How to ensure GDPR compliance for patient data logging in a digital health clinical trial?

Question

We are preparing to launch our first clinical trial for a digital health app for diabetes. Our process is as follows: collect patient data via the app, store it locally, export the data, send it to the cloud, and then store it in the cloud. We have already addressed consent, but need advice on the technical steps for GDPR compliance.
Our questions:
• Is it necessary to encrypt data locally on the device if the local database (e.g. ISAR DB) does not offer encryption at rest?
• What are best practices for exporting data in a GDPR-compliant way to transfer it securely to the cloud?
• We are considering using Firebase Storage as our cloud database. While Firebase claims to encrypt data in transit and at rest, there are concerns about data residency and GDPR compliance if data is stored outside the EU. Has anyone used Firebase for similar applications, or are there better cloud alternatives?
• Since there will be no third-party use of the data, is pseudonymization still relevant in our case?

Dr. Oliver Eidel · Accepted Answer

There's rarely a single clear answer for GDPR compliance since it depends on your specific use case, but here are some practical points:
• For local storage, encrypting sensitive data on the device is strongly recommended if the database (like ISAR DB) doesn't provide encryption at rest. This reduces risk if the device is lost or stolen.
• When exporting data, make sure to use secure channels like HTTPS/TLS. Ideally, data should be encrypted before export, and only decrypted in a secure environment in the cloud.
• Firebase can technically be used under GDPR, but there are growing concerns about data residency and control, as some EU authorities are questioning Google solutions. To minimize risk, you can either encrypt data before sending it to Firebase (and keep the key out of Google’s reach) or use a fully European cloud service. Some alternatives include Open Telekom Cloud, StackIT, or specialized providers like chino.io.
• Even if you do not share data with third parties, pseudonymization is still a recommended practice under GDPR, as it helps reduce risk in case of breaches and demonstrates proactive data protection.

Also keep in mind that if your project qualifies as a clinical investigation under MDR, additional data privacy requirements may apply.

How to ensure GDPR compliance for patient data logging in a digital health clinical trial?

1 Answer

Keep reading

DiGAs and the Telekom Cloud Run On Chinese Software From Huawei. Say What?

How We Keep Your Formwork Data Safe

Technical and Organizational Measures