and Art. 9 condition, meet transparency duties, answer erasure within Art. 17(3).
- 4Resolve attribution up front so assisted or proxy entry never leaves data attributed to the wrong person.
- 5Plan data clearance from the personal device at close-out — a storage-limitation question distinct from the erasure right.
- 6Offer a sponsor-provided device so owning a suitable handset is never a condition of taking part; record who BYOD would exclude.
FDA DHT guidance (Dec 2023), s.III · HMA/EC/EMA DCT paper v02 · EMA/INS/GCP/112288/2023, Annex 4, A5.1, A5.3 · ICH E6(R3) 2.8 · FDA/OHRP eConsent Q&A (2016) · GDPR Arts 5(1)(e), 9, 13–14, 17(3) · CTR Art. 28(3)
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call