Security, data and compliance in Clinical Trial Patient Recruitment App

How Clinical Trial Patient Recruitment App protects data and supports your compliance obligations.

Security controls

Business associate agreement

Where PHI is involved, Moraph signs a business associate agreement with the covered entity.

Participant sign-in

Participants sign in with multi-factor verification and device protections, and staff sign in through your identity provider.

Role-based access

What each person can see follows their role and study; sponsors see coded data unless consent and contract allow more.

Encryption and keys

Data is encrypted in transit and at rest, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, signature, report, assessment and export is logged with the person and time and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• FDA electronic records and signatures (21 CFR Part 11)
• FDA protection of human subjects and informed consent (21 CFR Part 50)
• Federal Policy for the Protection of Human Subjects, the Common Rule (45 CFR Part 46)
• IND safety reporting (21 CFR 312.32 and 312.64)
• ICH E6 Good Clinical Practice
• HIPAA Privacy Rule authorizations for research (45 CFR 164.508 and 164.512(i))

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region, with United Kingdom and Australia regions for sites outside the US.
• Participant app: Participants use the app on iOS or Android, or a mobile web version for those who prefer not to install an app.
• Dedicated environment: A single-tenant environment for sponsors or institutions whose policies require isolation, scoped in the proposal.

Limitations

• The app does not decide eligibility, enroll participants or give medical advice. Site staff make those decisions.
• It does not determine whether a report is an adverse event or submit safety reports to sponsors, IRBs or the FDA; investigators and sponsors do.
• Consent content and every change to it must be approved by your IRB before use; the app records the approval but does not grant it.
• Computer system validation and Part 11 compliance for your use are your organization's decisions; Moraph provides supporting documentation.
• It is not an electronic data capture system or a CTMS; it connects to the ones you use.
• It is not intended for emergencies. Participants are directed to call emergency services or their study team for urgent symptoms.
• Languages are added as approved translations are supplied; machine translation is not used for consent.
• Participants need a smartphone or web access; sites keep paper or in-person options for those without one.