Access
Access by role
Each person sees only what their role needs. A coordinator, an investigator and an administrator do not get the same view, and access is set up with you before launch.
Security and data handling
How we protect
participant data
Research software holds personal, and often health, information. This page sets out what we build in, where the data can live, and what we do not claim, in the terms a compliance officer needs.
At a glance
- Role
- Based access to every record
- Log
- Of who changed a record
- 2
- Hosting options: cloud or your servers
- NDA
- Before the first technical conversation
Controls we design in. The exact set is agreed for each study.
How does Andolasoft protect research participant data?
Andolasoft designs research study software with access by role, a log of changes to participant records, and encryption between the apps, the portal and the server. The data can live on cloud infrastructure built for protected health information or on servers the institution controls, and AI features can be kept away from row-level data. We do not claim HIPAA certification, SOC 2 certification or FDA 21 CFR Part 11 compliance for any system.
What we build in
Six controls we design in from the start
These are agreed with you for each study, not bolted on at the end.
Records
A log of who changed what
Changes to participant records are logged, so you can answer who changed a record and when.
Transit
Encrypted in transit
Data is encrypted between the participant apps, the coordinator portal and the server. We did this on our research institute project.
See that projectLocation
You choose where data lives
The system can run on cloud infrastructure built for protected health information, or on servers your institution controls. We agree this before anything is built.
Files
Secure file storage
Photos and other participant files go to secure cloud storage rather than being kept on a shared drive or in email.
AI
Control over AI features
If a system includes AI features, we design it so row-level participant data is not sent to a language model where you require that, and we can use models that run locally.
Straight answers
The questions a compliance team asks
Short answers, in plain terms.
| Question your compliance team asks | Where we stand today |
|---|---|
| Who can see participant records? | Only the roles you set up. Access is agreed with you before launch and can be changed later. |
| Can we see who changed a record? | Yes. Changes to participant records are logged. |
| Is data protected when it moves? | Yes. Data is encrypted between the apps, the portal and the server. |
| Where is the data stored? | On cloud infrastructure built for protected health information, or on your institution’s servers. You decide. |
| Does participant data go to an AI model? | Only if you want that. We can keep row-level data away from language models. |
| Is the software HIPAA certified? | No. HHS does not certify software for HIPAA. Compliance depends on how the system is built, hosted and run, and on the agreements in place. See below. |
| Can we sign an NDA first? | Yes. We can sign one before the first technical conversation. |
What we do not claim
Where our claims stop
Be clear
We do not claim certifications we do not hold
We design systems for HIPAA requirements. We do not describe software as “HIPAA certified”, and we do not claim SOC 2 certification or FDA 21 CFR Part 11 compliance for any system. If your study needs one of these, we say what the system would need to meet it, and whether that is in scope.
Be clear
Your institution still has responsibilities
Your IRB, your privacy officer and your agreements with participants set the rules for the study. We build to those rules. We do not replace them.
Security and data handling questions
HIPAA compliance is not a certificate a software company can hold. It depends on how a system is built, hosted and run, and on the agreements in place between the parties. We design research systems for HIPAA requirements, run them on infrastructure built for protected health information, and agree the responsibilities with you before the build.
We handle business associate agreements case by case. Whether one is needed depends on the study, the data and who handles it. Raise it in the first review, and we will set out what is needed on both sides before any work starts.
On cloud infrastructure built for protected health information, or on servers your institution controls. We agree the location with you before anything is built.
Only the roles you set up. A coordinator, an investigator and an administrator can each be given a different view, and changes to records are logged.
Only if you want it to. If a system includes AI features, we can design it so row-level participant data stays away from language models, and we can use models that run locally.
You do. The client owns the code and its data, and Andolasoft provides the service. We confirm this in writing before the build starts, so both sides know the position from day one.
We agree an exit plan at the start: what is handed over, in what form, and when our access ends. Documentation and handover are part of every engagement.
Insights
Latest insights
Research Labs7 min read
Research Study Data Access and Audit Trail Checklist: 10 Things to Check
A ten-point checklist for a research lab to check who can see participant data, whether changes are logged, and what to ask before you trust a study tool.
Read article
Research Labs7 min read
How to Keep Consent and Enrolment Records for a Research Study: A Checklist
A practical checklist for keeping consent and enrolment records that are easy to find and explain. Your IRB still sets the rules for your study.
Read article
Research Labs9 min read
How to Replace Study Spreadsheets Without an IT Team: A Step-by-Step Guide
A seven-step guide for research labs with no software team: map your spreadsheets, fix the rules, pick a route, migrate safely and hand the system an owner.
Read articleBring your compliance questions to the first call
Tell us what your IRB, privacy officer and data agreements require, and we will say what a system for your study would need. You will hear back from a solutions architect within one business day.
We can sign an NDA before the first technical conversation.