Risk Management Record

The endpoints of the device follow HL7's FHIR interoperability standard and information in Instructions for Use

Process for verification is defined in GP-012 Design, redesign and development. In addition, IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 to ensure that they include the information (TEST_011_We facilitate the integration of the device into the users' system).

HL7's FHIR standard compliance is verified at the TEST_013_The data that users send and receive follows the FHIR healthcare interoperability standard.

R-TF-012-015 Summative evaluation report_2024_001

The endpoints of the device follow ICD-9, ICD-10 and ICD-11, and they are also mapped to the output

Verification of REQ_004 is recorded in the TEST_004_The user receives an interpretative distribution representation of possible ICD categories represented in the pixels of the image.

R-TF-012-015 Summative evaluation report_2024_001

R-TF-015-003 Clinical Evaluation Report (section: Valid clinical association of the International Classification of Diseases (ICD) classes)

The endpoints of the device follow HL7's FHIR interoperability standard and we developed a integration manual within the IFU that explains the values, as well as a Swagger documentation

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

HL7's FHIR standard compliance is verified at the TEST_013_The data that users send and receive follows the FHIR healthcare interoperability standard.

R-TF-012-015 Summative evaluation report_2024_001

The endpoints of the device follow HL7's FHIR interoperability standard and we developed a integration manual within the IFU that explains the values, as well as a Swagger documentation

We define the minimum user interface requirements to show the medical device outputs to HCPs

Minimum user interface requirements are provided in the IFU

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

HL7's FHIR standard compliance is verified at the TEST_013_The data that users send and receive follows the FHIR healthcare interoperability standard.

R-TF-012-015 Summative evaluation report_2024_001

Information about device outputs are detailed in the IFU.

The medical device returns metadata about the output that helps supervising it, such as explainability media and other metrics.

AI models undergo retraining using expanded dataset of images.

Process for verification is defined in GP-012 Design, redesign and development.

We specify in the intended purpose of the device that is a support tool, not a diagnosis one, meaning that it must always be used under the supervision of HCPs, who should confirm or validate the output of the device considering the medical history of the patient, and other possible sympthoms they could be suffering, especially those that are not visible or have not been supplied to the device (TEST_011).

Verification of the implementation of metadata about the output of the device to help supervising the output: TEST_001, TEST_002, TEST_003

R-TF-012-015 Summative evaluation report_2024_001

R-TF-015-003 Clinical Evaluation Report (sections: Instructions for Use, Associated Design Product Requirement, Clinical performance)

Information about device outputs are detailed in the IFU.

The medical device returns metadata about the output that helps supervising it, such as explainability media and other metrics.

The device returns an interpretative distribution representation of possible ICD categories, not just one single condition.

AI models undergo retraining using expanded dataset of images.

Process for verification is defined in GP-012 Design, redesign and development.

Implementation of device output information in the IFU verified in TEST_011.

Verification of the implementation of metadata about the output of the device to help supervising the output: TEST_001, TEST_002, TEST_003.

Verification of the implementation of interpretative distribution representation of possible ICD categories verified in TEST_004.

R-TF-012-015 Summative evaluation report_2024_001

R-TF-015-003 Clinical Evaluation Report (sections: Instructions for Use, Associated Design Product Requirement, Valid clinical association of the International Classification of Diseases (ICD) classes, Clinical performance)

Information about device outputs are detailed in the IFU.

The medical device returns metadata about the output that helps supervising it, such as explainability media and other metrics.

The device returns an interpretative distribution representation of possible ICD categories, not just one single condition.

AI models undergo retarining using expanded dataset of images.

Process for verification is defined in GP-012 Design, redesign and development.

Implementation of device output information in the IFU verified in TEST_011.

Verification of the implementation of metadata about the output of the device to help supervising the output: TEST_001, TEST_002, TEST_003.

Verification of the implementation of interpretative distribution representation of possible ICD categories verified in TEST_004.

R-TF-012-015 Summative evaluation report_2024_001

R-TF-015-003 Clinical Evaluation Report (sections: Instructions for Use, Associated Design Product Requirement, Valid clinical association of the International Classification of Diseases (ICD) classes, Clinical performance)

State-of-the-art security measures to avoid unauthorized access to data, malignant uses and hacking, and information about authentication process for users are available in IFU

TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-012-015 Summative evaluation report_2024_001

R-TF-015-003 Clinical Evaluation Report (sections: Associated Design Verification Test, Requirement on devices that incorporate software or for software that are devices in themselves (GSPR 17.2), Instructions for Use)

A requirement of the device defines the creation of a processor whose purpose is to ensure that the image have enough quality. In other words, an algorithm, similar to the ones used to classify diseases, is used to check the validity of the image and provides an image quality score.

The device returns meaningful messages to the users about the quality score of the images. This allows care providers to re-take a photo.

The IFU contain the `How to take pictures` section with recommendation on how to take pictures with high quality.

We also offer training to the users to optimize the imaging process so that it is optimal for the device's operation.

Verification is defined in:

TEST_009_Notify the user if the quality of the image is insufficient,

TEST_007_If something does not work, the API returns meaningful information about the error,

TEST_011_We facilitate the integration of the device into the users' system

R-TF-001-006 IFU and label validation

R-TF-015-003 Clinical Evaluation Report (sections: Associated Design Product Requirement, Associated Design Verification Test, Clinical performance)

R-TF-012-015 Summative evaluation report_2024_001

A requirement of the device defines the creation of a processor whose purpose is to ensure that the image have enough quality. In other words, an algorithm, similar to the ones used to classify diseases, is used to check the validity of the image and provides an image quality score.

The device returns meaningful messages to the users about the quality score of the images. This allows care providers to re-take a photo.

The IFU contain the `How to take pictures` section with recommendation on how to take pictures with high quality plus in the Contraindications section of the IFU we state the following: We advise the user not to use the device if skin structures are not accessible by a camera, such as being located in a skin fold or is otherwise covered.

We also offer training to the users to optimize the imaging process so that it is optimal for the device's operation.

TEST_009_Notify the user if the quality of the image is insufficient

TEST_007_If something does not work, the API returns meaningful information about the error

TEST_011_We facilitate the integration of the device into the users' system

R-TF-001-006 IFU and label validation

R-TF-015-003 Clinical Evaluation Report (sections: Associated Design Product Requirement, Associated Design Verification Test, Clinical performance)

R-TF-012-015 Summative evaluation report_2024_001

State-of-the-art techniques of security and software availability.

The device returns meaningful messages about the error

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

TEST_007 verifies REQ_007

R-TF-012-015 Summative evaluation report_2024_001

State-of-the-art techniques of security and software availability.

The device returns meaningful messages about the error

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

TEST_007 verifies REQ_007

R-TF-012-015 Summative evaluation report_2024_001

State-of-the-art techniques of security and software availability.

The device returns meaningful messages about the error

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

TEST_007 verifies REQ_007

R-TF-012-015 Summative evaluation report_2024_001

State-of-the-art techniques of security and software availability

The device returns meaningful messages about the error

The endpoints of the device follow HL7's FHIR interoperability standard

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

TEST_007 verifies REQ_007

TEST_013 verifies REQ_006

R-TF-012-015 Summative evaluation report_2024_001

The deployment of the medical devices uses elastic demand design. The medical device makes constant backups. State-of-the-art techniques of security and software availability.

Due to the inherent features of the REST protocol, when a user send a request and the device is down, the device returns a specific code informing of the state of the device, including downtime. This means that the user will be automatically aware of downtime, as well as any other states.

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

TEST_007 verifies REQ_007

R-TF-012-015 Summative evaluation report_2024_001

The contracting process includes a contract in which the customer declares they are a healthcare provider

Instructions for use explain the intended users of the medical device and security requirements and recommendations

Stringent security measures:

- implementation of a robust authentication mechanisms such as OAuth or JWT to ensure that only authorized users can access the API. Role-based access control further restricts user privileges, enhancing data security;

- implementation of data encryption: all data transmitted between the user and the API is encrypted using industry-standard encryption protocols, such as SSL/TLS, to protect against eavesdropping and data breaches

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

Reviewed and signed contract services with customers.

GP-009 Sales

R-TF-012-015 Summative evaluation report_2024_001

Instructions for use include information about the intended user and their qualification, plus IFU contain the section `Security requirements and recommendations` to ensure best security practices are followed by ITPs

Implementation of authentication process and security controls to avoid unintended use of the device

TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-012-015 Summative evaluation report_2024_001

Instructions for use include information about the intended user and their qualification, plus IFU contain the section `Security requirements and recommendations` to ensure best security practices are followed by ITPs

Implementation of authentication process and security controls to avoid unintended use of the device

TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-012-015 Summative evaluation report_2024_001

Instructions for use include information about the intended user and their qualification, and instructions on how to integrate the device

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and TEST_011 to ensure that they include the information.

R-TF-012-015 Summative evaluation report_2024_001

Medical device is developed and produced according to harmonized standards for medical device in compliance with the applicable GSPR

The compliance with the GSPR is compiled at the R-TF-008-001_GSPR_2023_001

Internal/external audits

R-TF-015-003 Clinical Evaluation Report (section: Compliance with applicable regulatory requirements)

Implement a risk management process according to ISO 14971

R-TF-008-001 General Safety Performance Requirements (GSPR) 2023_001.

Risk management process is described at the GP-013 Risk management and documented in the applicable records:

R-TF-013-001 Risk management plan

R-TF-013-002 Risk management record

R-TF-013-003 Risk management report

Internal/external audits

Periodic review of GP-013 (Risk management), periodic review of risk management plan, record and report, stay up-to-date with any revision of the standard

IFU designed and developed according to harmonized standards for medical device

If the issue is access to the internet, the user would also not be able to use the device, so there is no risk of using the device without access to the instructions.

Provide the IFU in paper form upon request

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information. Procedure for managing paper IFU's request (SP-001-001 - eIFU)

R-TF-012-015 Summative evaluation report_2024_001

We specify the product intended purpose in the IFU and label to ensure this information is always available for the users

IFU and label verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-012-015 Summative evaluation report_2024_001

A requirement of the device defines the creation of a processor whose purpose is to ensure that the image have enough quality. In other words, an algorithm, similar to the ones used to classify diseases, is used to check the validity of the image and provides an image quality score.

The device returns meaningful messages about the quality score of the images. This allows care providers to re-take a photo.

The IFU contain a dedicated section on how to take pictures (section name: `How to take pictures`) and technical specifications of the camera (section: `Technical specifications`)

We also offer training to the users to optimize the imaging process so that it is optimal for the device's operation.

Verification is defined in TEST_009_Notify the user if the quality of the image is insufficient.

TEST_007 verifies REQ_007.

TEST_011 and R-TF-001-006 IFU and label validation verify REQ_012

R-TF-015-003 Clinical Evaluation Report (sections: Validation and testing of machine learning models, Post-market Clinical investigations (with focus on clinical studies whose primary endpoint is improving diagnostic accuracy))

R-TF-012-015 Summative evaluation report_2024_001

Stringent security measures:

- implementation of a robust authentication mechanisms such as OAuth or JWT to ensure that only authorized users can access the API. Role-based access control further restricts user privileges, enhancing data security;

- implementation of data encryption: all data transmitted between the user and the API is encrypted using industry-standard encryption protocols, such as SSL/TLS, to protect against eavesdropping and data breaches.

In the IFU we explain the access to the device by means of an API token that has expiration plus there is a specific section (`Security requirements and recommendations`) in which we explain security measures that ITP shall follow

Instructions detailed at the T-011-002 API token delivery and IFU. IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

R-TF-012-015 Summative evaluation report_2024_001

Develop post-market surveillance and post-market clinical follow up plans according to the regulatory requirements

R-TF-008-001 General Safety Performance Requirements (GSPR) 2023_001.

PMS and PMCF plans created: R-TF-007-001 Post-Market Surveillance (PMS) Plan and R-TF-007-002 Post-Market clinical follow-up (PMCF) Plan

Internal/external audits

We specify in the IFU the clinical safety information related to the product

IFU verification documented in TEST_011 and in R-TF-001-006 IFU and label validation 2023_001

R-TF-012-015 Summative evaluation report_2024_001

We specify in the IFU the product information for cybersecurity in the section `Security requirements and recommendations`

IFU verification documented in TEST_011 and in R-TF-001-006 IFU and label validation 2023_001

R-TF-012-015 Summative evaluation report_2024_001

A requirement of the device defines the creation of a processor whose purpose is to ensure that the image have enough quality. In other words, an algorithm, similar to the ones used to classify diseases, is used to check the validity of the image and provides an image quality score.

The device returns meaningful messages about the quality score of the images. This allows care providers to re-take a photo.

The IFU contain a dedicated section on how to take pictures (section name: `How to take pictures`) and technical specifications of the camera (section: `Technical specifications`)

We also offer training to the users to optimize the imaging process so that it is optimal for the device's operation.

Verification is defined in TEST_009_Notify the user if the quality of the image is insufficient.

TEST_007 verifies REQ_007.

TEST_011 and R-TF-001-006 IFU and label validation verify REQ_012

R-TF-015-003 Clinical Evaluation Report (sections: Validation and testing of machine learning models, Post-market Clinical investigations (with focus on clinical studies whose primary endpoint is improving diagnostic accuracy))

R-TF-012-015 Summative evaluation report_2024_001

Our device is built as an API that follows the REST protocol.

This protocol totally separates the user interface from the server and the data storage. Thanks to this, REST API always adapts to the type of syntax or platforms that the user may use, which gives considerable freedom and autonomy to the user. With a REST API, the user can use either PHP, Java, Python or Node.js servers. The only thing is that it is indispensable that the responses to the requests should always take place in the language used for the information exchange: JSON.

he data that users send and receive follows the FHIR healthcare interoperability standard

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

TEST_013 verifies REQ_006

R-TF-012-015 Summative evaluation report_2024_001

Product specifications explain the use of the REST protocol to inherently avoid bad practices in programming such as data re-writing. Every request is independent and cannot be edited.

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly

TEST_015 Ensure all API communications are conducted over HTTPS

TEST_017 Verification of authorized user registration and body zone specification in device API

TEST_018 Ensure API stability and cybersecurity of the medical device.

R-TF-012-015 Summative evaluation report_2024_001

Perform algorithm verification and validation with representative datasets, according to the procedure GP-012 Design, redesign and development.

In case of new dataset, new verification and validation activities will be carried out, according to the procedure GP-012 Design, redesign and development.

Conduct clinical testing using a wide range of representative data (from diverse demographics and conditions) to verify that the software produces consistent and reliable outputs across all use cases

GP-012 Design, redesign and development

TEST_004_The user receives an interpretative distribution representation of possible ICD categories represented in the pixels of the image

Section `AI/ML model re-training` of `R-TF-012-006 Lifecycle plan and report_2023_001`explains the re-trianing of AI models.

R-TF-015-003 Clinical Evaluation Report (section: Post-market clinical investigations)

The development of the device implements measures to improve consistency. Namely, the augmentation of images and the vast amount of images with different lightning and orientation deviations used to develop the device.

Perform algorithm verification and validation with representative datasets

AI training is explained in the GP-012 Design, redesign and development.

The verification is documented in TEST_004 The user receives an interpretative distribution representation of possible ICD categories represented in the pixels of the image

R-TF-015-003 Clinical Evaluation Report (section: Post-market clinical investigations)

R-TF-012-015 Summative evaluation report

We specify the intended user and the required qualification in the IFU

Additionally, we include at the IFU the instructions and information required by the ITPs to perform the integration of the device within their system

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-012-015 Summative evaluation report_2024_001

We carefully select the images in collaboration with Health Care Organisations and we hire HCP to perform the labeling to ensure it is properly performed (

Verification is compiled at the TEST_001_The user receives quantifiable data on the intensity of clinical signs, TEST_002_The user receives quantifiable data on the count of clinical signs, TEST_003_The user receives quantifiable data on the extent of clinical signs, TEST_004 The user receives an interpretative distribution representation of possible ICD categories represented in the pixels of the image.

R-TF-012-009 Validation and testing of machine learning models

R-TF-015-003 Clinical Evaluation Report (section: Post-market clinical investigations)

We carefully select the images in collaboration with Health Care Organisations and we hire HCP to perform the labeling to ensure it is properly performed (, )

Verification is compiled at the TEST_001_The user receives quantifiable data on the intensity of clinical signs, TEST_002_The user receives quantifiable data on the count of clinical signs, TEST_003_The user receives quantifiable data on the extent of clinical signs, TEST_004 The user receives an interpretative distribution representation of possible ICD categories represented in the pixels of the image.

R-TF-012-009 Validation and testing of machine learning models

R-TF-015-003 Clinical Evaluation Report (section: Post-market clinical investigations)

We performed clinical studies to demonstrate the clinical benefits of the medical device and we plan how to gather clinical data in the post-market phase.

Information about clinical benefits are provided in the IFU.

Plan and compilation of clinical results are documented at the R-TF-015-001 Clinical Evaluation Plan and R-TF-015-003 Clinical Evaluation Report.

Plan for post-market clinical evidence is documented in R-TF-007-002 Post-market clinical follow up plan.

Compliance with GSPR (especially for validation of intended use) documented in R-TF-008-001

R-TF-015-003 Clinical Evaluation Report (section: Clinical performance

with focus on post-market clinical investigations in which we measured the clinical utility)

We use scalable server structure (also called elastic), which is the industry standard and the widely used option.

In case of errors, the device returns meaningful messages about the error

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

TEST_007 verifies REQ_007

R-TF-012-015 Summative evaluation report (for the part of error messages and to monitor response time

accuracy of device's outputs)

The IFU explains the medical device's intended purpose

The IFU explain the device's outputs

The IFU contain a specific section (`User interface`) in which we explain the minimum requirements for the user interface that the ITP will implement

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-012-015 Summative evaluation report_2024_001

Label design has been performed according to the applicable regulations (MDR 2017/745 and ISO 15223-1). Labeling is included within the IFU and published at our website to ensure all the user can consult it when needed

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-008-001 General Safety Performance Requirements (GSPR) 2023_001.

Internal/external audits

IFU has been written according to the applicable regulations: MDR 2017/745 and ISO 15223-1

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-008-001 General Safety Performance Requirements (GSPR) 2023_001.

R-TF-012-015 Summative evaluation report_2024_001

Internal/external audits

IFU has been written according to the applicable regulations: MDR 2017/745 and ISO 15223-1

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-012-015 Summative evaluation report_2024_001

Internal/external audits

IFU has been written according to the applicable regulations: MDR 2017/745 and ISO 15223-1

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-012-015 Summative evaluation report_2024_001

Internal/external audits

Create a maintenance plan in which specifying the activities required to ensure reliable performance of the device (e.g. software and SOUPs update)

Maintenance plan for the medical device is documented in the document `R-TF-012-006 Lifecycle plan and report`.

Compliance with GSPR (especially for maintenance requirements) documented in R-TF-008-001

Control of device's version used by HCP to ensure last validated version of the device is being used. Information about changes compared to previous version provided to the users. Internal/external audits

The device does not require any performance checks activities nor maintenance by the users, as it is specified at the IFU

When a new software version with changes is released, users are properly informed following the GP-012 Design, redesign and development.

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

Transition to the updated versions is guided by the JD-005 as specified in the GP-012 Design, redesign and development

Control of device's version used by HCP to ensure last validated version of the device is being used. Information about changes compared to previous version provided to the users

The device does not require any performance checks activities nor maintenance by the users, as it is specified at the IFU.

When a new version with changes is released, users are properly informed following the GP-012 Design, redesign and development.

Additionally, we keep a record of customers that have not transitioned to the new versions that we review and update periodically.

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

Transition to the updated versions is guided by the JD-005 as specified in the GP-012 Design, redesign and development.

Customers that have not transitioned to the new versions are listed at the R-012-012 Customers product version control

Control of device's version used by HCP to ensure last validated version of the device is being used. Information about changes compared to previous version provided to the users

The IFU includes the information about the device lifetime (5 years) established in the technical documentation

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

R-TF-008-001 General Safety Performance Requirements (GSPR) 2023_001.

Internal/external audits

We have defined a procedure for the design and development process following the ISO 62304 and 13485 standards, and MDR Annex I (requirements related to design). We document all the development in the Design History File (DHF), including the product's requirements.

Product specifications (e.g. inputs, outputs, intended purpose, intended user, mode of action, technical specifications) provided in the IFU.

The design and development procedure is described at the GP-012 Design, redesign and development.

The product's requirements (user, technical and regulatory) are established within the Legit.Health DHF.

Compliance with GSPR (especially for design requirements) documented in R-TF-008-001.

IFU content verified in TEST_011 and R-TF-001-006 IFU and label validation.

Internal and external audits

If the issue is access to the internet, the use would also not be able to use the device, so there is no risk of using the device without access to the instructions. Furthermore, the IFU can be downloaded by PDF.

Moreover, the IFU is hosted on a independent instance to improve the resiliency of the information system, this means that downtime in the device does not imply downtime in the IFU. The device sends messages to the user when there is any problem with the communication between the device and the user end, so the user always receives basic instructions when something is wrong.

Furthermore, the procedure SP-001-001 - eIFU management explains the process to fulfil customer's request for paper IFU

The selection of independent instances is performed according to GP-012 Design, redesign and development

IFU are verified as registered at the TEST_011_We facilitate the integration of the device into the users' system.

Process to provide customers with IFU in paper format is explained in SP-001-001 - eIFU management

R-TF-012-015 Summative evaluation report_2024_001

A requirement of the device defines the creation of a processor whose purpose is to ensure that the image belongs to the domain of dermatology. In other words, an algorithm, similar to the ones used to classify diseases, is used to check that the image contains skin.

The device returns meaningful message about the image.

This allows care providers to prompt the user to re-take a photo.

The IFU contain a specific section on how to take pictures of skin structures to be analysed by the software (section name: `How to take pictures`) plus the section `Intended purpose or use/Device description` explains which are the inputs for the device (images of the epidermis, the dermis and its appendages, among other skin structures)

Verification is performed and documented in the TEST_008_Notify the user image modality and if the image does not represent a skin structure.

TEST_007 verifies REQ_007

TEST_011 and R-TF-001-006 IFU and label validation verify REQ_012.

R-TF-012-015 Summative evaluation report (for the part of error messages

one of the use cases can be the upload of non-skin images)

The medical device is developed and produced according to "IMDRF Principles and Practices for Medical Device Cybersecurity" (IMDRF/CYBER WG/N60FINAL:2020) and "MDCG 2019-16 - Guidance on Cybersecurity for medical devices". The procedure is defined in SP-012-002 Cybersecurity Requirements of AI/ML Models.

Stringent security measures:

- implementation of a robust authentication mechanisms such as OAuth or JWT to ensure that only authorized users can access the API. Role-based access control further restricts user privileges, enhancing data security;

- implementation of data encryption: all data transmitted between the user and the API is encrypted using industry-standard encryption protocols, such as SSL/TLS, to protect against eavesdropping and data breaches

API REST connection performance and security verification is recorded in TEST_014 The user authentication feature is functioning correctly, TEST_015 Ensure all API communications are conducted over HTTPS, TEST_017 Verification of authorized user registration and body zone specification in device API, TEST_018 Ensure API stability and cybersecurity of the medical device.

R-052-001 DPIA 2023_001 (Data Privacy Impact Assesment).

REST protocol explained in Legit.Health Plus description and specifications 2023_001

Internal/external audits

The electronic instructions for use are accessible via a web app that is accessible via any browser with any operating system. The instructions do not contain features, graphics or materials that are not universally accessible. It is also relevant to mention that the electronic access to the IFU is actually our recommended method of interacting with them, due to the intrinsic nature of the device

Users can request IFU in paper format

The selection of independent instances is performed according to GP-012 Design, redesign and development

IFU are verified as registered at the TEST_011_We facilitate the integration of the device into the users' system

R-TF-012-015 Summative evaluation report_2024_001

We include within one of the requirements defined during the design stage that one of the outputs of the device must be the version being used and this information is included in the IFU

IFU are verified as registered at the TEST_011_We facilitate the integration of the device into the users' system

R-TF-012-015 Summative evaluation report_2024_001

We carefully analyze all the SOUPs selected during the design and development of the device. We ensure compatibility by performing software tests

The SOUP anomalies have been identified in the R-TF-012-006 Lifecycle plan and report_2023_001, and in the DHF each requirement evaluated that SOUPs are compatible,

SOUPs records (part of the DHF),

compatibility testing to ensure SOUP modules work together and with other software elements

Revision of the design documentation

including requirements and SOUP records (part of the DHF) where requirements and anomalies are evaluated and documented

to ensure that the selected SOUPs were carefully analyzed and evaluated for compatibility during the design and development phases.

During the design and development of the device we evaluate that the SOUPs involved are up to date

regularly patched and maintained according to the process described in the software lifecyce plan and report (R-TF-012-006)

In the DHF each requirement evaluates that the SOUPs involved are up to date, regularly patched and maintained,

SOUPs records (part of the DHF),

R-TF-012-006 Lifecycle plan and report_2023_001 (section `SOUP maintenance`)

Revision of the design documentation

including requirements and SOUP records (part of the DHF) where requirements and anomalies are evaluated and documented

to ensure that the selected SOUPs were carefully analyzed and evaluated for compatibility during the design and development phases.

We carefully analyze all the SOUPs selected during the design and development of the device according to the process described in the software lifecyce plan and report (R-TF-012-006).

During the design review, we evaluated that these selected SOUPs have not had cybersecurity incidents related to them

SOUPs records containing evaluation in terms of cybersecurity (part of the DHF),

R-TF-012-006 Lifecycle plan and report_2023_001 (section `SOUP maintenance`)

Revision of the design documentation, including requirements and SOUP records (part of the DHF) where requirements and anomalies are evaluated and documented to ensure that the selected SOUPs were carefully analyzed and evaluated for compatibility during the design and development phases.

We plan for re-training during the design and development process, data augmentation, post-market data collection

The R-TF-012-006 Lifecycle plan and report includes a section called AI/ML model re-training that specifies re-training activities

R-TF-015-003 Clinical Evaluation Report (section: Post-market clinical investigations)

We specify that automatic re-training will not be used as a re-training strategy during the design and development process. Instead

we plan for exclusively manual retraining, data augmentation, post-market data collection

The R-TF-012-006 Lifecycle plan and report_2023_001 includes a section called AI/ML model re-training that specifies re-training activities

R-TF-015-003 Clinical Evaluation Report (section: Post-market clinical investigations)

IFU is designed in such a way that it is accessible via a dedicated and secure URL and it is also available in the website. The only requirement for accessing the eIFU is having internet connection. The users can access the IFU via any web browsers with any operations system.

Upon user's request, we provide the user with IFU in paper format according to the internal procedure SP-001-001 eIFU management

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

SP-001-001 eIFU management

R-TF-012-015 Summative evaluation report_2024_001

IFU content and versions managed and stored using git. The IFU content can be edited only by using signed commits with GPG Keys, implementation of branch structure with approvals for merging changes and automated verification of code correctness and lack of bugs or errors before merge, secure stage of environment variables in Git repository, implementation of redundant backups, both in Git repository and deployment server.

Implementation of a robust authentication systems for administrative access and a role-based access control (RBAC) framework for delineating user permissions

GP-001 Documents control explains the risk control measures implemented to achieve IFU data and content protection

TEST_011

IFU designed and developed according to harmonized standards for medical device; IFU is designed in such a way that it is accessible via a dedicated and secure URL and it is also available in the website. The only requirement for accessing the eIFU is having internet connection. The users can access the IFU via any web browsers with any operations system

Creation of a procedure for the management of paper copies of the IFU defining the process, responsibilities and timeline. The timeline is set taking into account the severity and the intended use of the device (support to diagnosis), and it is within 7 calendar days to reduce the harm of misdiagnosis, delays in proper treatment and worsening of the patient's health status.

IFU verification is recorded at R-TF-001-006 IFU and label validation 2023_001 and in TEST_011 to ensure that they include the information.

Procedure for managing paper IFU's request (SP-001-001 eIFU management)

R-TF-012-015 Summative evaluation report_2024_001

training on procedure (SP-001-001 eIFU management) for employees involved in the process

A requirement of the device defines the creation of a processor whose purpose is to ensure that the image have enough quality. In other words, an algorithm, similar to the ones used to classify diseases, is used to check the validity of the image and provides an image quality score.

The device returns meaningful messages about the quality score of the images. This allows care providers to re-take a photo.

The IFU contain a dedicated section on how to take pictures (section name: `How to take pictures`) and technical specifications of the camera (section: `Technical specifications`)

We also offer training to the users to optimize the imaging process so that it is optimal for the device's operation.

Verification is defined in TEST_009_Notify the user if the quality of the image is insufficient.

TEST_007 verifies REQ_007.

TEST_011 and R-TF-001-006 IFU and label validation verify REQ_012

R-TF-015-003 Clinical Evaluation Report (sections: Validation and testing of machine learning models, Post-market Clinical investigations (with focus on clinical studies whose primary endpoint is improving diagnostic accuracy))

R-TF-012-015 Summative evaluation report_2024_001