Phase 5: Product Validation Review

Process Overview

The purpose of the Product Validation review (Phase 5) is to ensure that the complete product satisfies all validation criteria and is ready for market release. This review validates that all validation activities have been completed, all procedural reports are finalized, regulatory requirements are met, and the product can be safely released to the market.

According to GP-012, Phase 5 is the final gate before product certification, registration, and market launch. This phase confirms that the device meets its intended use in the intended environment and that all regulatory documentation is complete.

Phase 5 Key Activities Flow

1. Clinical Evaluation (GP-015): Validate clinical safety and performance with real clinical data
2. Usability Summative Evaluation (R-TF-025-004): Confirm usability goals achieved with no critical use errors
3. Final Risk Management Review (GP-013): Complete the "Verification of Effectiveness" column in R-TF-013-002 Risk Management Record to confirm all risk control measures are effective
4. Commissioning (GP-029): Validate device performs correctly in the production environment (R-TF-029-001, R-TF-029-002, R-TF-029-003)
5. Post-Commissioning Risk Review: Confirm no new risks were identified during commissioning activities
6. Validated Version Transfer (R-TF-012-039): Final approval for market release after all activities complete

Regulatory Requirement: Separation Between Verification and Validation

According to multiple regulatory standards, there must be a clear separation and independence between software verification and product validation activities:

• IEC 82304-1:2016 Section 6.1: "Validation activities shall be carried out by personnel who are independent of the persons who performed the verification activities."
• IEC 62304:2006+A1:2015 Section 5.7 and 5.8: Distinguishes between software system testing (verification) and validation activities, requiring independence to ensure objectivity.
• FDA Guidance on Software Validation (2002): "Validation activities should be conducted using actual or simulated use conditions and should be conducted by individuals who are independent of those who developed the software."
• EU MDR 2017/745 Annex II Section 6.1: Requires verification and validation activities to demonstrate that the device meets its intended purpose.
• ISO 13485:2016 Section 7.3.6: Design and development verification and validation procedures must ensure independence between these activities.

Compliance Strategy: The product validation is performed by JD-003 (Design & Development Manager - Taig Mac Carthy), who has not participated in the software development activities (performed under JD-007's responsibility). This organizational separation ensures:

• Independence: JD-003 provides objective assessment of whether the product meets user needs and intended use
• Objectivity: Validation is performed by personnel not involved in implementation decisions
• Regulatory Compliance: Satisfies IEC 82304-1, IEC 62304, FDA, and MDR requirements for validation independence

Role Separation:

• Software Verification (Phase 4): Performed by JD-007 (Technical Manager), responsible for software development and verification that implementation meets software requirements
• Product Validation (Phase 5): Performed by JD-003 (Design & Development Manager), independent from software development, validates that product meets user needs and intended use in real-world conditions

General Information

	Information
Device name	Legit.Health Plus (hereinafter, the device)
Model and type	NA
Version	1.1.0.0
Basic UDI-DI	8437025550LegitCADx6X
Certificate number (if available)	MDR 792790
EMDN code(s)	Z12040192 (General medicine diagnosis and monitoring instruments - Medical device software)
GMDN code	65975
EU MDR 2017/745	Class IIb
EU MDR Classification rule	Rule 11
Novel product (True/False)	TRUE
Novel related clinical procedure (True/False)	TRUE
SRN	ES-MF-000025345

Project Information

• Project title: Legit.Health Plus Version 1.1.0.0
• Validation responsible: JD-003 (Design & Development Manager - Taig Mac Carthy)
• Review date: [Date to be completed]
• Reviewers: JD-001 (General Manager), JD-003 (Design & Development Manager), JD-007 (Technical Manager), JD-004 (Quality Manager & PRRC), JD-018 (Clinical Research Coordinator)

Validation Independence Confirmation:

• JD-003 (Taig Mac Carthy) is responsible for product validation and has not been directly involved in software development activities (Phases 2-4)
• Software development and verification were performed under JD-007's responsibility
• This separation ensures compliance with IEC 82304-1 Section 6.1, IEC 62304 Section 5.7-5.8, FDA Software Validation Guidance, and ISO 13485:2016 Section 7.3.6

Planning

Phase	Object	Done
Phase 1 Product Design Review	Establish input data	✓
Phase 2 Software Design Review	SRs, Architectural Design and UI Prototypes	✓
Phase 3 Software Development	Coding, integration and test plan	✓
Phase 4 Software Verification Review	Software version verified and residual anomalies	✓
Phase 5 Product Validation Review	Validation activities, Technical Documentation and DHF	✓

Previous Reserves

All reserves from Phase 4 have been addressed and closed.

N°	Issue from Phase 4	Resolution	Status
-	No reserves	-	-

Validation Outputs Review

Core Validation Reports

Document	Status	Reference	Responsible	Comments
Software Verification
Software Test Report	✓	R-TF-012-035 Software Test Report	JD-007	All verification tests completed successfully
Verified Version Release	✓	R-TF-012-038 Verified Version Release	JD-007	Version 1.1.0.0 verified and documented
Clinical Evaluation
Clinical Evaluation Plan	✓	R-TF-015-008 Clinical Evaluation Plan	JD-018	Clinical evaluation strategy defined
Clinical Evaluation Report	✓	Clinical Evaluation Section	JD-018	Clinical evidence demonstrates safety and performance
Clinical Investigation Report (if applicable)	✓	Clinical Investigation Section	JD-018	Clinical data supports intended use and validates AI/ML model performance in real-world clinical conditions
Risk Management
Risk Management Report	✓	R-TF-013-003 Risk Management Report	JD-003, JD-004	Final risk-benefit analysis favorable
Risk Management Record	✓	R-TF-013-002 Risk Management Record	JD-003, JD-004	All risks assessed, controls verified, "Verification of Effectiveness" column completed
Cybersecurity
Cybersecurity Risk Management Report	✓	R-TF-030-005 Cybersecurity Risk Management Report	JD-007	Security risks managed, controls verified
Cybersecurity Testing Report	✓	R-TF-030-004 Cybersecurity Testing Report	JD-007	Security testing completed, vulnerabilities addressed
Usability
Usability Validation Report (Summative)	✓	R-TF-025-004 Summative Evaluation Protocol	JD-003	Usability goals achieved, no critical use errors
Usability Engineering File	✓	R-TF-025-001 Usability Plan	JD-003	Complete usability documentation
AI/ML Development (Completed in Phase 2)
AI/ML Development Report	✓	R-TF-028-005 AI/ML Development Report	JD-017	Complete AI/ML development documentation (from Phase 2)
AI/ML Release Report	✓	R-TF-028-006 AI/ML Release Report	JD-017	Algorithm integration specifications (from Phase 2)
AI/ML V&V Checks	✓	R-TF-028-010 AI/ML V&V Checks	JD-017	AI/ML verification and validation complete (from Phase 2)
AI Risk Matrix	✓	R-TF-028-011 AI/ML Risk Assessment	JD-017	AI-specific risks managed (from Phase 2)

Note: Per GP-028, all AI/ML development activities were completed during Phase 2, before software development began in Phase 3. Phase 5 validation reviews the AI/ML documentation produced in Phase 2 and verifies that algorithms were correctly integrated in the final product.

Clinical Validation of AI/ML Performance: The clinical evaluation (GP-015) validates that the AI/ML models, which were developed and technically verified in Phase 2, perform correctly in their intended use environment with real clinical conditions. Clinical investigation confirms that:

• AI/ML algorithms function as intended in actual clinical workflows
• Model outputs are clinically relevant and accurate in real-world use
• Device performance meets clinical requirements with integrated AI/ML components
• Safety and efficacy are demonstrated in the target patient population and clinical settings

This clinical validation complements the technical AI/ML verification from Phase 2, ensuring end-to-end validation from algorithm development to clinical deployment.

Design Transfer and Release Documentation

Document	Status	Reference	Comments
Labeling and IFU Requirements	✓	Instructions for Use	Labels and IFU complete with required information
Device Master File (DMF)	✓	Technical File root: Legit.Health Plus 1.1.0.0	Complete technical documentation

Note: The R-TF-012-039 Validated Version Transfer document is completed at the end of Phase 5, after Clinical Evaluation and Commissioning are finalized, as the final step before market release. See section "Validated Version Transfer" below.

Stakeholder Requirements Validation

According to IEC 62304 and MDR 2017/745, product validation must confirm that all stakeholder requirements have been satisfied. The following validation confirms that the product meets the needs of all identified stakeholders:

Internal Stakeholders (Company)

Stakeholder	Category	Requirements Validated	Evidence	Status
JD-001 (General Manager)	Business	Business strategy and market requirements	Product ready for target markets (EU/EEA, USA), business objectives achieved	✓
JD-003 (Design & Development Mgr)	Regulatory	Regulatory requirements and compliance	EU MDR (Class IIb) and FDA (Class II) requirements satisfied, R-TF-008-001 GSPR Checklist complete	✓
JD-007 (Technical Manager)	Technical	Technical feasibility and system performance	Software verified per R-TF-012-035 Software Test Report, system performance meets specifications	✓
JD-004 (Quality Manager & PRRC)	Quality	Quality requirements and compliance verification	Quality management system compliant, all quality gates passed	✓
JD-018 (Clinical Affairs)	Clinical	Clinical needs and evidence requirements	Clinical Evaluation Report demonstrates clinical benefits	✓

External Stakeholders (Users, Patients, Regulatory, Market)

Stakeholder Type	Category	Requirements Validated	Evidence	Status
Primary Users (Clinicians)	End User	Usability and clinical workflow requirements	R-TF-025-003 Summative Evaluation Report confirms no critical use errors, workflow requirements met	✓
Patients	Patient	Safety requirements and data privacy	Risk-benefit analysis favorable, R-TF-013-003 Risk Management Report, patient safety demonstrated	✓
Regulatory Bodies (EU, FDA)	Regulatory	Compliance with EU MDR and FDA requirements	Technical documentation complete for regulatory submission, all standards compliance verified	✓
Target Markets (EU/EEA, USA)	Market	Regional requirements and local regulations	EU MDR Class IIb requirements met, FDA Class II requirements met, ready for market entry	✓
Healthcare Institutions	Customer	Integration requirements and technical specifications	System integration validated, technical specifications documented in R-TF Device Description and Specification	✓
Notified Body	Regulatory	Technical documentation for conformity assessment	Complete technical file ready for CE marking submission	✓

Stakeholder Validation Conclusion: All stakeholder requirements have been validated and satisfied. The product meets the needs of:

• ✓ End users (clinicians) through validated usability and clinical workflow integration
• ✓ Patients through demonstrated safety and clinical benefits
• ✓ Regulatory bodies through compliance with EU MDR and FDA requirements
• ✓ Target markets through regional requirement satisfaction
• ✓ Healthcare institutions through technical integration capability
• ✓ Company through business, quality, and regulatory objectives achievement

Final Risk Management Review

Verification of Effectiveness of Risk Control Measures

Per GP-013 and ISO 14971:2019, Phase 5 includes the final review of the Risk Management File to confirm that all risk control measures have been implemented and their effectiveness verified. This is done by completing the "Verification of Effectiveness" column in the Risk Management Record.

Review Activity	Status	Evidence	Conclusion
Review of all identified risks	✓	R-TF-013-002 Risk Management Record	Complete risk inventory confirmed
Verification that all risk controls are implemented	✓	Traceability to verification tests	All controls implemented as designed
"Verification of Effectiveness" column completed	✓	R-TF-013-002 Risk Management Record	Each control measure effectiveness confirmed
Review of residual risk acceptability	✓	Risk acceptability per ISO 14971	All residual risks within acceptable limits
Review for new risks introduced by risk control measures	✓	R-TF-013-002 Risk Management Record	No unacceptable new risks introduced
Overall residual risk evaluation	✓	R-TF-013-003 Risk Management Report	Overall residual risk acceptable

Verification of Effectiveness Assessment:

• Are all risk control measures implemented?: Yes
• Has the effectiveness of each risk control measure been verified?: Yes (documented in "Verification of Effectiveness" column)
• Are all residual risks acceptable?: Yes

Risk-Benefit Analysis

Assessment	Status	Evidence	Conclusion
All risks identified and assessed	✓	R-TF-013-002 Risk Management Record	Complete risk inventory
Risk control measures implemented and verified	✓	Verification of Effectiveness review	All controls effective
Residual risks acceptable	✓	Risk acceptability per ISO 14971	No unacceptable residual risks
Benefits documented	✓	Clinical Evaluation Report	Clinical benefits demonstrated
Risk-benefit analysis favorable	✓	R-TF-013-003 Risk Management Report	Benefits outweigh residual risks

Risk-Benefit Conclusion: The overall risk-benefit analysis is favorable. The clinical benefits of Legit.Health Plus version 1.1.0.0 for dermatological diagnosis and disease tracking significantly outweigh the residual risks. All risk control measures have been verified as effective, and no unacceptable residual risks remain.

Regulatory Requirements Compliance

EU MDR Compliance

Requirement Category	Status	Evidence	Comments
Device classification (Class IIb)	✓	R-TF Device Description and Specification	Classification justified
General Safety and Performance Requirements (GSPR)	✓	R-TF-008-001 GSPR Checklist	All applicable GSPRs satisfied
Clinical evaluation requirements	✓	Clinical Evaluation Section	Clinical evidence sufficient per MDR
Risk management per ISO 14971	✓	Risk Management Section	Risk management compliant
Post-Market Surveillance Plan	✓	R-TF-007-001 PMS Plan	PMS strategy defined
Technical documentation complete	✓	Technical File	All required documentation present

FDA Requirements

Requirement Category	Status	Evidence	Comments
Device classification (Class II)	✓	R-TF Device Description and Specification	Classification determined
Software documentation level (Moderate)	✓	R-TF-012-040 Documentation level FDA	Documentation level appropriate
Software verification and validation	✓	Software V&V Section	V&V activities complete
Cybersecurity documentation	✓	Cybersecurity Section	Security documented per FDA guidance
Clinical performance data	✓	Clinical Evaluation Section	Clinical data supports 510(k)

Standards Compliance

Standard	Status	Evidence	Applicability
IEC 62304 (Software lifecycle)	✓	R-TF EN 62304 Checklist	Class B requirements satisfied
IEC 82304-1 (Health software)	✓	R-TF EN 82304 Checklist	Health software requirements met
ISO 14971 (Risk management)	✓	R-TF-013-004 Checklist ISO 14971	Risk management compliant
IEC 81001-5-1 (Cybersecurity)	✓	Cybersecurity documentation	Security requirements addressed
IEC 62366-1 (Usability)	✓	R-TF-025-001 Usability Plan	Usability engineering process followed

Commissioning Activities

Per GP-029, commissioning activities validate that the device performs as designed in the production environment before market release.

Commissioning Records

Document	Status	Reference	Comments
Deployment and Configuration Commissioning Record	✓	R-TF-029-001	Production environment configured and validated
Functional and Interface Commissioning Record	✓	R-TF-029-002	Core functionalities tested in production
Clinical Workflow and Operational Readiness Commissioning Record	✓	R-TF-029-003	Clinical workflows validated in real environment

Commissioning Status:

• Does the software version behave as expected on the production environment?: Yes
• Production readiness confirmed: Yes

Post-Commissioning Risk Review

Per GP-013 and ISO 14971:2019, after commissioning activities are completed, a final review of the Risk Management File is required to confirm that no new risks were identified during commissioning in the production environment.

New Risks Identification Review

Review Item	Status	Evidence	Conclusion
New risks identified during deployment and configuration commissioning	✓	R-TF-029-001 review	No new risks identified
New risks identified during functional and interface commissioning	✓	R-TF-029-002 review	No new risks identified
New risks identified during clinical workflow commissioning	✓	R-TF-029-003 review	No new risks identified
Risk Management Record updated if applicable	✓	R-TF-013-002 Risk Management Record	No updates required - no new risks identified
Overall residual risk assessment remains valid	✓	R-TF-013-003 Risk Management Report	Risk-benefit analysis remains favorable

Post-Commissioning Risk Assessment:

• Were any new risks identified during commissioning activities?: No
• Were any existing risk control measures found to be ineffective in the production environment?: No
• Does the Risk Management File require updates?: No
• Risk Management File closure confirmed: Yes

Validated Version Transfer

After successful completion of all Phase 5 activities (Clinical Evaluation, Usability Summative Evaluation, Final Risk Management Review with Verification of Effectiveness, and Commissioning), the validated version is formally transferred to production.

Document	Status	Reference	Comments
Validated Version Transfer	✓	R-TF-012-039 Validated Version Transfer	Final transfer to production after validation complete

Transfer Checklist:

• ✓ All validation activities completed (Clinical, Usability Summative)
• ✓ Final Risk Management Review completed (Verification of Effectiveness confirmed)
• ✓ Commissioning activities completed (production environment validated)
• ✓ Post-Commissioning Risk Review completed (no new risks identified)
• ✓ All regulatory requirements satisfied
• ✓ Risk-benefit analysis favorable
• ✓ Post-market surveillance infrastructure ready
• ✓ Version 1.1.0.0 approved for market release

Information Provided by Manufacturer

Labeling and Instructions for Use

Item	Status	Reference	Comments
Instructions for Use (IFU) complete	✓	IFU Documentation	All required information included
IFU contains intended use	✓	Intended use clearly stated	Consistent with technical documentation
IFU contains indications and contraindications	✓	Medical information complete	Clinically appropriate
IFU contains warnings and precautions	✓	All safety information present	Risk communication adequate
IFU contains technical specifications	✓	Device specifications documented	Complete technical information
Labels contain required information	✓	UDI, manufacturer information, CE mark ready	Regulatory labeling requirements met

IFU Assessment:

• Does the IFU and labeling contain all expected information?: Yes

Design History File (DHF) Final Review

Item	Status	Comments
DHF complete and organized	✓	All development and validation records present
Traceability complete	✓	End-to-end traceability: PR → SRS → Implementation → Tests → Results
All phase reviews documented	✓	Phases 1-5 reviews complete
All procedural reports included	✓	Risk, clinical, cybersecurity, AI/ML, usability reports present
Change control records complete	✓	All changes documented and approved
SOUP documentation complete	✓	All third-party software documented
Version control records complete	✓	Software versioning documented

Distribution and Market Release

Target Markets

• EU/EEA: CE marking pathway via Notified Body
• United States: FDA 510(k) clearance pathway
• Other markets: [Specify additional target markets]

Regulatory Submissions

Submission	Status	Target Date	Comments
CE Technical Documentation submission	Ready	[Date]	Technical file complete for Notified Body review
FDA 510(k) submission	Ready	[Date]	510(k) documentation package complete

Reserves and Pending Actions

N°	Issue / Action Required	Owner	Targeted Date	Status
-	No reserves identified at this phase	-	-	-

Final Approval

Certification and Registration

• Approval for product certification and registration?: Yes
• Ready for CE marking process?: Yes
• Ready for FDA 510(k) submission?: Yes

Market Release Authorization

• All validation activities completed?: Yes
• All regulatory requirements satisfied?: Yes
• Risk-benefit analysis favorable?: Yes
• Product ready for market release?: Yes

Conclusion

Review Outcome: The Phase 5 Product Validation review has been successfully completed.

Comprehensive Assessment:

1. Verification and Validation Complete:

   • Software verification completed with all tests passed
   • Clinical evaluation demonstrates safety and efficacy
   • Usability validation confirms device is safe and effective for intended users
   • AI/ML models validated and meet performance requirements
   • All validation activities documented and reviewed

2. Risk Management:

   • Comprehensive risk analysis completed per ISO 14971
   • All identified risks assessed and controlled
   • Risk-benefit analysis is favorable
   • Benefits significantly outweigh residual risks
   • Post-market surveillance plan established

3. Regulatory Compliance:

   • EU MDR requirements satisfied (Class IIb device)
   • FDA requirements satisfied (Class II device)
   • All applicable harmonized standards met
   • General Safety and Performance Requirements (GSPR) addressed
   • Technical documentation complete and compliant

4. Procedural Reports:

   • Risk Management Report complete and favorable
   • Clinical Evaluation Report demonstrates clinical benefits
   • Cybersecurity Report confirms security controls effective
   • Usability Report shows no critical use errors
   • AI/ML Validation Report confirms model performance

5. Technical Documentation:

   • Design History File (DHF) complete and organized
   • Full traceability maintained throughout lifecycle
   • All design controls satisfied
   • Configuration management compliant
   • Device Master File (DMF) ready for regulatory submission

6. Labeling and Information:

   • Instructions for Use complete with all required information
   • Labeling meets regulatory requirements
   • Risk communication adequate
   • User information clear and comprehensive

7. Commissioning and Deployment:

   • Production environment validated
   • Software behaves as expected in production
   • Deployment procedures verified
   • Post-market monitoring infrastructure operational

Regulatory Authorization:

• The product is approved for CE marking certification process
• The product is approved for FDA 510(k) submission
• The product meets all requirements for market release in target jurisdictions

Regarding the mentioned reserves, has the review been accepted?: Yes

Final Decision:

✓ Product Legit.Health Plus Version 1.1.0.0 is APPROVED for market release

The product has successfully completed all phases of design, development, verification, and validation. All regulatory requirements are satisfied, and the device is ready for:

• Regulatory body submissions (CE marking, FDA 510(k))
• Commercial deployment in approved markets
• Post-market surveillance activities

Next Steps:

1. Submit technical documentation to Notified Body for CE marking
2. Submit 510(k) to FDA for US market clearance
3. Initiate post-market surveillance activities per R-TF-007-001 PMS Plan
4. Deploy to production following GP-029 deployment procedures
5. Monitor device performance and user feedback
6. Maintain vigilance system for adverse events and incidents

---

Approved by:

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Author: Team members involved
• Reviewer: JD-003, JD-004
• Approver: JD-001