Introduction
From GAMP 5, Appendix O13
Archiving is the process of taking records and data off-line by moving them to a different location or system, often protecting them against further changes. It may also be necessary to retain in archive the applications that support the records and data. Archived records should be readily retrievable for business or regulatory purposes.
It is important to note that archiving and retrieval is different to backup and restore of data.
Source Data
ClinSpark was designed to capture confidential personal and medical information in the course of the conduct of clinical trials.
This data is often ‘source data’ in the context of GCP and is collected by the duly authorised principal investigator, and their delegated representatives. The principal investigator is typically obliged, in law, to retain the source data for specified retention periods.
Archiving and Retrieval
ClinSpark is provided as Software as a Service (SaaS) on Amazon Web Services (AWS).
Due to the modern nature of ClinSpark's data infrastructure, study archival is not required for ClinSpark customers. With very high database storage capacity, highly optimized database structure and powerful server infrastructure, ClinSpark can meet all currently forecasted data storage and performance targets, even with years of customer data in place. Study data are not removed (deleted) from ClinSpark.
Participant information may be removed under carefully restricted circumstances in order to support a ‘Persons right to be forgotten’ per the EU GDPR Regulation.
Data Retention
Setting the period of data retention
It is not possible to set an automated period of data retention in ClinSpark - data is retained for the duration of the contractual relationship with the customer (Data Controller) unless otherwise specified.
Should you require data to be removed from ClinSpark this would need to be communicated in writing by the customer. Any “hard deletion” of data is directed towards our engineering team in the service desk, where controller instructions are reviewed and acted on accordingly.
Documentation supporting data deletion
As part of the communication in the service desk, we would agree a process in which the customer confirms in writing that selected data is no longer needed, or that the customer has received a copy of the data (as applicable, based on the customers instructions). This process would be agreed upon in writing, in the service desk communication. We would not proceed with data deletion until the customer had confirmed the process in writing.
After completion is complete, this would be confirmed in the service desk communication.
Cost of data deletion
There may be a cost associated with data deletion and this will be communicated and agreed with the customer before data deletion occurs.
Timeline for data deletion
It may take several weeks, or longer, to schedule data deletion activities as qualified and experienced engineers will need to perform these tasks. A schedule will be communicated and agreed with the customer before work commences.
References
GAMP 5 – A Risk-Based Approach to Compliant GxP Computerized Systems, ISPE, 2008
https://www.ema.europa.eu/en/ich-e6-r2-good-clinical-practice-scientific-guideline