R-TF-007-001 Post-Market Surveillance (PMS) Plan

Purpose

This plan describes product-specific post-market surveillance activities to monitor the safety and performance of devices placed on the market and continuously review the benefit-risk analysis.

Scope

This PMS plan applies to:

• Legit.Health (version 2.1): this is our class I legacy device certified according to the requirements set out in MDD 93/42/EEC.
• Legit.Health Plus (version 1.0.0.0): this is our class IIa medical device according to the requirements set out in MDR 2017/745.

We will use the same plan for both devices to define the post-market activities; however, we will summarise the results of the activities in the PMS report for Legit.Health device (class I legacy device) and in the PSUR for Legit.Health Plus device (class IIa).

Surveillance period

The period under evaluation for the class I legacy device is from January 2021 to December 2023.

The period under evaluation for the class IIa device is yet to be determined because the device is not yet certified according to MDR requirements. We will start the collection of data from the first device placed on the market.

Regulatory references

This plan follows the requirements set out in MDR 2017/745, Article 84, and Annex III (1.1).

Abbreviations

• PMS: Post-market surveillance
• PMCF: Post-market clinical follow up
• FSCA: Field Safety Corrective actions
• CAPA: Corrective Action Preventive Action
• PSUR: Periodic Safety Update Report
• CER: Clinical Evaluation Report

General considerations

Annex III section 1.1(b) of MDR 2017/745 describes the requirements applicable to the post-market surveillance plan.

The table below shows the regulatory requirements and how we comply with them:

MDR requirement	Activity
A proactive and systematic process to collect any information referred to in point (a). The process shall allow a correct characterisation of the performance of the devices and shall also allow a comparison to be made between the device and similar products available on the market	GP-007 Post-market surveillance
Effective and appropriate methods and processes to assess the collected data	GP-007 Post-market surveillance
Suitable indicators and threshold values that shall be used in the continuous reassessment of the benefit-risk analysis and of the risk management as referred to in Section 3 of Annex I	R-TF-007-001 Post-Market Surveillance (PMS) Plan, section Trend analysis
Effective and appropriate methods and tools to investigate complaints and analyse market-related experience collected in the field	GP-014 Feedback and complaints
Methods and protocols to manage the events subject to the trend report as provided for in Article 88, including the methods and protocols to be used to establish any statistically significant increase in the frequency or severity of incidents as well as the observation period	R-TF-007-001 Post-Market Surveillance (PMS) Plan, section Trend analysis
Methods and protocols to communicate effectively with competent authorities, notified bodies, economic operators and users	GP-004 Vigilance system
Reference to procedures to fulfil the manufacturers obligations laid down in Articles 83, 84 and 86	GP-007 Post-market surveillance
Systematic procedures to identify and initiate appropriate measures including corrective actions	GP-006 Non-conformities, Corrective and preventive actions
Effective tools to trace and identify devices for which corrective actions might be necessary	GP-006 Non-conformities, Corrective and preventive actions; SP-004-001 Product withdrawal; GP-016 Traceability and identification
A PMCF plan as referred to in Part B of Annex XIV, or a justification as to why a PMCF is not applicable	R-TF-007-002 Post-Market Clinical Follow-up (PMCF) Plan

Data collection activities

The following table provides a summary of the identified PMS activities together with responsibilities, frequency of the activities and documents where the activities and their results are detailed.

PMS activity	Responsible person	Frequency of review	Evidence
Serious incidents and Field Safety Corrective Actions (FSCA) documentation	JD-004	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Serious incidents and FSCA
Non-serious incidents and undesirable side-effects documentation	JD-004 / JD-005	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Non-serious incidents and side effects
Customer feedback documentation	JD-005 / JD-016	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Customer feedback
Customer complaints documentation	JD-004	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Customer complaints
Corrective and preventive actions	JD-004	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Corrective and preventive actions
Research data about similar devices in the market	JD-005	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Data related to similar devices
Research updates of standards and legislation	JD-004	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Regulatory requirements
Analyse trends, decide on necessary measures and implement them	JD-005	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Trend analysis
Clinical literature review	JD-005	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Clinical literature
Research on cybersecurity and state of the art	JD-005	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Cybersecurity and state of the art
Research on security vulnerabilities of SOUPs and software tools	JD-017	Semi-annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Security vulnerabilities of SOUPs and software tools
Volume of sales, an estimate evaluation of the size and other characteristics of the population (such as profession) using the device and, where practicable, the usage frequency of the device, volume of sales by country	JD-005	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR), R-TF-007-004 Post-Market Surveillance (PMS) Report, section Sales data
Conduct post-market clinical follow-up activities	JD-005	Annual	R-TF-007-005 Post-Market Clinical Follow-up (PMCF) report; R-TF-015-003 Clinical Evaluation Report
Update risk management file	JD-004	Annual	R-TF-013-002 Risk management record; R-TF-013-003 Risk management report; IFU, R-TF-015-003 Clinical Evaluation Report; R-TF-007-003 Periodic Safety Update Report (PSUR)
Summarise PMS activities in the PSUR	JD-004	Annual	R-TF-007-003 Periodic Safety Update Report (PSUR); R-TF-015-003 Clinical Evaluation Report
Summarise PMS activities in the PMS report	JD-004	Annual	R-TF-007-004 Post-Market Surveillance (PMS) Report
Summarise PMCF activities in the PMCF report	JD-005	Annual	R-TF-007-005 Post-Market Clinical Follow-up (PMCF) report; R-TF-015-003 Clinical Evaluation Report

Serious incidents and FSCA

Serious incidents are documented, notified to Regulatory Authorities, investigated and addressed according to the requirements set out in GP-004 Vigilance system and in GP-006 Non-conformities, Corrective and preventive actions.

Once a year, JD-004 will actively analyse the new data collected from the vigilance system.

The R-TF-007-004 PMS Report and R-TF-007-003 PSUR will summarize the number of reported serious incidents, their investigation results and any taken subsequent measures.

The same approach is followed for Field Safety Corrective Actions (FSCA): they are documented, notified to Regulatory Authorities and implemented according to the requirements set out in GP-004 Vigilance system and in SP-004-001 Product withdrawal.

The PMS Report and PSUR will summarize the number of FSCA initiated and their status (ongoing, completed).

Non-serious incidents and side effects

Non-serious incidents are documented, investigated and addressed according to the requirements set out in GP-004 Vigilance system and GP-006 Non-conformity. Corrective and preventive actions. The non-conformities detected are registered in the T-006-001 Non-conformity report and are reviewed every 3 months to monitor their status.

They are also reviewed on a yearly basis by the JD-004 and the evaluation results and conclusions will be summarised in the R-TF-007-004 PMS Report and R-TF-007-003 PSUR.

Side effects non-previously identified or foreseen are reviewed by JD-005 on a yearly basis, actively updating the product side effects or the improvement opportunities and redesign requirements (technical features).

The results of this research will be summarised in the R-TF-007-004 PMS Report and R-TF-007-003 PSUR.

Customer feedback

Feedback from users is documented, analysed and addressed according to the requirements set out in GP-014 Feedback and complaints and will be evaluated every year by JD-005 to identify any actions and improvements to be implemented on the products.

According to GP-014 Feedback and complaints we also proactively gather user feedback using surveys (T-014-001 Customer satisfaction survey) to search for complaints or comments based on user experience that may require a product redesign.

JD-016 is in charge of planning and sending the customer surveys and of gathering, analysing and presenting results to the rest of the team to identify any actions or improvements.

One additional item we will actively follow up is the customer access to the latest version of the medical device (and it is also one of the quality indicators included in the R-002-002 Quality indicators).

Evaluation and results of user feedback will be summarised in the R-TF-007-004 PMS Report and R-TF-007-003 PSUR.

Customer complaints

Customer complaints are documented, analysed and addressed as explained in GP-014 Feedback and complaints.

As part of the analysis, JD-005 or JD-004 will identify whether there are any non-serious incidents or serious incidents and categorise them as such.

In case of serious incidents, we will follow the reporting process described in GP-004 Vigilance system.

Customer complaints will be reviewed on a yearly basis by JD-004 and the results of the revision will be summarised in the R-TF-007-004 PMS Report and R-TF-007-003 PSUR.

Corrective and preventive actions

Corrective and preventive actions are documented, investigated, implemented and verified for effectiveness according to the requirements set out in GP-006 Non-conformity. Corrective and preventive actions.

Corrective and preventive actions are reviewed every 3 months by JD-004 to review their status and/or their effectiveness.

Once a year, JD-004 performs an additional review and the evaluation results and conclusions will be summarised in the R-TF-007-004 PMS Report and R-TF-007-003 PSUR.

Data related to similar devices

Data related to similar devices are gathered, evaluated and summarised according to GP-015 Clinical evaluation and the Clinical Evaluation Plan (CEP) (R-TF-015-001 Clinical evaluation plan). The results of the analysis of similar devices will be performed yearly by the JD-005, taking into consideration two fundamental features (technical and clinical characteristics).

Adverse events databases will be also consulted to obtain information related to similar devices. At least 6 of the databases listed at the R-TF-007-006 Sanitary alerts databases will be consulted per period analyzed, with the following keywords: artificial intelligence, dermatology, deep learning, medical imaging, computer vision.

This activity is part of the PMCF activities and is documented in R-TF-007-002 PMCF plan.

The results of this activity will be documented in the Clinical Evaluation Report (R-TF-015-003 Clinical evaluation report (CER)) and the R-TF-007-005 PMCF evaluation report.

Regulatory requirements

Every year JD-004 will revise the following websites, or other equivalents, to extract new or revised regulatory information that may require a revision of the clinical evaluation or the risk management.

• The Spanish Agency for Medicines and Medical Devices (AEMPS)
• The International Medical Device Regulators Forum (IMDRF)
• MedTech Europe
• Harmonized Standards for Medical Devices (European Commission)
• Public Health Policies (European Commission)
• The US Food and Drug Administration (FDA)
• The Notified Body Operations Group (NBOG)

The results of the website consultation will be summarised in the R-TF-007-004 PMS Report and R-TF-007-003 PSUR.

Trend analysis

Trend reporting aims to systematically monitor and analyze non-serious incidents over time to assess any notable changes in the benefit-risk analysis of the medical device.

Trend analysis is performed on undesirable side-effects and non-serious incidents. These sources of data will be monitored in order to identify any negative trend and, if this is the case, communicate it according to the requirements set out in GP-007 Post-market surveillance.

All incidents deemed non-serious and anticipated undesirable side effects will undergo documentation and categorization and, after that, normalization will be applied, factoring in the respective number of sold devices per month.

The data obtained will be graphically represented, portraying the number of normalized incidents against the corresponding month. This data visualisation serves to show the temporal progression of these incidents over time, facilitating a comprehensive understanding of trends and patterns.

Adhering to the guidelines outlined in ISO/TR 20416 for Medical Devices - PMS for manufacturers, Rule 3 of the Nelson Rules will be employed to detect trends.

A trend is detected where six or more points in a row exhibit a continuous upward trajectory. In other words, if we have a steady increase of complaints over the course of 6 months, this means we have a trend in our data.

If a trend is detected, a CAPA will be opened to investigate the incidents and we will follow the reporting process explained in GP-007 Post-market surveillance.

Clinical literature

According to GP-015 Clinical evaluation and the Clinical Evaluation Plan (CEP) (TF_T-015-001 Clinical evaluation plan), the clinical literature will be reviewed yearly by the JD-005 or designee.

This activity is part of the PMCF activities therefore more details are provided in the R-TF-007-002 PMCF plan and results of the clinical literature review will be summarised in the R-TF-007-005 PMCF evaluation report.

Cybersecurity and state of the art

According to the Guideline MDCG 2019-16, the cybersecurity and the capability to comply with the General and Safety Requirements (GSPR) shall be evidenced during the product lifetime.

Activities performed during the post-market phase related to cybersecurity monitoring are described in the SP-012-002 Cybersecurity and Transparency Requirements and they are also listed below:

• Active monitoring system: to evaluate cybersecurity effectiveness
• Regular reporting and vigilance: to review cybersecurity incidents or potential threats
• Regular security updates: to keep the device up-to-date with the latest security patches and updates
• Response to emerging threats: to quickly address new emerging cybersecurity threats.

In order to perform the activities listed above, we will revise the European Union Agency for Cybersecurity (ENISA) and the Cybersecurity and Infrastructure Security Agency (CISA) websites to gather data about:

• new vulnerabilities discovered
• cybersecurity incidents report
• emerging cybersecurity threats
• significant risks and most common risk reduction activities
• tools and resources to defend against cybersecurity threats
• software's security controls based on evolving threats and technological advancements
• good practices to implement preventive measures.

These activities are performed every year by JD-005 or designee.

The data collected by performing these activities will be analysed to understand which are relevant for us (for our device and infrastructure), to evaluate whether the risk management record shall be updated and to plan necessary activities to maintain cybersecurity effectiveness.

This is also carried out in conjunction with GP-004 Vigilance system, GP-002 Quality planning and GP-014 Feedback and complaints paying attention to feedback, complaints and incidents.

The data collected and their analysis will be documented in the R-TF-007-004 PMS Report and R-TF-007-003 PSUR.

Security vulnerabilities of SOUPs and software tools

Each of the SOUPs and software tools used during the development and deployment of the medical device is monitored in the post-market surveillance stage. For this, we gather and evaluate information on security vulnerabilities related to SOUPs and software tools.

Our primary activity for SOUPs involves periodically evaluating their lists of anomalies, which are compiled in the Lists of published anomalies section of each DHF SOUP record, while the findings of the evaluation are documented under the section History of evaluation of SOUP anomalies also in the same record.

For software tools, we are subscribed to security advisory services. This provides us with timely updates on vulnerabilities pertinent to our development tools, so we can take swift action to mitigate risks.

Every 6 months, we monitor and evaluate lists of SOUP anomalies for vulnerabilities and obsolescence notifications. Security advisory services for software tools, however, are reviewed on a yearly basis.

Sales data

Every year the JD-005 is in charge of collecting sales data about the device to extract the following information:

• Volume of sales
• an estimate evaluation of the size and other characteristics of the population using the device
• the usage frequency of the device
• volume of sales by country.

The analysis of sales data will be documented in the R-TF-007-004 PMS Report and R-TF-007-003 PSUR.

PMCF activities

A PMCF plan has been developed for the device to consistently collect relevant clinical data, confirming the benefit-risk determination in the Risk Management Report (R-TF-013-003) and Clinical Evaluation Report (R-TF-015-003).

This includes assessing clinical safety, performance, any claims, and its alignment with the current state of the art.

The PMCF activities are detailed in the R-TF-007-002 PMCF plan and their results will be summarised and discussed in the R-TF-007-005 PMCF evaluation report.

Planned PMS report / PSUR

The PMS report is planned to be completed by December 2023 while the first PSUR will be planned as soon as the first device is introduced into the market.

Both reports will summarize and discuss the results coming from the activities described in this plan and they will include the following:

• The product benefit/risk ratio confirmation
• New risks or trends
• Any clinical evaluation change
• The required actions (if any) to be implemented to ensure safety and performance.

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Author: Team members involved
• Reviewer: JD-003, JD-004
• Approver: JD-001