Click here to open the filter panel
I
Inspection
I
Institutional Review Board (IRB)
I
Interactive response technology (IRT)
I
Interactive web response system (IWRS)
I
International data transfer
I
Investigational Medicinal Product Dossier (IMPD)
I
Investigational medicinal product (IMP)
I
Investigational New Drug (IND) application
I
Investigator
I
Investigator's brochure (IB)
I
In Vitro Diagnostic Regulation (IVDR)
I
ISO/IEC 27001 (information security management)
I
ISO/IEC 42001 (AI management system)
J
Joint controllers
K
k-anonymity
K
Key-coded data (coded data)
K
Key (cryptographic key and pseudonymisation key)
K
Kinetics (pharmacokinetics and pharmacodynamics)
L
Large language model (LLM)
L
Lawfulness
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

S

Synthetic data

Synthetic data is data that is artificially generated, typically by statistical models or generative AI (generative adversarial networks, variational autoencoders, diffusion models or LLM-based generators) trained on a real dataset, so as to reproduce the statistical properties, correlations and structure of the original without containing the actual records of real individuals. Fully synthetic datasets contain no original records; partially synthetic or hybrid datasets replace only some variables. Synthetic data is one of the privacy-enhancing technologies promoted by ENISA, the ICO and the EDPB.

In life sciences, synthetic data is used to share realistic datasets with software developers and researchers without exposing patient records, to test and validate systems such as EDC and analytics pipelines, to augment small or imbalanced training sets for machine learning (rare diseases, under-represented populations), to build synthetic control arms as an alternative to real-world data, and to enable exploratory analysis before applying for access to the real data through a health data warehouse or the European Health Data Space. Regulators are cautious about using synthetic data as evidence, but accept it for methods development and system testing.

Whether synthetic data is personal data depends on the generation method and on the residual risk of inference about real individuals. Generators can memorise and reproduce records, outliers in the training data may be reconstructed, and membership inference attacks can reveal whether a person was in the training set; the GDPR test of Recital 26 (all means reasonably likely to be used) therefore has to be applied case by case, with privacy metrics such as distance to closest record, attribute disclosure risk and, where used, differential privacy guarantees documented. Generating synthetic data is itself a processing of the real personal data requiring a legal basis and, for health data, an Art. 9 exception and a DPIA. The utility of synthetic data (fidelity to the original) and its privacy are in tension, and both should be validated and reported before a dataset is treated as anonymous and shared without restriction.