Click here to open the filter panel
C
Controller
C
Cookies
C
Cross-border processing
D
Data Act
D
Data concerning health
D
Data Governance Act (DGA)
D
Data management plan (DMP)
D
Data minimisation
D
Data monitoring committee (DMC)
D
Data processing agreement (DPA)
D
Data protection authority (DPA)
D
Data protection by default
D
Data protection by design
D
Data Protection Impact Assessment (DPIA)
D
Data Protection Officer (DPO)
D
Data Protection Representative (DPR)
D
Data quality
D
Data retention
D
Data subject
D
Data subject access request (DSAR)
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

F

Federated learning

Federated learning is a machine-learning approach in which a model is trained collaboratively across several data holders (hospitals, research centres, companies) without the underlying data leaving each holder's environment. A central coordinator distributes the model, each participant trains it locally on its own data and returns only model updates (gradients or parameters), which are aggregated into an improved global model and redistributed; the cycle repeats until convergence. Variants include cross-silo federation among organisations, cross-device federation across smartphones, and federated analytics for statistics rather than models. It belongs to the family of privacy-enhancing technologies and is often combined with secure aggregation, differential privacy and encryption.

In health research, federated learning enables multi-centre training of imaging, genomic and prediction models where data sharing is legally or practically impossible: cross-border collaborations, hospital networks, industry consortia and the federated analytics infrastructures of the EMA's DARWIN EU network and several national health data warehouse initiatives. It reduces international transfer exposure, keeps data holders in control and aligns with the European Health Data Space's preference for analysis in secure processing environments.

Federated learning is not a way out of the GDPR. Local training is processing of personal data by each participant, requiring a legal basis and, for health data, an Art. 9 exception and a DPIA; model updates can leak information about training data through inversion or membership inference attacks, so they may themselves be personal data unless protected by secure aggregation or differential privacy; and the final model may embed personal data, as the EDPB Opinion 28/2024 notes. Governance therefore requires a clear allocation of controller roles (participants as controllers for local processing, the coordinator as processor or joint controller for aggregation), a consortium agreement covering purposes, intellectual property, security and exit, a technical assessment of leakage risks, and transparency towards patients through institutional notices. Where the resulting model is placed on the market for a medical purpose, AI Act and MDR obligations attach to the provider.