Clinical Governance

Governance-ready by design

ProNova52 is built from the ground up to support clinical governance, regulatory compliance, and data protection requirements across international healthcare jurisdictions.

Governance Pillars

Data Integrity

All participant responses are timestamped at point of submission and become immutable once recorded. Every response is linked to a verified invite reference, creating a chain of custody from invitation dispatch through to data export. Question modifications after study activation are version-tracked.

Comprehensive Audit Trail

The platform maintains a chronological timeline of every significant action: study creation and modification, participant enrolment, invite dispatch and delivery, response submission, data exports, and user access events. All timeline entries are append-only and cannot be deleted or modified.

Consent Management

Studies support mandatory consent questions that must be acknowledged before a participant can proceed. Consent timestamps are stored independently and can be exported for regulatory review. Consent text is version-controlled — changes after study activation create a new version without overwriting prior consent records.

Role-Based Access Control

Access is governed by organisation-level roles (Owner, Administrator, Member, Researcher) with principle-of-least-privilege defaults. Row-level security policies enforce data isolation between organisations at the database layer, not just the application layer.

Hazard & Risk Logging

Studies can be linked to external hazard log references and governance reference numbers for clinical safety tracking. These references appear on study dashboards and are included in data exports to maintain traceability between the platform and your organisation's risk management system.

Encryption & Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Authentication uses secure token-based sessions with automatic expiry. The platform undergoes regular penetration testing and vulnerability scanning.

Data Lifecycle Management

ProNova52 manages participant data through a controlled lifecycle:

  1. Collection — Data is collected via validated questionnaire instruments with real-time input validation. Each submission is timestamped and linked to a unique invite reference.
  2. Storage — Data is encrypted at rest using AES-256 and stored with organisation-level isolation enforced at the database layer through row-level security policies.
  3. Processing — Scoring, aggregation, and analytics are performed within the secure environment. No participant data leaves the platform unless explicitly exported by an authorised user.
  4. Retention — Organisations control their own retention policies. Data can be exported in standard formats (CSV, PDF) and subsequently purged from the platform.
  5. Deletion — Participant data deletion requests can be processed in compliance with data subject rights under applicable legislation. Deletion actions are logged in the audit trail.

Compliance by Jurisdiction

ProNova52 supports regulatory and governance requirements across the following jurisdictions. Select a country to view detailed compliance information.

NHS Digital & DTAC

ProNova52 aligns with the NHS Digital Technology Assessment Criteria (DTAC) framework, covering clinical safety, data protection, technical security, interoperability, and usability. Our clinical safety processes follow DCB0129 (manufacturer) and support organisations implementing DCB0160 (deployer).

UK GDPR & Data Protection Act 2018

The platform operates in compliance with UK GDPR as retained EU law post-Brexit. Data processing agreements, lawful bases for processing, data subject rights (access, rectification, erasure, portability), and breach notification procedures are built into the platform's operational framework.

NICE Evidence Standards

ProNova52 supports collection of Patient-Reported Outcome Measures (PROMs) and Patient-Reported Experience Measures (PREMs) in formats aligned with NICE evidence standards for digital health technologies, including validated scoring and longitudinal tracking.

Care Quality Commission (CQC)

The audit trail, access controls, and data integrity features support organisations' obligations under CQC inspection frameworks for safe, effective, and well-led services.

Incident Response & Reporting

ProNova52 maintains a documented incident response process covering:

  • Detection — Automated monitoring and alerting for anomalous access patterns, failed authentication attempts, and system health metrics.
  • Triage — Classification by severity (critical, high, medium, low) with defined response timeframes for each level.
  • Notification — Affected organisations are notified within the timeframes required by applicable data protection legislation (72 hours under GDPR, without unreasonable delay under HIPAA).
  • Remediation — Root cause analysis, corrective action implementation, and post-incident review documentation.
  • Reporting — Incident reports are made available to affected organisations and relevant supervisory authorities as required by law.

Governance Enquiries

For governance, compliance, or data protection enquiries, including requests for Data Processing Agreements, security questionnaires, or DPIA support, please contact:

Email: admin@lane52.com

We aim to respond to governance enquiries within 3 business days.