Click here to open the filter panel
S
Sensitive data
S
Serious adverse event (SAE)
S
Software as a Medical Device (SaMD)
S
Source data verification (SDV) and source documents
S
Special categories of personal data
S
Sponsor
S
Standard contractual clauses (SCC)
S
Start of a clinical trial
S
Storage limitation (limited storage periods)
S
Study Data Tabulation Model (SDTM)
S
Subject (clinical trial participant)
S
Sub-processor
S
Supervisory authority
S
Supplementary measures
S
Swiss Federal Act on Data Protection (FADP / revFADP)
S
Synthetic data
T
Technical and organisational measures (TOMs)
T
Temporary halt of a clinical trial
T
Third country
T
Third party
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

V

Validation (computerised system validation, CSV)

Validation, in the regulated life sciences context, is the documented process of establishing that a computerised system, process or method consistently performs as intended and fit for its purpose. Computerised system validation (CSV) applies to systems used in GxP activities: EDC and eCRF platforms, eCOA and IRT systems, safety databases, eTMF, laboratory and manufacturing systems, and increasingly AI-based tools. The regulatory bases are FDA 21 CFR Part 11 on electronic records and signatures, EU GMP Annex 11, the EMA guideline on computerised systems and electronic data in clinical trials (2023), ICH E6(R3) on GCP and, for devices, IEC 62304 and ISO 13485. ISPE's GAMP 5 (second edition, 2022) is the industry methodology, and the FDA's computer software assurance (CSA) guidance (2025) promotes a risk-based, critical-thinking approach over exhaustive documentation.

A validation package typically includes a validation plan, user requirements, functional and design specifications, risk assessment, supplier assessment, installation, operational and performance qualification (or agile equivalents), traceability matrix, test evidence, deviations, a validation report and procedures for change control and periodic review to keep the system in a validated state. For cloud software-as-a-service used in trials, sponsors rely on the vendor's validation and perform their own configuration and user acceptance testing, with the division of responsibilities recorded in the quality agreement.

Validation and data protection overlap substantially. Audit trails, access control, electronic signatures, data integrity (ALCOA+), backup and disaster recovery are simultaneously Part 11 requirements and Art. 32 GDPR security measures; user requirement specifications are the natural place to state data protection by design requirements such as pseudonymisation architecture, field-level access restrictions, minimisation of identifiers and retention configuration; and the DPIA and the validation risk assessment should reference each other. For AI systems, AI Act requirements on accuracy, robustness, logging and human oversight extend the validation scope. Vendor validation evidence is a standard item in iliomad's vendor assessments and quality assurance work.