GDPR Compliance for Clinical Trials

1. Purpose

This Standard Operating Procedure ("SOP") establishes the mandatory requirements and step-by-step procedure for ensuring compliance with the GDPR whenever Aurelyn AI Clinical, its sponsor clients, contracted Clinical Research Organizations ("CROs"), investigator sites, or the Aurelyn Trial | OS™ platform and Aurelyn Clinical Engines™ (Cohort Intelligence™, Adaptive Dose™, Safety Sentinel™, Clinical Evidence™, eTMF Intelligence™) process personal data of clinical trial data subjects. It defines how GDPR obligations are harmonized with FDA (US) and EMA (EU) clinical research regulations so that a single, integrated control framework governs trial data regardless of the jurisdiction in which it is collected, processed, transferred, or archived.

2. Scope

2.1 Applies To

• All Aurelyn AI Clinical employees, contractors, and platform administrators.
• Sponsor clients and their designated Clinical Project Managers using Aurelyn Trial | OS™.
• Contracted CROs, central/local laboratories, IRT/RTSM providers, eTMF and safety-database vendors acting as data processors or sub-processors.
• Investigator sites, Principal Investigators, and site personnel entering or accessing trial participant data.
• All trial phases (I–IV), interventional and observational designs, and Investigator-Initiated Studies conducted in whole or in part in the EU/EEA, or otherwise processing personal data of data subjects located in the EU/EEA — including trials whose lawful basis, consent, or safety data must additionally satisfy FDA requirements.

2.2 Data In Scope

• Direct and indirect identifiers (name, initials, date of birth, contact details, national ID, randomization-linked codes where re-identification is possible).
• Special category data under Art. 9 GDPR: health data, genetic data, biometric data, and — where collected — data revealing racial/ethnic origin.
• Source documents, electronic case report form (eCRF) data, informed consent records, adverse event (AE/SAE/SUSAR) reports, biological-sample-linked data, images, and eTMF artifacts containing personal data of participants, investigators, or monitors.

2.3 Out of Scope

Fully anonymized, irreversibly de-identified aggregate data that can no longer be attributed to an identifiable natural person (Recital 26 GDPR) falls outside the scope of this SOP once anonymization is validated and documented. Non-EU/EEA data subject data that is not otherwise subject to GDPR's extraterritorial scope under Art. 3 is governed by applicable local/federal frameworks and cross-referenced FDA requirements only.

3. Responsibilities

A summary RACI (Responsible / Accountable / Consulted / Informed) overview is provided below; the full matrix by activity is provided in Appendix A.

4. Definitions & Abbreviations

4.1 Key Definitions

4.2 Abbreviations

5. Regulatory & Guidance Framework

This SOP is designed to satisfy GDPR obligations concurrently with the following FDA (US) and EMA (EU) authorities and guidances. Where requirements diverge, personnel must apply the more stringent standard unless a documented, risk-based justification states otherwise.

6. Policy Statement

Aurelyn AI Clinical requires that all processing of clinical trial personal data — whether performed directly, through the Aurelyn Trial | OS™ platform, or by contracted third parties — adhere at all times to the seven principles of Art. 5 GDPR:

No process, protocol, technology (including AI-assisted features of Aurelyn Clinical Engines™), or vendor arrangement may be implemented that conflicts with these principles or with applicable FDA/EMA obligations. Exceptions require documented, DPO-approved risk acceptance.

7. Procedure

The following sub-procedures must be followed sequentially at study start-up and revisited at each protocol amendment, new vendor engagement, or material change to data flows.

7.1 Determine Roles & Applicability

At protocol concept stage, the Clinical Project Manager, with DPO support, must document each party's GDPR role:

• Sponsor — ordinarily sole or joint Controller, determining trial purpose and design.
• Investigator Site — typically an independent Controller for source data collection and consent, or joint Controller with the Sponsor depending on Member State interpretation; confirm per-country legal analysis.
• CRO / eTMF / IRT / Safety Database Vendors, and the Aurelyn Trial | OS™ platform — Processors, acting only on documented Sponsor instructions.

The determination is recorded in the study-level ROPA entry (Section 8) and drives which downstream controls (consent language, DPAs, transfer mechanisms) apply.

7.2 Establish the Legal Basis for Processing

Two layers of legal basis are required for special category clinical trial data — a general processing basis (Art. 6) and a special category basis (Art. 9):

7.3 Privacy by Design and by Default (Art. 25)

• Pseudonymize participant identity at first point of capture using subject ID codes; the re-identification key is held only by the investigator site under restricted access.
• Apply role-based access control (RBAC) within Aurelyn Trial | OS™ so users see only the minimum data set needed for their function.
• Design eCRFs and Clinical Engines™ inputs to exclude direct identifiers wherever indirect/coded identifiers suffice.
• Default all new platform modules to the most privacy-protective configuration; explicit administrator action is required to broaden access or retention.

7.4 Conduct a Data Protection Impact Assessment (Art. 35)

A DPIA is mandatory before processing begins whenever any trigger in Appendix B is met — this includes, by default, essentially all interventional trials processing special category health data at scale, and any use of AI-assisted features (Cohort Intelligence™, Adaptive Dose™, Safety Sentinel™) that produce automated outputs influencing participant management. The DPIA is drafted by the Clinical Project Manager, reviewed and approved by the DPO, and — where residual risk remains high after mitigation — submitted for prior consultation with the competent Supervisory Authority (Art. 36).

7.5 Consent Forms & Transparency Notices

Maintain two distinct documents, cross-referenced but not merged:

Per Recital 33 and Art. 17(3)(d), withdrawal of participation does not require erasure of data already lawfully collected where retention is necessary for scientific research or archiving purposes with Art. 89(1) safeguards; the transparency notice must state this explicitly to avoid participant misunderstanding.

7.6 Managing Data Subject Rights

Response timeline: Requests must be acknowledged within 5 business days and substantively resolved within 1 calendar month of receipt (extendable by two further months for complex requests, with the data subject informed of the extension within the first month) (Art. 12(3)).

7.7 International Data Transfers (Chapter V)

Any transfer of personal data outside the EU/EEA — including to Aurelyn AI Clinical's US infrastructure, a US-based Sponsor, or FDA submission packages — requires a documented lawful transfer mechanism before data leaves the EU/EEA.

See Appendix D for the full decision tree used at protocol start-up and vendor onboarding.

7.8 Data Processing Agreements (Art. 28)

A written Data Processing Agreement ("DPA") is mandatory with every processor and sub-processor before any personal data is shared, including CROs, central/local laboratories, IRT/RTSM vendors, safety database providers, translation vendors, and the Aurelyn Trial | OS™ hosting infrastructure. At minimum, each DPA must specify:

• Subject matter, duration, nature and purpose of processing, and categories of data/data subjects.
• Obligation to process only on documented Controller instructions (Art. 28(3)(a)).
• Confidentiality commitments for authorized personnel.
• Technical and organizational security measures (Art. 32).
• Sub-processor authorization mechanism (general or specific written authorization).
• Assistance obligations for data subject rights, DPIAs, and breach notification.
• Return/deletion of data at end of engagement, subject to regulatory retention overrides.
• Audit rights for the Controller/DPO.

7.9 Security of Processing (Art. 32)

Technical and organizational measures implemented across the Aurelyn Trial | OS™ platform and required of all processors include:

Security measures are periodically tested (penetration testing, access reviews, business continuity/disaster recovery exercises) and documented for both GDPR Art. 32 and 21 CFR Part 11 audit trail requirements simultaneously.

7.10 Personal Data Breach Management (Art. 33–34)

Any suspected or confirmed personal data breach must be reported immediately to the DPO via the incident channel; the timeline below governs the response.

7.11 Records of Processing Activities (Art. 30)

The DPO maintains a central ROPA covering every study and platform processing activity, including: purposes of processing, categories of data subjects and data, recipients (including third-country recipients), transfer safeguards, retention periods, and a general description of security measures. The ROPA is updated at study start-up, protocol amendment, and vendor change, and is reviewed at minimum annually.

7.12 Data Retention & Destruction

GDPR's storage limitation principle (Art. 5(1)(e)) permits extended retention where data is processed for archiving in the public interest or scientific research purposes, subject to Art. 89(1) safeguards (pseudonymization, access restriction). This allows trial data to be retained per the longer of applicable regulatory retention periods (see Appendix C) without conflicting with GDPR, provided the retention schedule is documented and enforced. Destruction/anonymization at end of retention must be logged and, where technically irreversible anonymization is used, validated before the record is considered fully out of GDPR scope.

7.13 EU Clinical Trials Regulation 536/2014 & CTIS Submission

• Lay summaries and protocol content submitted to CTIS must be reviewed by the DPO to confirm no direct participant identifiers appear in the public layer.
• Investigator and Sponsor contact personal data published via CTIS transparency rules is processed under a distinct legal basis (public task/legitimate interest for regulatory transparency) documented separately in the ROPA.
• EudraLex Volume 10 guidance on data protection and CTIS user manuals must be consulted for country-specific deferral/redaction requests (e.g., delayed publication) where applicable.

7.14 ICH M11 CeSHarP Protocol Template Alignment

Where a protocol is authored using the ICH M11 Clinical electronic Structured Harmonised Protocol template, the data protection / privacy section must reference: the applicable Art. 6/9 legal basis, categories of data collected, the GDPR transparency notice, and a summary data flow diagram (see Appendix D pattern) consistent with the sections above, ensuring a single source of truth between the protocol and the participant-facing consent pack.

7.15 AI & Aurelyn Clinical Engines™ Governance

Where Cohort Intelligence™, Adaptive Dose™, Safety Sentinel™, Clinical Evidence™, or eTMF Intelligence™ process personal data — including for model-assisted analysis, cohort selection, or dose recommendations — the following additional controls apply:

• A DPIA is mandatory before go-live for any AI feature that produces an output materially influencing decisions about a participant (Art. 22 automated decision-making considerations).
• Personal data is pseudonymized by default before being processed by any AI/ML component; direct identifiers are excluded from model inputs unless a documented, DPO-approved exception exists.
• Human oversight is maintained — no fully automated decision producing legal or similarly significant effects on a participant is permitted without meaningful human review.
• Personal data is not used to train or fine-tune AI models beyond the specific study for which lawful basis was established, absent a separate, documented legal basis.

7.16 Cross-Border Safety Reporting

SUSAR and expedited safety reports transmitted to EMA/national authorities and to FDA (IND Safety Reports) under ICH E2A and CIOMS/E2B(R3) formats must minimize personal data — using case identifiers rather than direct identifiers — while retaining sufficient traceability for causality assessment. Cross-border transmission of safety data follows the transfer mechanisms in Section 7.7.

7.17 Training & Awareness

All personnel with access to trial personal data must complete GDPR and this SOP's training module prior to data access, with refresher training at each annual review cycle or upon material regulatory change. Completion is logged in the training record referenced in Section 8.

7.18 Deviations & CAPA

Any deviation from this SOP is documented, risk-assessed by the DPO/QA, and — where warranted — escalated into the Corrective and Preventive Action (CAPA) process. Recurring or systemic deviations trigger a root-cause review and, where required, DPIA re-assessment.

8. Documentation & Records

9. Related Documents

• SOP PRI-001 — Data Privacy & Protection Policy
• SOP CLN — Informed Consent Process
• SOP QA — Incident & Breach Management
• SOP DM — Data Management Plan & eCRF Governance
• SOP TMF — Trial Master File / eTMF Governance
• SOP IT-SEC — Information Security & Access Control
• Aurelyn Trial | OS™ Platform Security & AI Governance Charter

10. Appendices