Click here to open the filter panel
#
510(k) premarket notification
A
Accountability
A
Accuracy
A
Adequacy decision
A
Ad hoc services
A
Adverse event
A
AI literacy (Art. 4 EU AI Act)
A
AI Officer
A
Analysis Data Model (ADaM)
A
Anonymisation
A
Appropriate safeguards
A
Article 29 Working Party (WP29)
A
Artificial intelligence (AI)
A
Authorised representative (EU AI Act)
A
Automated individual decision-making
A
Auxiliary medicinal product
B
Best-in-class drugs
B
Binding corporate rules (BCR)
B
Biobank
B
Biometric data
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

P

Privacy notice (information notice)

A privacy notice, also called an information notice, privacy statement or privacy policy, is the document or set of communications through which a controller fulfils its obligation to inform data subjects under Art. 13 and 14 GDPR, giving effect to the transparency principle and the right of information. It must be provided at the time data is collected from the individual, or within a reasonable period (at most one month) when data is obtained from another source, and must be concise, transparent, intelligible and easily accessible, in clear and plain language (Art. 12(1)).

Mandatory content includes: the identity and contact details of the controller and, where applicable, its EU representative and DPO; the purposes and legal bases, including the legitimate interests relied on; the recipients or categories of recipients; any international transfers and the safeguards used, with a means to obtain a copy; the retention period or criteria; the rights of the individual, including withdrawal of consent, objection and the right to lodge a complaint with a supervisory authority; whether provision of data is statutory or contractual and the consequences of not providing it; the existence and logic of automated decision-making; and, for indirectly collected data, the categories and source. The EDPB transparency guidelines (WP260) recommend layered notices, with a short first layer and links to detail, and just-in-time information at the point of collection, and warn against burying information in terms and conditions.

A life sciences company typically needs several notices: a website and cookie notice; a notice for trial participants, usually integrated into the informed consent form; a notice for investigators and site staff; a notice for healthcare professionals and key opinion leaders in CRM and engagement databases; a notice for pharmacovigilance reporters and patients in safety databases; a notice for app or platform users; an employee and candidate notice; and, for secondary use of health records without contact, a public transparency notice under Art. 14(5)(b). Each must be consistent with the record of processing activities and the relevant DPIA, and translated and localised (for example to reflect UK and Swiss representatives) where the audience requires.