Introduction

From GAMP 5, Appendix O13

Archiving is the process of taking records and data off-line by moving them to a different location or system, often protecting them against further changes. It may also be necessary to retain in archive the applications that support the records and data. Archived records should be readily retrievable for business or regulatory purposes.

It is important to note that archiving and retrieval is different to backup and restore of data.

Source Data

ClinSpark was designed to capture confidential personal and medical information in the course of the conduct of clinical trials.

This data is often ‘source data’ in the context of GCP and is collected by the duly authorised principal investigator, and their delegated representatives. The principal investigator is typically obliged, in law, to retain the source data for specified retention periods.

Archiving and Retrieval

ClinSpark is provided as Software as a Service (SaaS) on Amazon Web Services (AWS).

Due to the modern nature of ClinSpark's data infrastructure, study archival is not required for ClinSpark customers. With very high database storage capacity, highly optimized database structure and powerful server infrastructure, ClinSpark can meet all currently forecasted data storage and performance targets, even with years of customer data in place.

Study data is not removed (deleted) from ClinSpark. See also:https://foundryhealth.atlassian.net/wiki/spaces/DOCS/pages/3709665347

Data Retention

Setting the period of data retention

It is not possible to set an automated period of data retention in ClinSpark - data is retained for the duration of the contractual relationship with the customer (Data Controller) unless otherwise specified.

Should you require data to be removed from ClinSpark this would need to be communicated in writing by the customer. Any “hard deletion” of data is directed towards our engineering team in the service desk, where controller instructions are reviewed and acted on accordingly.

Documentation supporting data deletion

As part of the communication in the service desk, we would agree a process in which the customer confirms in writing that selected data is no longer needed, or that the customer has received a copy of the data (as applicable, based on the customers instructions). This process would be agreed upon in writing, in the service desk communication. We would not proceed with data deletion until the customer had confirmed the process in writing.

After completion is complete, this would be confirmed in the service desk communication.

Cost of data deletion

There may be a cost associated with data deletion and this will be communicated and agreed with the customer before data deletion occurs.

Timeline for data deletion

It may take several weeks, or longer, to schedule data deletion activities as qualified and experienced engineers will need to perform these tasks. A schedule will be communicated and agreed with the customer before work commences.

References

1. GAMP 5 – A Risk-Based Approach to Compliant GxP Computerized Systems, ISPE, 2008

2. https://gdpr.eu/right-to-be-forgotten/

3. https://www.ema.europa.eu/en/ich-e6-r2-good-clinical-practice-scientific-guideline