The Clinical Engine is intended for study design metadata such as forms, items, variables, codelists, and relationships. It is not a patient-data repository or a clinical record system.
This page describes the current product intent, not a legal opinion or certification. Applicability depends on the customer, the data submitted, the service configuration, and the jurisdictions involved.
HIPAA generally concerns protected health information handled by covered entities and business associates. Study structure alone is usually not PHI, but an uploaded file containing identifiable patient information may change that analysis. Do not upload PHI or patient identifiers.
Part 11 may become relevant when electronic records or signatures are used in a regulated process. A conversion utility should be validated for its intended use, with versioning, repeatable tests, schema validation, access controls, and traceability documented before regulated deployment.
GDPR may apply to contact details, account data, IP addresses, support records, or an uploaded file containing personal data. HTTPS, data minimization, retention limits, processor agreements, and a documented rights process remain necessary where applicable.
Bring a de-identified or synthetic study specification so the team can review the workflow without exposing patient data.