ensuring data is attributable, legible, contemporaneous, original, and accurate (ALCOA).

System Validation and Part 11 Compliance

Any wearable system used to generate trial data must be validated. This includes:

• Vendor Qualification: Audit the DHT vendor’s quality systems and SOPs
• Functional Testing: Confirm that devices consistently record expected data
• Security & Access Controls: Enforce unique logins and encryption protocols
• Audit Trails: All actions must be time-stamped and unalterable

Example: A CRO using a wearable patch for ECG must validate firmware, BLE data transmission, server-side APIs, and dashboard export tools for data lock and submission.

Data Integrity Across the Wearable Lifecycle

Sponsors must ensure data collected via wearables is handled per GCP throughout its lifecycle:

• At Source: Device must reliably record raw signals (e.g., HR, SpO₂)
• During Transmission: Secure sync using SSL/TLS to prevent interception
• Storage: Cloud or local storage must be GxP-compliant
• During Analysis: Raw vs derived data must be distinguishable

Data reconciliation with EDC or lab data may be required during trial monitoring or SDTM conversion.

Oversight Responsibilities of CROs and Sponsors

ICH E6(R2) places responsibility on sponsors for ensuring data integrity, even when functions are outsourced. In wearable-enabled trials, CROs must:

• Implement SOPs for wearable handling, data upload, and QC
• Ensure trained staff verify device deployment, returns, and data capture
• Perform periodic vendor audits and system re-validations
• Generate data listings and discrepancy reports for monitoring visits

Sponsors should document risk-based vendor oversight plans and require CROs to use wearable SOP templates like those from PharmaSOP.in.

Informed Consent and Patient Training

When wearables are used, participants must be fully informed about:

• What data is collected and how frequently
• Any risks associated with device use (e.g., skin irritation)
• Data access and privacy protections
• Who to contact for support or malfunction

Training logs and comprehension checks (e.g., quizzes post-training) should be archived. If eConsent is used, it must also be Part 11 compliant and version-controlled.

Case Study: GCP Inspection Findings Involving Wearables

A Phase 2 oncology study using a wearable patch for continuous temperature monitoring was audited by the EMA. Key findings included:

• Lack of validation documentation for the wearable data pipeline
• Missing audit trails for data deleted during device syncing
• Inconsistent subject compliance logs (wear time not verified)
• No SOP for training patients on wearable use

Result: A major finding requiring data exclusion from primary analysis and retraining of CRO personnel. This case reinforces the need for thorough pre-inspection readiness.

Documentation and Traceability

Sponsors must maintain a complete paper or electronic trail including:

• Device calibration logs and serial number linkage to subject IDs
• Version histories of firmware, apps, and APIs used
• QC reports and SOPs governing device handling
• Audit trail exports from wearable platforms

Refer to EMA’s guidance for device traceability expectations in remote monitoring trials.

Preparing for GCP Inspections Involving Wearables

Inspection readiness tips include:

• Maintain a DHT master file: device specs, validation, SOPs, logs
• Designate a “DHT SME” for interviews with inspectors
• Keep screen recordings of user workflows for demonstration
• Validate your backup and restore processes

Most findings in audits stem not from poor devices—but from insufficient documentation or oversight.

Conclusion: Compliance by Design, Not Afterthought

GCP compliance with wearable devices is achievable—but only when built into protocol design, vendor selection, training, and monitoring workflows. Sponsors and CROs must adopt a proactive approach to system validation, data integrity, and regulatory expectations.

As wearables become core to decentralized trials, their compliance burden will grow—and so will the need for purpose-built SOPs, validated tech stacks, and trained teams to manage them.