R-TF-007-001 Post-Market Surveillance (PMS) Plan

Purpose

This plan describes product-specific post-market surveillance activities to monitor the safety and performance of devices placed on the market and continuously review the benefit-risk analysis.

Scope

This PMS plan applies to:

• Legit.Health Plus (version 1.1.0.0): this is our class IIb medical device according to the requirements set out in MDR 2017/745.

This plan is for the device Legit.Health Plus, but to define the post-market activities for the Legit.Health Plus, we will need summarise the results of the activities of the PMS report of Legit.Health device (class I legacy device). Then, next year, the PSUR for Legit.Health Plus device (class IIb) will be completed.

Legit.Health (version 2.1) is our class I legacy device certified according to the requirements set out in MDD 93/42/EEC.

The period under evaluation for the class I legacy device is from January 2021 to December 2025.

Surveillance period

The period under evaluation for the class IIb device (Legit.Health Plus) will cover from the date of the first device placed on the market up to one calendar year.

Regulatory references

This Post-Market Surveillance Plan follows the requirements set out in Regulation (EU) 2017/745 on medical devices, specifically Articles 83, 84, 86 (as applicable), and Annex III in its entirety

Abbreviations

• PMS: Post-market surveillance
• PMCF: Post-market clinical follow up
• FSCA: Field Safety Corrective actions
• CAPA: Corrective Action Preventive Action
• PSUR: Periodic Safety Update Report
• CER: Clinical Evaluation Report
• PMCF report: Post-Market Clinical Follow-up report

General considerations

Annex III section 1.1(b) of MDR 2017/745 describes the requirements applicable to the post-market surveillance plan.

The table below shows the regulatory requirements and how we comply with them:

MDR requirement	Activity
A proactive and systematic process to collect any information referred to in point (a). The process shall allow a correct characterisation of the performance of the devices and shall also allow a comparison to be made between the device and similar products available on the market	GP-007 Post-market surveillance
Effective and appropriate methods and processes to assess the collected data	GP-007 Post-market surveillance
Suitable indicators and threshold values that shall be used in the continuous reassessment of the benefit-risk analysis and of the risk management as referred to in Section 3 of Annex I	R-TF-007-001 Post-Market Surveillance (PMS) Plan, section Trend analysis
Effective and appropriate methods and tools to investigate complaints and analyse market-related experience collected in the field	GP-014 Feedback and complaints
Methods and protocols to manage the events subject to the trend report as provided for in Article 88, including the methods and protocols to be used to establish any statistically significant increase in the frequency or severity of incidents as well as the observation period	R-TF-007-001 Post-Market Surveillance (PMS) Plan, section Trend analysis
Methods and protocols to communicate effectively with competent authorities, notified bodies, economic operators and users	GP-004 Vigilance system
Reference to procedures to fulfil the manufacturers obligations laid down in Articles 83, 84 and 86	GP-007 Post-market surveillance
Systematic procedures to identify and initiate appropriate measures including corrective actions	GP-006 Non-conformities, Corrective and preventive actions
Effective tools to trace and identify devices for which corrective actions might be necessary	GP-006 Non-conformities, Corrective and preventive actions; SP-004-001 Product withdrawal; GP-016 Traceability and identification
A PMCF plan as referred to in Part B of Annex XIV, or a justification as to why a PMCF is not applicable	R-TF-007-002 Post-Market Clinical Follow-up (PMCF) Plan

Data collection activities

The following table provides a summary of the identified PMS activities together with responsibilities, frequency of the activities and documents where the activities and their results are detailed.

PMS Activity	Responsible Person	Frequency of Review	Initial Data Source Procedure (IDSP)	MDR Vigilance Type	Data Collected / Focus	Data Type (Quant/Qual)
Legacy Device Data	JD-004 / JD-005	Annual / As Needed	GP-007 (PMS), Historical Technical Files (MDD)	Proactive / Reactive	Historical incident reports, clinical data, performance issues from previous regulations.	Quantitative/Qualitative
Serious incidents and FSCA documentation	JD-004	Annual	GP-004 (Vigilance system), GP-006 (CAPA)	Reactive	Severe adverse events, trends, root cause analysis, risk reduction measures.	Quantitative/Qualitative
Non-serious incidents and undesirable side-effects documentation	JD-004 / JD-005	Annual	GP-004 (Vigilance system)	Reactive	Minor adverse events, high-volume/low-severity trends, early warning signals.	Quantitative
Customer feedback documentation	JD-005 / JD-016	Annual	GP-014 (Feedback and complaints)	Proactive/Reactive	User satisfaction, usability issues, suggestions for improvement, minor non-conformities.	Qualitative
Customer complaints documentation	JD-004	Annual	GP-014 (Feedback and complaints)	Reactive	Product failures, discrepancies in performance, reported harms, complaint resolution status.	Quantitative/Qualitative
Corrective and preventive actions (CAPA)	JD-004	Annual	GP-006 (Non-conformities, CAPA)	Reactive	Effectiveness check of actions taken, systemic issues.	Qualitative
Research data about similar devices in the market	JD-005	Annual	GP-007 (PMS)	Proactive	Safety and performance data of competing/equivalent devices, identification of new risks.	Quantitative/Qualitative
Research updates of standards and legislation	JD-004	Annual	GP-007 (PMS)	Proactive	Changes in harmonised standards, MDR updates, national implementing laws.	Qualitative
Analyse trends, decide on necessary measures and implement them	JD-005	Annual	R-TF-007-001 (PMS Plan, section Trend analysis), GP-006 (CAPA)	Proactive/Reactive	Statistical analysis of incident/complaint data, early detection of statistically significant increases.	Quantitative
Clinical literature review	JD-005	Annual	GP-007 (PMS) / R-TF-007-002 (PMCF Plan)	Proactive	New clinical data, long-term safety/performance, state-of-the-art for the device category.	Qualitative
Research on cybersecurity and state of the art	JD-005	Annual	GP-007 (PMS)	Proactive	Identified security flaws, patch status, industry best practices, new technologies.	Qualitative
Research on security vulnerabilities of SOUPs and software tools	JD-017	Semi-annual	GP-007 (PMS)	Proactive	Known vulnerabilities in third-party software (Software of Unknown Provenance), dependency scanning.	Qualitative
Conduct post-market clinical follow-up (PMCF) activities	JD-005	Annual	R-TF-007-002 (PMCF Plan)	Proactive	Targeted clinical data collection, long-term safety, device performance in the target population.	Quantitative/Qualitative
Update risk management file	JD-004	Annual	GP-006 (CAPA) / GP-007 (PMS)	Proactive/Reactive	New/changed risks, risk-benefit ratio re-evaluation, residual risk acceptability.	Qualitative

Legacy Device Data

Legacy device data is collected and reviewed by JD-004 and JD-005 on an annual or as-needed basis. The data sources include GP-007 (PMS) and historical technical files (MDD). This proactive and reactive activity focuses on historical incident reports, clinical data, and performance issues from previous regulations, and is both quantitative and qualitative. The analysis of legacy device data informs the ongoing PMS activities for the current device and ensures continuity in safety and performance monitoring.

Serious incidents and FSCA

Serious incidents are documented, notified to Regulatory Authorities, investigated and addressed according to the requirements set out in GP-004 Vigilance system and in GP-006 Non-conformities, Corrective and preventive actions. Once a year, JD-004 will actively analyse the new data collected from the vigilance system. The R-TF-007-003 PSUR will summarize the number of reported serious incidents, their investigation results and any taken subsequent measures. The same approach is followed for Field Safety Corrective Actions (FSCA): they are documented, notified to Regulatory Authorities and implemented according to the requirements set out in GP-004 Vigilance system and in SP-004-001 Product withdrawal. The PSUR will summarize the number of FSCA initiated and their status (ongoing, completed).

Non-serious incidents and undesirable side-effects

Non-serious incidents and undesirable side-effects are documented, investigated and addressed according to the requirements set out in GP-004 Vigilance system. The non-conformities detected are registered in the T-006-001 Non-conformity report and are reviewed every 3 months to monitor their status. They are also reviewed on a yearly basis by JD-004 and the evaluation results and conclusions will be summarised in the R-TF-007-003 PSUR. Minor adverse events, high-volume/low-severity trends, and early warning signals are monitored as part of this process.

Customer feedback

Feedback from users is documented, analysed and addressed according to the requirements set out in GP-014 Feedback and complaints and is evaluated every year by JD-005 and JD-016 to identify any actions and improvements to be implemented on the products. This includes user satisfaction, usability issues, suggestions for improvement, and minor non-conformities. Evaluation and results of user feedback will be summarised in the R-TF-007-003 PSUR.

Customer complaints

Customer complaints are documented, analysed and addressed as explained in GP-014 Feedback and complaints. As part of the analysis, JD-005 or JD-004 will identify whether there are any non-serious incidents or serious incidents and categorise them as such. In case of serious incidents, we will follow the reporting process described in GP-004 Vigilance system. Customer complaints will be reviewed on a yearly basis by JD-004 and the results of the revision will be summarised in the R-TF-007-003 PSUR.

Corrective and preventive actions (CAPA)

Corrective and preventive actions are documented, investigated, implemented and verified for effectiveness according to the requirements set out in GP-006 Non-conformities, CAPA. These actions are reviewed every 3 months by JD-004 to review their status and/or their effectiveness. Once a year, JD-004 performs an additional review and the evaluation results and conclusions will be summarised in the R-TF-007-003 PSUR. The focus is on the effectiveness check of actions taken and identification of systemic issues.

Research data about similar devices in the market

Research data about similar devices is gathered and reviewed annually by JD-005 using GP-007 (PMS) as the data source. This proactive activity focuses on safety and performance data of competing or equivalent devices and identification of new risks. The results are both quantitative and qualitative and are used to inform the ongoing PMS activities.

Research updates of standards and legislation

Research updates of standards and legislation are performed annually by JD-004 using GP-007 (PMS) as the data source. This proactive activity focuses on changes in harmonised standards, MDR updates, and national implementing laws. The results are qualitative and are used to ensure ongoing compliance.

Analyse trends, decide on necessary measures and implement them

Trend analysis is performed annually by JD-005 using the PMS Plan (section Trend analysis) and GP-006 (CAPA) as data sources. This activity includes statistical analysis of incident and complaint data and early detection of statistically significant increases. If a trend is detected, a CAPA will be opened to investigate the incidents and the reporting process in GP-007 Post-market surveillance will be followed.

Clinical literature review

Clinical literature is reviewed annually by JD-005 using GP-007 (PMS) and R-TF-007-002 (PMCF Plan) as data sources. This proactive activity focuses on new clinical data, long-term safety and performance, and the state-of-the-art for the device category. The results are qualitative and are summarised in the PMCF evaluation report.

Research on cybersecurity and state of the art

Research on cybersecurity and state of the art is performed annually by JD-005 using GP-007 (PMS) as the data source. This proactive activity focuses on identified security flaws, patch status, industry best practices, and new technologies. The results are qualitative and are used to maintain cybersecurity effectiveness.

Research on security vulnerabilities of SOUPs and software tools

Research on security vulnerabilities of SOUPs and software tools is performed semi-annually by JD-017 using GP-007 (PMS) as the data source. This proactive activity focuses on known vulnerabilities in third-party software (Software of Unknown Provenance) and dependency scanning. The results are qualitative and are used to mitigate risks related to software components.

Conduct post-market clinical follow-up (PMCF) activities

Post-market clinical follow-up activities are conducted annually by JD-005 using R-TF-007-002 (PMCF Plan) as the data source. This proactive activity focuses on targeted clinical data collection, long-term safety, and device performance in the target population. The results are both quantitative and qualitative and are summarised in the PMCF evaluation report.

Update risk management file

The risk management file is updated annually by JD-004 using GP-006 (CAPA) and GP-007 (PMS) as data sources. This proactive and reactive activity focuses on new or changed risks, risk-benefit ratio re-evaluation, and residual risk acceptability. The results are qualitative and are used to ensure ongoing risk management.

Integration of PMS and PMCF results into risk management and clinical evaluation:

• All relevant findings from PMS and PMCF activities (including new risks, changes in frequency/severity, and emerging safety signals) are systematically reviewed and incorporated into the risk management file.
• The risk management process is closely linked to the clinical evaluation, ensuring that any new information affecting the benefit-risk profile is reflected in the Clinical Evaluation Report (CER).
• Identified risks or changes are assessed for impact, and risk control measures are updated as necessary.
• This integration ensures continuous alignment with MDR requirements and supports the ongoing demonstration of device safety and performance.

PMCF activities

A PMCF plan has been developed for the device to consistently collect relevant clinical data, confirming the benefit-risk determination in the Risk Management Report (R-TF-013-003) and Clinical Evaluation Report (R-TF-015-003).

In accordance with Annex XIV Part B of MDR 2017/745 and MDCG 2020-7 guidance, the need for PMCF for this class IIb device is justified as follows:

• The device is innovative medical software with new functionalities and algorithms.
• There are residual clinical uncertainties after the initial clinical evaluation.
• It is necessary to confirm long-term safety and performance in the target population and under real-world conditions.

The PMCF plan includes:

• Systematic collection of post-market clinical data.
• Ongoing monitoring of safety and performance in clinical practice.
• Identification of emerging risks and verification of the acceptability of the benefit-risk balance.
• Methods: observational studies, real-world data analysis, user surveys, and continuous literature review.

This information is integrated into the PSUR and the periodic update of the clinical evaluation.

Planned PSUR

For a class IIb device, a Periodic Safety Update Report (PSUR) will be prepared in accordance with Article 86 of MDR 2017/745 and following the recommendations of MDCG 2022-21 and related guidance documents. The PSUR will be updated at least every two years and will summarize and analyze the results of the post-market surveillance activities described in this plan.

The PSUR will include:

• Confirmation of the benefit/risk determination
• Identification of new risks or trends
• Any changes to the clinical evaluation
• Actions taken or planned to ensure the continued safety and performance of the device
• Summary of vigilance activities (including serious incidents, FSCA, and trend reporting)
• Summary of PMCF activities and results
• Conclusions and recommendations for risk management and clinical evaluation

The PSUR will be prepared in accordance with the structure and content recommended by MDCG 2022-21. When EUDAMED becomes fully functional, the PSUR will be submitted through the EUDAMED database as required. Until then, the PSUR will be made available to the notified body and competent authorities upon request, as required by the regulation and guidance.

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Author: Team members involved
• Reviewer: JD-003, JD-004
• Approver: JD-005