Extra Horizon Blog

Discover our brand new Medical Device Tutorial, Control Center improvements and more

koen.schoofs@extrahorizon.com (Extra Horizon) — Fri, 26 Jan 2024 12:56:53 GMT

We’re excited to introduce our latest tutorial for building a blood pressure monitoring app with Extra Horizon! Dive into the step-by-step guide, tailored for all skill levels, and discover hands-on experiences with our CLI and SDK.

Plus, explore our Control Center enhancements, featuring bug fixes and usability improvements, ensuring an optimal user experience. Read on to explore the new features of SDK v8.0.0 and the revamped Schema Verification process via the CLI.

Brand new tutorial: building a blood pressure monitoring app with Extra Horizon ��️

At Extra Horizon, we're always enhancing the development experience of our customers and partners. And that's why we are very excited to announce a very useful new tutorial!

In this tutorial, you will be guided through all the steps of building a blood pressure monitoring app with Extra Horizon. Even if you have little to no development experience, you will be able to follow the process and learn all the ins and outs of working with our platform.

Go to the tutorial by clicking here.

What we’re covering in the tutorial

Embark on a guided journey with our tutorial on building a blood pressure monitoring app. Here's what we're covering:

Create and update your first data schema
Craft a precise data schema tailored for a blood pressure monitoring app.

Build workflows based on this schema
Learn how to build the app's functionality with simplified and effective workflows.

Configure your permissions on different levels
Gain expertise in configuring permissions at various levels for robust data control.

Setup oAuth in the backend and build a demo login page
Enhance the app's security with OAuth integration and create a demo login page from scratch.

Why try it out?

The tutorial aims to be as hands-on as possible. For example, you will also learn how to work with the CLI and SDK along the journey. Instead of getting hung up on all the theoreticals, in this tutorial, you'll learn how to create a medical app with just the information you need. Also, when in need, there is always a link to further documentation in each section.

Want to dive directly into the code, check out the dedicated repo on Github! ��

Control Center Enhancements: Bug Fixes and Improvements

The Control Center, our standard admin panel, is the essential tool to effortlessly manage your Extra Horizon environments, users, schemas, tasks, and logs. In our latest release, we've focussed on improving the user experience while fixing some pesky bugs along the way.

Let’s dive into a high level overview of what we changed.

Usability Improvements ⬆️

Login tokens now work across browser sessions.
"Remember me" functionality added during login.
Activation and forgot password flow added.
Real link navigation in tables, allowing you to easily open multiple tabs with specific schema, user, or function details.
RQL filter improved: Apply button added & size increase for more complex queries.
Table component refactored: Improved pagination allowing users to skip to the top/end of the list and see the total number of results.
Text wrapping of access logs and function logs.

Bugs Fixed ��️

Access logs refresh button

Text is now replaced by a refresh icon

Tasks

Calculation of task execution is fixed and can no longer be a negative number

Pagination

Resolved issues with RQL filter and pagination, returning users to the page with the correct values.

Performance

Fixed performance issues caused by performing multiple requests.

User permission

Users can now close the modal after adding custom permissions.

SDK v8.0.0: Breaking Ground with New Features

Our latest SDK version, v8.0.0, marks a significant milestone with three breaking changes, enhancing the capabilities and flexibility for our users.

Major Breaking Changes ⭐

First change

RQL values are now double encoded by default when using the RQL builder.

Second change

Starting from v8.0.0, the SDK will no longer normalize custom keys in requests and responses. All custom keys will be sent and received exactly as provided.

Third change

For all unauthenticated methods, the response will now undergo the same transformation steps as any other request.

Please consult the Migration Guide for more information.

New version of Schema Verification via the CLI, further elevating your user experience

Experience a revamped schema validation process with a second version of the CLI. We've fine-tuned the validation to make your schema management even more robust and user-friendly.

Key enhancements ⭐

Id Property Validation in Arrays

New Feature : Added a validation check for id properties in objects within arrays in data schemas. Any discrepancies will now be reported as errors.

Duplicate Transition Name Validation

New Feature: Introduced validation for duplicate transition names in data schemas. Any duplicates will now be reported as errors.

Flexible Validation for Input Conditions

Enhancement: Modified the strictness of validation for properties of input conditions. Modifiers like enum , minLength , maxLength , etc., will no longer produce errors if not present in the condition property.

Want to know more?

Contact us here and feel free to ask any questions you might have. Also, you can subscribe to these products updates via email here to stay in the loop .

Introducing the Software Lifecycle Tool & some major RQL improvements

koen.schoofs@extrahorizon.com (Extra Horizon) — Tue, 28 Nov 2023 07:00:00 GMT

We have some exciting things to share with you today! Join our SLCT Beta Program for IEC62304 compliant software development. Plus, check out our RQL 7.8.0 update that boasts some nice new improvements and bug fixes.

Ready to transform your compliant software development process? Introducing our brand new Software Lifecycle Tool (SLCT) - the ultimate solution for streamlining IEC62304 compliance with your Extra Horizon environment.

Developed by our team of experts, the SLCT seamlessly integrates with your software development processes, ensuring swift adoption of IEC62304 standards, on-time CE-Approval documentation, and facilitating early product-market fit.

Some Key Features ��

Swift adoption of IEC62304 standards
Ready-made CE-Approval documentation
Facilitates early product-market fit

Don't let chaos and delays hinder your compliance journey. Say goodbye to spreadsheets and human errors. Our Software Lifecycle Tool is the smarter, more efficient way to navigate IEC62304 challenges.

If you want to dive a little deeper before signing up for the beta program, check out these resources: 1 Minute explainer video | Full demo video

Interested in joining the beta program? Sign up via the form on this page or just contact us directly .

Improvements and bug fixes in SDK 7.8.0 Update

We are excited to announce some significant enhancements to our Resource Query Language (RQL) capabilities in the latest release of Extra Horizon. RQL is a powerful query language designed for querying and manipulating resources within Extra Horizon. This update brings improvements to both the usage and performance of RQL, alongside crucial bug fixes.

Updated documentation ��

We have strongly improved the current documentation on RQL by adding UTF-8 support, skipCount and providing more detailed context on the operators. Read the documentation here and check the full list of functions.

Improvements ✨

Querying Special Characters (UTF-8) in the Data Service

RQL now seamlessly handles queries involving special characters (UTF-8) in the Data Service, providing enhanced flexibility and precision.

‘skipCount’ Implementation for Performance Improvements

Introduced the ‘skipCount’ feature to enhance performance, making data retrieval more efficient and responsive.

SDK Compatibility - Available in v7.8.0

The RQL improvements are now integrated into the new major version of the SDK (v7.8.0), ensuring a cohesive and streamlined experience across your development environment.

Bug fixes ��

Server Exceptions Resolved to RQL Exceptions

Addressed and resolved server exceptions, ensuring a smoother experience by transforming them into RQL exceptions.

Behavior Fixes for 'ne' and 'contains' operators

Fixed the behavior of 'ne' (not equal) and 'contains' operators, ensuring accurate and reliable results in your queries.

MUST READ

Encryption: the Key to Success to Navigate the Complexities of Data Security in Healthcare

In the intricate landscape of healthcare and medtech, where patient data is sacred and regulatory compliance is paramount, the journey through data security becomes even more challenging. In this blog, we will delve deeper into the importance of encryption, unraveling the complexities of data security specific to the healthcare and medtech environments.

Read the full blog here.

Want to know more?

Contact us here and feel free to ask any questions you might have. Also, you can subscribe to these products updates via email here to stay in the loop .

Encryption: the Key to Success to Navigate the Complexities of Data Security in Healthcare

koen.schoofs@extrahorizon.com (Extra Horizon) — Tue, 21 Nov 2023 09:38:01 GMT

In the intricate landscape of healthcare and medtech, where patient data is sacred and regulatory compliance is paramount, the journey through data security becomes even more challenging. In this blog, we will delve deeper into the importance of encryption, unraveling the intricacies of data security specific to the healthcare and medtech environments.

The Backstory: Why Encryption Has Become Vital for Digital Medical Applications

The Schrems II ruling and its Implications for Healthcare

The Schrems II ruling has significantly impacted the data protection landscape, shaking the foundations of the EU–US Privacy Shield. This has raised concerns about the adequacy of data protection measures for patient information. Despite commendable efforts by U.S. medtech companies, the nuanced challenges posed by U.S. surveillance laws continue to create hurdles in achieving GDPR and HIPAA compliance.

Adopting Standard Contractual Clauses (SCCs) and server location strategies

In response to these challenges, companies in the U.S. and beyond have smartly started using Standard Contractual Clauses (SCCs) in their contracts. They have also been strategically choosing server locations, such as setting up branches in Europe or collaborating with cloud companies with servers in the EU. While this has been a pivotal step forward, ambiguity persists due to U.S. ownership and the potential for U.S. authorities to request access to data, especially in healthcare settings.

The Trans-Atlantic Data Privacy Framework: a ray of hope

Looking ahead, we must acknowledge the progress made in March 2022 with the announcement of the Trans-Atlantic Data Privacy Framework by the European Commission and the U.S. While a draft has been thoroughly reviewed, the absence of a concrete adequacy decision leaves the current situation uncertain. The complex nature of trans-continental data privacy negotiations, especially in the highly regulated healthcare sector, indicates that a comprehensive solution will take time.

Data protection is not black and white - The Doctolib Ruling (France)

A noteworthy case in the healthcare sector, the Doctolib ruling in France, highlights the significance of "sufficient safeguards." This ruling emphasizes how legal and technical measures, including encryption and key management, play a pivotal role in ensuring data protection in healthcare. The court's decision, ruling in favor, underscores the importance of these safeguards, even when hosted by a U.S.-based provider like AWS.

Thus bridging us to the next section of this blog piece, which is a closer look into the world of encryption (especially in a healthcare setting).

The Basics: Diving Deeper into the World of Encryption

In our data-driven world, encryption holds immense significance, particularly in the healthcare and medtech industry. Let's explore why below.

Importance of Encryption in the Healthcare Industry

Healthcare has become one of the most data-intensive industries, generating and storing vast amounts of patient information. Approximately 30% of the world’s data volume is generated by the healthcare industry. Safeguards, including encryption, are critical for protecting patient information from unauthorized access or use due to a growing number of data breaches.

Why Do We Need Encryption?

Confidentiality: Prevents unauthorized access to sensitive information, ensuring only authorized users can view it.

Security: Encryption helps protect data from theft or hacking, making it more difficult for attackers to access and steal sensitive information, thus improving data security.

Compliance: In many industries, data encryption is a requirement to meet regulations, such as HIPAA for healthcare.

Privacy: Encrypting data protects personal information, such as health records, from being accessed or used without permission.

Trust: Encryption helps build trust between organizations, customers, and partners by demonstrating a commitment to protect sensitive information.

Authentication: Through digital signatures, digital certificates, or a Public Key Infrastructure.

Top 5 Use Cases of Data Encryption in Healthcare

Electronic Health Records (EHRs): Protecting comprehensive patient records from unauthorized access.

Medical Devices: Securing data transmitted between connected medical equipment like insulin pumps and pacemakers.

Remote Patient Monitoring (RPM): Ensuring the confidentiality of vital signs and health data outside traditional healthcare settings.

Telemonitoring: Safeguarding data transmitted during telehealth sessions, maintaining patient information confidentiality.

Healthcare Data Analytics: Protecting large sets of healthcare data used for insights into patient health and healthcare operations.

Some of the Healthcare Related Standards Referring to Encryption

HIPAA Requirements: Mandates encryption to protect ePHI during storage or transmission.

GDPR Requirements: While GDPR doesn't explicitly mention encryption, it emphasizes enforcing security measures, and encryption is considered an "appropriate technical and organizational measure."

ISO27001: Emphasizes encrypting data as a critical control for ensuring confidentiality, integrity, and availability of information.

ISO27701: Provides a cryptographic framework for organizations to operate within, emphasizing policy on the use of cryptographic controls and key management.

Country-Specific Regulations

In the ever-evolving landscape of healthcare data security, adherence to country-specific regulations crucial. Two noteworthy examples are the regulations in Germany and France:

DIGA (Germany): Elevating Data Security Through Comprehensive Measures

In Germany, the Digital Health Applications (DiGA) regulations set forth stringent requirements for safeguarding health data. Beyond the standard practices, DiGA mandates the implementation of an Information Security Management System (ISMS). This systematic approach ensures a comprehensive strategy for managing and protecting sensitive health information. Furthermore, DiGA places a significant emphasis on encryption as a fundamental component of its data security framework.

HDS (France): Upholding Rigorous Standards for Personal Health Data Protection

Across the border in France, the Hébergeurs de Données de Santé (HDS) certification is a pivotal element in the nation's healthcare data landscape. This certification doesn't just recommend but mandates strong measures for securing personal health data. In alignment with broader data protection principles, HDS emphasizes encryption as a non-negotiable aspect of its certification requirements.

Proposing a Better Option for Addressing Healthcare Data Security Challenges & Encryption: The Extra Horizon Option

We explore three viable options for medtech companies navigating the intricate landscape of healthcare data security challenges. Among them, the Extra Horizon option stands out, offering EU-based storage locations, cluster-level encryption, and safe key management.

Build solution on

Pro’s and cons

Extra Horizon

Usage of EU-based storage locations

Cluster level encryption included

Safe Key Management included

Extra Horizon

Usage of EU-based storage locations

Cluster level encryption included

Safe Key Management included

US Cloud Providers

Familiarity with established providers

Need to manage technical safeguards independently, including encryption & key management

US Cloud Providers

Familiarity with established providers

Need to manage technical safeguards independently, including encryption & key management

EU Cloud Providers

Limited availability & maturity compared to US providers

Need to manage technical safeguards independently, especially on AWS: Encryption & key Management

EU Cloud Providers

Limited availability & maturity compared to US providers

Need to manage technical safeguards independently, especially on AWS: Encryption & key Management

Our Conclusion

This blog provides a comprehensive but still to the point exploration into the critical role of encryption in the healthcare and medtech landscape. From dissecting legal implications like the Schrems II ruling to highlighting pivotal cases such as the Doctolib ruling in France, we've navigated the intricate web of data security challenges.

Extra Horizon stands as a beacon of security, offering tailored solutions that leverage EU-based storage locations, cluster-level encryption, and safe key management. In the highly regulated and data-intensive sector of healthcare, ensuring the confidentiality, integrity, and availability of information remains our daily commitment.

Reach out to us to learn more on our encryption capabilities.

Major Update of the Extra Horizon Dispatcher Service & More

koen.schoofs@extrahorizon.com (Extra Horizon) — Tue, 17 Oct 2023 09:31:36 GMT

Hi there,

We are thrilled to share some major updates and enhancements to the Extra Horizon Dispatcher Service, along with a few other exciting developments! These updates are designed to empower you to create even more dynamic and efficient workflows within Extra Horizon.

Major Update of the Extra Horizon Dispatcher Service

We are excited to announce that our Dispatcher Service has undergone a significant overhaul. The Dispatcher Service enables you to configure both simple and complex workflows (from sending emails to creating complicated care paths), all within Extra Horizon.

How the Dispatcher Service works

If you are familiar with our Event Service, you know it’s in charge of communicating the occurrence of specific types of events. The Dispatcher Service, however, allows you to act on these events. Here a few examples of real-life scenarios:

Example 1: you want to ensure all PII data is removed from your cluster when a user deletes their account.

Action: the Dispatcher Service receives a "user_deleted" event and schedules a Task to eliminate PII, such as in the Data Service.

Example 2: you want to send a new welcome email to newly registered users

Action: the Dispatcher Service subscribes to a "user_created" event, and upon receiving it, schedules a Task (e.g., "newUserCommunicationTask") to send a welcome email

For more information and details about these updated features, read our Dispatchers Service documentation .

NEW: Managing dispatchers via the Extra Horizon CLI ��

Synchronize locally declared dispatchers with existing ones
Automatically tag CLI-managed dispatchers with "EXH_CLI_MANAGED"
Delete CLI-managed dispatchers not present in the local Dispatchers file

For in-depth information about the CLI part, click here.

New security setting: Non-Browser Viewable Files

We've introduced a new security setting in the File Service, allowing customers to determine which file types can be viewed directly in their browser and which ones should be downloaded locally.

This enhancement involves the addition of a settings endpoint in the File Service, featuring this array:

"disableForceDownloadForMimeTypes."

Users can customize this array to specify their preferences:

['image/png', 'application/pdf'] : Permits browser viewing of PNG and PDF files.
['*/*'] : Enables browser viewing for all file types.
[] : Disables browser viewing for all files, prompting local downloads instead.

For more details, please visit the documentation here .

MongoDB Version Upgrade to v6.0

We take pride in managing your infrastructure, ensuring it consistently meets the highest standards and remains up-to-date. We have now upgraded your MongoDB version to the latest version, MongoDB v6.0. This way, we enhance the overall performance, security, and functionality of your clusters, allowing you to focus on your core business activities while we handle the technical aspects.

Want to know more?

Contact us here and feel free to ask any questions you might have. Also, you can subscribe to these products updates via email here to stay in the loop .

Ensuring Regulatory Compliance in the Cloud: How Extra Horizon Addresses Common Regulatory Challenges

koen.schoofs@extrahorizon.com (Koen Schoofs) — Fri, 08 Sep 2023 12:29:03 GMT

In the rapidly evolving digital health landscape, medical device companies are increasingly turning to public cloud infrastructures to power their operations. While the cloud offers tremendous scalability and cost-efficiency, it also introduces unique challenges when it comes to regulatory compliance. In this blog post, we will explore what challenges digital health medical device companies face and how Extra Horizon provides a comprehensive solution for its clients.

The Complexity of Cloud Compliance

One of the primary challenges medical device companies encounter is navigating the complex landscape of working with a compliant cloud component in their solution. Cloud environments introduce additional layers of complexity, making it essential to have a robust compliance strategy in place.

How Extra Horizon Can Help

At Extra Horizon, we understand the intricate requirements of regulatory compliance in the medical device industry. Our specialized expertise allows us to offer solutions that simplify the compliance process for your company. By integrating regulatory standards into our services and providing comprehensive compliance support, we ensure that you can meet regulatory requirements with confidence.

Data Protection and Privacy

Protecting sensitive patient data is a paramount concern for medical device companies. Cloud environments require robust data protection measures to maintain compliance with privacy regulations even beyond the basics such as HIPAA or GDPR.

How Extra Horizon Can Help

We prioritize data privacy and protection. By implementing stringent security measures and adhering to industry best practices, we offer a secure cloud infrastructure that meets the rigorous requirements of data protection regulations like GDPR, HIPAA, ISO27001, ISO27701 and the EU Cloud Code of Conduct. Medical device companies can leverage Extra Horizon's expertise to safeguard patient data and maintain compliance with privacy standards. Beyond this, Extra Horizon strives to achieve the deepest levels of regionalized cloud hosting regulations for patient data.

Auditing and Documentation

Demonstrating compliance through audits and documentation is a crucial aspect of regulatory requirements. However, managing and maintaining the necessary documentation in a cloud environment can be complex and very time-consuming.

How Extra Horizon Can Help

We help streamline the auditing and documentation process by providing comprehensive tools and features. With built-in capabilities for audit trails, logging, and compliance reporting, our platform simplifies the collection and management of audit-related documentation. This ensures that medical device companies can easily provide the necessary evidence of compliance during the certification process or even for post-market surveillance purposes.

Continuous Compliance Monitoring

Regulatory compliance is an ongoing process that requires continuous monitoring and adaptation. Cloud environments introduce the challenge of ensuring compliance in dynamic and ever-changing infrastructures.

How Extra Horizon Can Help

We take a proactive approach to continuous compliance monitoring. By monitoring the underlying cloud environment for unannounced changes, we ensure that medical device companies are alerted to any potential compliance risks. This allows companies to promptly address and rectify any compliance issues, minimizing the risk of non-compliance.

Compliance with Industry-Specific Standards

Medical device companies must comply with industry-specific standards such as the MDR, FDA regulations, or ISO 13485. Ensuring compliance with these standards can be complex, especially in a cloud environment.

How Extra Horizon Can Help

Extra Horizon is designed to meet the unique compliance needs of the medical device industry. It provides a framework that aligns with industry-specific standards, such as FDA regulations, IEC 62304, or ISO 13485. By integrating these standards into its services, we help simplify compliance for medical device companies, enabling them to meet industry-specific requirements with ease. With its own ISO 13485 certification, Extra Horizon can assure its clients that it truly classifies as a trusted supplier that follows the same quality standards required from medical device manufacturers.

Conclusion

Ensuring regulatory compliance in the cloud is a critical priority for medical device companies. By leveraging Extra Horizon's specialized expertise and solutions, companies can overcome common compliance challenges. From navigating complex compliance requirements to protecting sensitive patient data and ensuring continuous compliance monitoring, Extra Horizon empowers medical device companies to meet regulatory standards with confidence.

Introducing new Extra Horizon SDK Features and API Functions

koen.schoofs@extrahorizon.com (Extra Horizon) — Tue, 05 Sep 2023 09:44:56 GMT

Hi there,

We have some exciting updates to share with you today! We have recently released version 7.4.1 of our SDK, bringing user-centric enhancements for a better development experience. You'll enjoy improved support for API Functions and Tasks, as well as monitoring file uploads, leading to smoother workflows and better performance.

Furthermore, we are introducing Extra Horizon API Functions: V2, offering more power and flexibility for invoking functions via HTTP(S) requests, ensuring streamlined monitoring, efficient workflows, and reliable performance.

Now, let's dive a bit deeper into each of these below ��

Extra Horizon SDK Improvements: Quick Overview ��✅

We are excited to introduce the latest Extra Horizon SDK improvement in version 7.4.1. This update brings a bunch of enhancements that will undoubtedly elevate your development experience. Here's what you can expect:

Support for API Functions

API Functions can be executed more efficiently by using methods found in exh.tasks.api
API Requests produced by executing API Functions are accessible using methods found in exh.tasks.apiRequests
API Request Logs produced during the execution of an API Function can be accessed using methods found in exh.tasks.apiRequests.logs

Improved Support for Tasks

Manage Task Schedules effortlessly with methods available in exh.tasks.schedules
Task Logs produced during the execution of a task can now be accessed using methods found in exh.tasks.logs

Monitoring File Uploads ��

Monitor file uploads in the browser with a new callback function
Render progress bars to enhance user experience during uploads ( visit the documentation for more in-depth information )

Extra Horizon API Functions: V2

We are also excited to announce the latest update to Extra Horizon's API Functions, bringing you even more power and flexibility in invoking functions via HTTP(S) requests. Also, we dive a bit deeper into the addition and importance of logs, enabling to improve the monitoring of your own functions. Discover the enhanced features and benefits designed to elevate your development experience.

Benefits ⭐

Streamlined Monitoring and Analysis on Logs ��

The dedicated log retrieval endpoint enables easy access to API function logs, empowering you to monitor and analyze executions with precision.

Efficient Development Workflow

With enhanced SDK capabilities and CLI support, executing and managing API functions becomes more intuitive and productive.

Reliable Performance

The continuous performance improvements ensure a robust and reliable platform, capable of handling diverse workloads effectively.

Features ✅

Retrieve logs for API functions through a dedicated endpoint: GET/{taskID}/logs. Visit the documentation for more information.

Execute API functions and easily list API requests and logs using the SDK.

Create a full folder structure of an API function in Typescript effortlessly with the CLI. Visit the documentation for more information. ��

Experience additional performance improvements for a seamless platform

Want to know more?

Contact us here and feel free to ask any questions you might have. Also, you can subscribe to these products updates via email here to stay in the loop .

Unlock AI/ML and Advanced Data Analytics with Extra Horizon

koen.schoofs@extrahorizon.com (Extra Horizon) — Thu, 13 Jul 2023 11:40:56 GMT

Hi there,

Today, we are excited to dive deeper into two powerful capabilities that are already at your fingertips when working with Extra Horizon: Artificial Intelligence/Machine Learning (AI/ML) and Advanced Data Analytics.

Let's dive a bit deeper into each one below ��

AI/ML with Extra Horizon: Unleash the Future of MedTech Innovations

Extra Horizon is a leading platform for AI/ML enabled medical devices. Our platform provides you with highly accurate diagnostic and decision-support capabilities, enabling you to unlock the full potential of your AI/ML enabled medical device.

AI/ML capabilities already embedded in Extra Horizon

Dynamic Queue Mechanisms for Reliable Performance: Guarantee stable algorithm execution and predictable response times, even during system load spikes.

Ensuring Secure AI/ML Solutions: Meet regulatory requirements, industry standards, and ensure patient privacy through advanced data encryption and vulnerability assessments.

Powerful GPU Processing Capabilities: Unlock the full potential of your algorithms with multiple CPUs, ample memory, and high-performance GPUs.

Workflow Triggers for Seamless Integration: Seamlessly integrate AI/ML algorithms based on processed data and business logic.

Cost-Effective Pay-as-You-Go Model: Run AI/ML models efficiently, paying only for active utilization and enabling seamless scaling.

Algorithm Review Made Easy: Simplify algorithm development, review outcomes, and incorporate annotations within the platform.

You can head over to our dedicated website page on AI/ML for more information.

Advanced Data Analytics with Extra Horizon

Our Medical Backend-as-a-Service platform empowers you with robust data handling capabilities and visualization, ensuring seamless synchronization and easy access to your valuable medical data.

Dedicated Statistics Database: Extra Horizon empowers you with a dedicated statistics database tailored to your digital medical solutions' production environment(s).

Advanced Data Visualisation: Unleash the full potential of your data by utilizing powerful visualization features, enabling you to gain deep insights and effectively analyze medical data on our platform.

You can head over to our dedicated website page on data analytics for more information.

Want to know more?

Contact us here and feel free to ask any questions you might have. Also, you can subscribe to these products updates via email here to stay in the loop .

What is SaMD (Software as a Medical Device) and how is it regulated?

koen.schoofs@extrahorizon.com (Extra Horizon) — Fri, 30 Jun 2023 14:36:41 GMT

Building a SaMD (Software as a Medical Device) is, to say the least, a challenge. To start things off, let’s take a step back and define exactly when a medical device is considered to be a SaMD, and when it’s not.

Defining SaMD (Software as a Medical Device)

Before looking into building a SaMD, you must be 100% certain that the type of medical device you will be, or are currently building is, in fact, a SaMD. The IMDRF (International Medical Device Regulators Forum), an international group of regulators that aim to harmonise regulatory requirements for medical products, including SaMDs, provide us with a clear definition of what a SaMD exactly is:

The term “Software as a Medical Device” (SaMD) is defined as software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.

Basically, there are 2 main types of medical device software. The figure below the terms explains the process of making the distinction between both of them in a more visual way.

1. Software as a Medical Device (SaMD)

In this case, the software in itself serves as a medical product.

2. Software in a Medical Device (SiMD)

In this case, the software in itself serves as a medical product.

Next to these 2 primary groups, there are also other types of medical device software. For example, an accessory product to medical devices is one, but we will not be diving further into these types of software.

The many types of SaMD solutions

The digital health landscape is enormous. Therefore, there are numerous types of SaMD solutions already available, and many, many more are on the way. Most SaMDs are related to some kind of diagnosis, prevention, treatment, prediction, alleviation or monitoring in the context of an illness, injury or disability. In addition, if the medical device, running as standalone software, is involved in the control of conception or IVD & sterilisation, it is also a SaMD. SaMDs can range from software that can detect cancer based on smartphone images, to a sleep app that analyses the data to form the basis of a sleep treatment plan.

It’s quite impossible to create a complete list of all types of SaMDs, because as seen in the figure above, the digital landscape is vast. An easy trick to know whether or not medical device software can be seen as SaMD is whether or not the software is run on non-medical devices like smartphones, smartwatches, tablets and so on.

The key benefits of SaMD solutions

There are two key benefits of SaMD solutions that we’d like to share:

1) The use of data to improve health in patients

SaMD solutions make it possible to collect data much more easily and faster than some of the traditional health improvement methods. Also, as these kinds of solutions are highly regulated, the quality of the data is often very high as well. As a result, SaMDs enable the health space to create patient-centred solutions that are capable of improving patient health tremendously.

2) The use of the software is much more versatile than hardware-based solutions

SaMDs exist mostly in the cloud. This is a big win in terms of speed and versatility, not only when building these kinds of solutions, but also the updates and adaptations to said SaMD solutions. By utilising the latest technologies, connected medical devices are much easier to create, build and keep in the air, in contrast to the traditional hardware-based health improvement solutions.

A real-life example of a SaMD

For us, it’s quite easy to give you a very tangible example of a SaMD. Our customer FibriCheck has created a pure form of SaMD. FibriCheck is an app that you can download directly from the app store or the play store, that enables you to accurately detect Atrial Fibrillation (irregularities in your heart rhythm) using only the app, your smartphone, your smartphone camera and your index finger.

What are the key elements of SaMD?

There are 4 basic elements that you will encounter in almost every type of SaMD solution:

1. SaMD inputs

These are the inputs required in order for the SaMD to work correctly. This can range from patient data to lab results, image data, physiological states, symptoms and so on.

2. SaMD algorithm

At the core of the SaMD, the algorithm is the key player. The algorithm holds, in most cases, the IP of the solution. Here you will find the set of instructions and logic, required for the SaMD to accomplish its task of generating some kind of medical related output.

3. SaMD outputs

After the inputs are entered into the SaMD, and the algorithm goes to work with them, some kind of output will be generated. These outputs will inform, drive, diagnose or treat the user of the SaMD.

4. Clinical Evaluation

The outputs of the SaMD will be subject to clinical evaluation, which is a very challenging and difficult phase for every SaMD to go through. We have written an in-depth blog post on how to get through this stage with flying colours if you feel you need more information on this phase.

How are SaMD solutions categorised?

When diving into the categorisation of SaMD solutions, it’s important to know that, although similar, the approach is different in the EU and the US regulated markets.

EU SaMD (or MDSW) categorisation

To start things off, it’s important to note that although we talk about SaMD solutions, this term is not used in the EU officially. In the EU, the term “Medical Device Software” or “MDSW” is used. In the EU, the MDR defines 4 different classes; being classes I, IIa, IIb and III. These classes align to a rather large extent with the classification created by the IMDRF as well. In line with the EU classification of other medical devices, these classes depend on the intended purpose of the medical device, and the risks it might create. In the figure below, you can see the overview of classes used by the MDR.

If we dive a bit deeper into the risk aspect, it’s also important to note that the EU MDR uses the harmonised ISO 62304 standard to assess risk. If you plan on launching a SaMD in the EU, you will need to get a certificate of conformance from a notified test body for this standard.

US SaMD categorisation

In the US, it’s the FDA that establishes the different classes for SaMD solutions. Here, classification is based on both impact and functionality controls that are needed in order to prove safety and effectiveness. There are 3 categories that a SaMD can fall into according to the FDA: Class I, Class II and Class III.

What is important to note, is that the FDA also approaches risk classification based on the ISO 62304 standard, be it with some different terminology here and there.

What is the major international regulatory framework for SaMD (Software as a Medical Device) solutions?

In this section, we will dive a bit deeper into the regulatory landscape surrounding SaMD solutions. Especially in medical device development, the regulatory requirements can be quite challenging. Looking at the regulatory burdens early in the development process of a SaMD is the key to successfully launching the SaMD later on.

SaMD regulations: EU MDR vs FDA

First off, it is important to note that there is a difference when you are launching a SaMD into the EU or US markets. There is a clear distinction between the two markets, be it the way they are regulated. On the one hand, the EU market is regulated by the MDR (Medical Device Regulation), while on the other, the US market is regulated by the FDA (Food & Drugs Association). You might also have heard of the MDD (Medical Device Derivative), which has been replaced in the EU by the MDR.

Luckily, with the coming of the MDR, both types of regulations are much more aligned than they were before, especially in the case of the QMS (Quality Management System) requirements. More specifically, the ISO 13485 standard, but more on that later on.

Also, the IMDRF standards for SaMD are a harmonising effort, as both the EU and the FDA chair the council of the international forum. Although much more harmonised than before, it’s still very important that you deep-dive into the similarities and differences between the two if you plan on entering both markets.

SaMD quality management systems and standards: ISO 13485 vs FDA QSR

When we are talking about quality management for a SaMD, we are mostly talking about the ISO 13485 standard. The ISO 13485 standard is an international one that is required in order to launch a SaMD in the EU, Canada, Australia and many other markets. If you plan on getting a CE Mark for selling your SaMD in the EU, you will need to become compliant with the MDR, and to be compliant with the MDR, you will need to be compliant with the ISO 13485 standard. As you can see, it’s quite a big chunk of regulatory work to become a regulatory compliant SaMD manufacturer.

The US has its own set of regulations for SaMD companies. In particular, US regulation 21 CFR Part 820, also known as the US FDA QSR, is the one that has been implemented for over 20 years.

Complying with both types of regulations is a cost and time-consuming effort for many international SaMD providers. Luckily, the FDA is currently in the process of adapting the ISO 13485 requirement as well, which would make it much easier for companies to sell internationally. Only a few additional stipulations would be added to the FDA version, as both of them already are quite similar. This is also a result of the harmonisation effort of the IMDRF.

SaMD data protection: GDPR vs HIPAA

Software as a Medical Device will always rely on patient data in order to work properly and have its desired outcome. And with patient data, comes data protection and data security. Both the EU and US markets have strict data protection and data security regulations in place that you will need to comply with.

In the EU, data protection is regulated by the GDPR (General Data Protection Regulation). In the US, data protection is regulated by HIPAA (Health Insurance Portability and Accountability Act). Where the GDPR regulates ALL the personal data of persons living in the EU, HIPAA has a much more narrow scope, zooming in on the PHI or Protected Health Information of patients.

We have written an elaborate blog post on the exact differences between GDPR and HIPAA if you require more information on this topic. Read it here.

The importance of the IEC 62304 standard for SaMD development

The IEC 62304 standard is an international standard that defines a framework for software lifecycle processes, specifically for medical device software. The requirements are applied both for SaMDs and SiMDs.

As a SaMD manufacturer, you will need to comply with this standard in order to sell your solution in the EU, the US or both. As the software is an integral part of the SaMD, it’s best to start complying with the standard as soon as possible. A perfectly working solution means nothing if you’re not making sure it’s compliant. The standard also demands a QMS (see above) and recommends the ISO 13485 one.

Here at Extra Horizon, we have embedded quite the useful tool in the Extra Horizon medical Backend-as-a-Service platform, called the Software LifeCycle Tool. This tool enables you to implement software development processes to build IEC 62304 compliant documentation for your software code. The tool is integrated with Extra Horizon to streamline the compliance documentation generation for the configuration and facilitate your software release processes. All of this supports your compliance requirements for MDR in the EU market and FDA in the US market.

Clinical Evaluation of a SaMD

Clinical Evaluation is a dreaded step in the process of building and releasing a SaMD. Therefore, we have written a blog post specifically about the clinical evaluation phase for SaMDs in the EU, which you can read here .

We are also currently in the process of doing the same for clinical evaluation in FDA regulated markets, as this is a whole topic of its own, although similarities are present. So keep your eyes open for that blog post as well. If you want to receive updates like these directly in your inbox, you can always subscribe to our newsletters as well.

How difficult is building an in-house SaMD solution?

Building a SaMD from scratch, in-house, is quite the challenge. This does not mean whatsoever that it’s not possible to do so, but it does require a highly competent and knowledgeable team, with lots of resources to support it.

How do we know? We have done it many times over together with our customers. When building a SaMD, there are many, many stakeholders and aspects to take into account. When first starting out, you will probably want to focus on attracting the right team members, getting funding, creating your first prototype and so on. In a later stage, you will need to perform clinical trials, expand your team, have some FTEs specifically for regulatory compliance, and so on.

We have written an interesting blog about the challenges of creating medical applications completely from scratch if you need some more in-depth information on this topic, read it here.

How our Medical Backend-as-a-Service platform, made for SaMD solutions, can help

Extra Horizon offers you a way to easily manage and scale your SaMD solution when going through the difficult process of ideating, prototyping, validating and launching your solution. All this while still enabling you to be easily compliant with all the regulatory requirements that pop up over time. It is, as you could say, the medical backend that grows as your company grows. So, let’s make your developers and regulatory colleagues happy by choosing the platform made for them, and start unburdening them as much as you can to focus more on your IP!

Extra Horizon joins the AWS Partner Network, while introducing an important added feature: single sign-on

koen.schoofs@extrahorizon.com (Extra Horizon) — Thu, 01 Jun 2023 11:43:44 GMT

Hi there,

We are thrilled to announce that Extra Horizon is now an official member of the prestigious AWS Partner Network (APN), opening doors to a world of enhanced value and benefits for our esteemed customers. But that's not all – we've also implemented single sign-on (SSO), further improving accessibility within the Extra Horizon platform.

Now, let's dive deeper into these significant developments below ��

Extra Horizon Joins the AWS Partner Network (APN) ��

We're delighted to announce our partnership with the esteemed AWS Partner Network (APN) as an official AWS Partner. This collaboration unlocks a myriad of possibilities for both us and our customers, allowing us to harness AWS programs, expertise, and resources to deliver cutting-edge digital medical solutions built on the reliable AWS infrastructure.

To earn the coveted AWS Partner status, Extra Horizon underwent a comprehensive technology review, ensuring that our cloud architecture meets and exceeds AWS standards and best practices. We are proud to share that Extra Horizon successfully fulfilled all requirements, solidifying our position as an esteemed AWS Partner.

How You Benefit from this Partnership ⭐

Enhanced Expertise: As an AWS Partner, we can provide you with unparalleled expertise and guidance in leveraging AWS services and products to their fullest potential
Accelerated Cloud Adoption: With our partnership, we can help expedite your journey to the cloud by leveraging the extensive capabilities and support offered by AWS

If you have any questions or would like to explore the benefits and possibilities further, our dedicated product team is just a message away. Feel free to reach out!

Introducing Single Sign-On (SSO) via OpenID Connect to Extra Horizon ✅

Say goodbye to the hassle of managing multiple credentials. We're excited to introduce OpenID Connect, a powerful authentication process that brings seamless single sign-on (SSO) functionality to Extra Horizon. With this exciting addition, both you and your users can securely access multiple applications on our platform using a single set of credentials.

Benefits for Your Users ⭐

Easy Implementation: Enabling SSO functionality for your app's users is made simple through our software development kit (SDK) or via our user-friendly Control Center.

Enhanced Security and Compliance: Extra Horizon, leveraging OpenID Connect, ensures robust authentication practices and facilitates compliance with data privacy and protection regulations such as GDPR and HIPAA. Complex passwords become a thing of the past, reducing security risks and simplifying password management.

Simplified Authentication: No more juggling multiple sets of credentials. With SSO, your users can enjoy a unified login experience across applications and systems.

Enhanced User Experience: With a simplified login process, end-users can easily navigate and interact with your applications, resulting in a more seamless and satisfying user experience.

Use Case ��

Imagine your medical device comes with multiple frontends – a mobile application and a web dashboard. Traditionally, users and healthcare practitioners would need to log in separately for each frontend. However, with SSO enabled through OpenID Connect, users of all types can access these frontends effortlessly using a single set of credentials. Say goodbye to the need for unique usernames and passwords for each login!

For more information, have a look at the development documentation , or reach out for more information.

Want to know more?

Contact us here and feel free to ask any questions you might have. Also, you can subscribe to these products updates via email here to stay in the loop .

Extra Horizon is partnering up with HTD Health

Fri, 07 Apr 2023 08:20:55 GMT

Extra Horizon is excited to join forces with HTD Health to provide the fully-functioning backbone for a wide range of digital health solutions.

HTD Health, a boutique consultancy exclusively focused on health technology, was founded in 2016 with a mission to make health technology human. Their team of over 200 consultants and technologists is dedicated to providing strategy and digital services support to a diverse range of clients, from several healthcare areas of focus.

HTD Health and Extra Horizon share the same “API-tite” in the field of health. In an increasingly competitive digital health space, time-to-market becomes particularly important - but regulatory compliance is non-negotiable, and corners cannot be cut when it comes to meeting these requirements. In that context, HTD believes that to focus on making health technology human, it is important to focus on adding new value for customers rather than re-inventing a certified backend. Extra Horizon’s Medical BaaS provides foundational infrastructure to save time in development while ensuring security and compliance.

By partnering up, we will be able to combine the best of both worlds and provide the end-user with a fully-compliant, easy-to-use digital medical application, every time. We both share the same values that will enable us to help bring new patient-centered and high-quality healthcare solutions to the market.

Hans

De Leenheer

CEO

Extra Horizon

"Every technology solution has very specific needs, and in the medical space, it requires a lot of market experience to tackle that efficiently. But that doesn’t mean you cannot build these solutions on top of a very strong foundation that already exists, such as Extra Horizon. From our very first contact with HTD Health, we immediately felt both of our teams were speaking that same language of understanding. Having that built-in trust in recognizing each other’s strengths is what is going to make this partnership a great success."

Zach Marchin

Founder

HTD Health

"HTD is really excited about the opportunities in the medical device space. Next-generation devices increasingly require user-friendly software for device use, onboarding and education, and broader digital health features to engage patients over time — not to mention companion platforms for storing and analyzing the data these devices produce. We have spent the last year building out our internal eQMS and processes for designing and building FDA regulated software and with Extra Horizon we have the opportunity to bring SaMD to market with speed and security. We’re looking forward to what this partnership will bring!

Get up to speed on the latest changes, features, bug fixes, and more on the Extra Horizon backend platform

koen.schoofs@extrahorizon.com (Extra Horizon) — Thu, 30 Mar 2023 11:57:39 GMT

Today, we're excited to share several changes and features of the platform that we believe will enhance your experience:

Introducing the Extra Horizon Control Center ��️
Plan ahead with Task Scheduling ��
A Service Discovery you can rely on ✅

Read on for more information on these exciting updates!

Introducing the Extra Horizon Control Center: tra nsforming the way you manage your Extra Horizon environment

We're excited to introduce our brand new Control Center - a web interface designed exclusively for Extra Horizon customers and partners. The Control Center offers a range of powerful benefits and features that make managing your medical device(s) simpler and more efficient than ever before.

Benefits ⭐

Enjoy increased autonomy and ease of use
Get a more tangible product experience
Easily accessible web platform to gain insights into your environment(s)

Features ✅

Streamline user management with the ability to add, update, and delete users and user roles

Simplify configuration management with a clear view of your data schemas, documents, task functions, and task executions

Ensure regulatory compliance and achieve necessary certifications with audit logs that track key events and actions, such as as user creation, login attempts, data creation, and function creation.

As an Extra Horizon customer, you can access the Control Center via app.extrahorizon.com , and login credentials are provided by us. It's deployable in any new or recently updated Extra Horizon environment, making it easier than ever to manage your medical device(s) with confidence. Don’t hesitate to reach out directly to learn more about the Control Center.

Task Scheduling is Here - Automate your Custom Functions with Ease

We're delighted to introduce our newest feature, Task Scheduling, which is designed to provide our customers with a simple and powerful way to automate their custom functions.

Benefits ⭐

More autonomy: Task Scheduling enables you to can automate your custom functions with ease, without having to worry about complex scheduling
Less error-prone: Task Scheduling eliminates the need for functions to manually schedule themselves, reducing the likelihood of errors

Features ✅

Ability to schedule functions at specific intervals
Option to set a start time for scheduled tasks
Option to schedule tasks based on a start time and an interval after the start time (in seconds)
Ability to run tasks only when triggered, with no schedule

Example ��

Imagine you have a digital medical application that needs to send weekly reports to a hospital. With Task Scheduling, you can set up a schedule for this function to run every week without having to worry about manually triggering it. The function contains the functionality to send that report, and you can rest assured that it will be executed at the desired interval, without any manual intervention.

Read the full documentation here ->

Improved Service Discovery

We are very pleased to announce that we have improved the Extra Horizon Service Discovery functionality.

Being an Extra Horizon customer also means that we make sure your medical device is running on the latest technological architecture. You don’t need to worry about these things yourself - we take care of it for you. The Service Discovery is included in the infrastructure of all Extra Horizon clusters, so no setup is required.

Benefits ⭐

Increased availability guarantees: Mitigating any risks of unavailability is always a high priority for us. Our new Service Discovery functionality is using the latest technology and will ensure your medical device will always be up and running, ready to perform!
Faster API response time: optimised routing of requests, leading to faster API response times.

Want to know more?

Contact us here and feel free to ask any questions you might have. Also, you can subscribe to these products updates via email here to stay in the loop .

Why we should push for the Privacy code of conduct on mobile health apps to be approved

Tue, 21 Mar 2023 08:39:30 GMT

When using a new medical app, it is only natural to have some initial scepticism about whether or not you can trust the app with your personal data. And who can blame us? We are putting some of our most sensitive information into these apps, and hearing about the numerous health data breaches happening worldwide is not very reassuring.

Gaining trust from users is one of the most important hurdles when successfully launching a new mobile health app into the ever-growing digital health market. Of course, the market is heavily regulated, with stringent data regulations such as the GDPR being in place. The GDPR exists to protect the personal data of individuals, but when it comes to medical apps, the picture becomes even more complex.

And that’s where the Privacy code of conduct on mobile health apps comes into play. But first, some background information to get you up to speed.

In the beginning, there was the European Commission Green Paper on mobile health

So let’s start at the very beginning, before the GDPR even came into force. When the European Commission published a Green Paper on mobile health back in 2014, it revealed that people often do not trust mobile health apps due to privacy concerns. In fact, the paper revealed that 67% of consumers did not want to use their mobile phone in support of their health at all. At a time when digital health apps are offering a number of life-changing benefits to patients, it’s pity that some people might miss out due to privacy concerns.

The solution? A Privacy Code of Conduct on mobile health apps

Motivated by the findings of the Green Paper, the European Commission decided to encourage the creation of a Privacy Code of Conduct on mobile health apps . Created by industry stakeholders, the purpose of the code was to increase trust amongst mobile health app users. Work on the code started less than a year after the Green Paper consultation, in April 2015.

Important guidance on data principles, made specifically for medical app developers

The code contains guidance catered specifically to the developers of medical devices. As developers are the ones creating the apps, and deciding to what extent the apps will access and process personal data, it only seems logical to have a standardised and consistent guide to data principles specifically for medical app developers.

The code addresses the following topics:

User consent
Purpose limitation and data minimisation
Privacy by design and by default
Data subject rights and information requirements
Data retention
Security measures
Advertising in mobile health apps
Use of personal data for secondary purposes
Disclosing data to third parties for processing operations
Data transfers
Personal data breaches
Data gathered from children

So, why was the code not approved in the first place?

As the Code was submitted on 7th December 2017, before the GDPR was in effect, it was submitted for approval under the Data Protection Directive (DPD), which was the predecessor to the GDPR. However, when the assessment of the code was published in April 2018, just one month before the GDPR came into effect, it was determined that the GDPR should be applied instead of the DPD. Thus, the code was not approved, as it was not written with the GDPR in mind.

But why add more rules and regulations on top of the GDPR?

It may sound like a lot of work to comply with both the GDPR and the Privacy code of conduct on mobile health apps, but in my opinion, this is not the right way to look at it. Although the GDPR already provides thorough guidance in terms of data privacy and security, these rules and regulations have yet to be reworked into suitable criteria and guidelines for the medical app industry. Introducing the Privacy code of conduct on mobile health apps will fill this knowledge gap, and will be a useful companion to existing privacy regulations, including the GDPR.

The future of the privacy code of conduct on mobile health apps

Although the first version of the code was not approved, the European Commission continues to encourage industry stakeholders to develop the code, in the hopes that it will eventually be approved by the European Data Protection Board - and I feel strongly that we should be supporting this.

So, why should we be striving to get this code of conduct finished and approved?

A code written by developers, for developers

First of all, the idea of this code of conduct is very much welcomed by medical app developers. Industry members took the lead in developing the code itself, with the European Commission acting as a facilitator of the code. In essence, it is a code written by developers, for developers.

Having the code officially approved will mean that these industry-specific criteria and guidelines will finally be widely available, bringing the regulatory and app development worlds together in a language that developers understand. This will iron out any confusion and uncertainties, and keep developers on the same page across the industry.

Provides specific guidance on European data protection rules

The code raises awareness of the data protection rules in the EU. With developers not necessarily being experts in the field of medical device regulations, a thorough guide to the necessary data and privacy rules is an extremely useful resource for programmers looking to build compliant medical device software. If developers have one common code of conduct to adhere to, less time will be spent figuring out the often-puzzling data regulations, and developers will have more time to focus on creating high-quality and life-changing digital health solutions.

Empowering users

The privacy code of conduct on mobile health apps plays a pivotal role in highlighting the numerous benefits of medical apps, and reassuring users that their data is in safe hands. With medical apps transforming the world of healthcare and changing the lives of patients, we should be doing everything we can to reassure the 67% of people that medical apps can be trusted. Plus, this statistic was recorded in 2014 - who knows how high that number could still be in 2023? Getting the Privacy code of conduct on mobile health apps finished and approved will provide some much-needed reassurance to the people who are hesitant to trust mobile health apps.

To conclude

Although it’s likely to take a lot of time and effort to get the current draft of the code into shape, the benefits to the medical app industry will be astronomical. The code will not only benefit the creators of these apps, but also the users, who will be able to sleep easy at night knowing that their data and their health are in good hands. Working at Extra Horizon, where we create a medical backend platform built for medical apps in particular, I can only applaud the current efforts being made with this code.

About Sophie

Sophie is the content expert at Extra Horizon. She has done lots and lots of research into the wonderful world of digital health applications. During her research, she encounters lots of interesting topics like this one.

Cybersecurity and techno-nationalism: will the patient benefit in the end?

Tue, 07 Mar 2023 13:13:26 GMT

As an account executive, I often talk to extremely intelligent and ambitious people who strive to improve patients' lives, and preferably as quickly as possible. They often run into various barriers to innovation, especially from a cybersecurity perspective.

The cybersecurity battle

The topic of cybersecurity looks more and more like a protectionist battleground of the various states, rather than a battleground to protect the citizen/patient. NEN 7510 in the Netherlands, HDS / SecNumCloud in France, and Gematik ( BDSG ) in Germany are just of few examples of local legislation with specific requirements for each country when it comes to information security and data sovereignty related to health data. On top of that, European institutions are trying to take this to a universal level with their own regulations and directives, but so far did not succeed in harmonising this across the Union. Cybersecurity in Europe is therefore beginning to take on more and more techno-nationalist characteristics, instead of being focused first and foremost on protecting healthcare information.

But what exactly is techno-nationalism?

A Techno-nationalism is a term used to describe the promotion of technology as a means of advancing nationalism, with nationalism being an ideology that places the interests of a nation above any other interests or nations, and national self-interest. It outlines the idea that a country should prioritise its own technological advancement and that technology should be developed and used in a way that serves the national interest, as opposed to the interest of patients as a whole.

Techno-nationalism can take many forms, from supporting domestic technology companies, to limiting the import of technology from other countries, to developing solely-domestic capabilities in key technological areas such as artificial intelligence, biotechnology, and cybersecurity. Techno-nationalism can be seen as a response to the increasing globalisation of technology and the desire to maintain national sovereignty in the technological realm.

Will techno-nationalism improve or kill innovation?

The plus sides: increased investment and incentivised innovation

The impact of techno-nationalism on innovation is complex and multifaceted. On one hand, promoting national self-interest in technology can lead to increased investment in research and development, and the creation of favourable conditions for innovation. For example, governments may provide funding for technological projects, subsidies for companies, and favourable tax policies to incentivise innovation. This can result in the development of new technologies, increased competitiveness, and a boost to the national economy. And, most of all, these technological advancements in healthcare can be hugely beneficial to patients.

The downsides: restricted market access and lack of collaboration

On the other hand, techno-nationalism can also stifle innovation by limiting the flow of ideas, talent, and capital across borders. By prioritising national self-interest, countries may restrict access to international markets and limit the import of foreign technology. This can lead to a reduction in competition, reduced incentives for innovation, and a slowdown in technological progress. Ultimately, patients can miss out on the various life-changing medical technologies that come from overseas markets, thus decreasing the quality and choice of care available to them.

Furthermore, techno-nationalism can also have negative effects on international cooperation and collaboration in the field of technology, particularly in the healthcare field. When countries prioritise their own interests, they may be less likely to share knowledge, collaborate on projects, and participate in international organisations dedicated to technological advancement. This can result in a fragmentation of the global technology community and a reduction in the efficiency of technological innovation. Companies and institutions in different countries have the potential to work together and create innovations that transcend borders, but techno-nationalism threatens this idea.

To conclude

In conclusion, the impact of techno-nationalism on innovation is complex and depends on the specific policies and circumstances of each country. While it can lead to increased investment in technology and a boost to the national economy, it can also limit the flow of ideas and stifle international cooperation, ultimately reducing the overall progress of technological innovation and limiting patient benefits. Thus, we should be mindful to make sure that techno-nationalism does not get in the way of getting patients the healthcare technology they genuinely need.

So, why are we not all using the same standards globally, like we already do with ISO-standards?

About Michiel

Michiel is the Account Executive at Extra Horizon. He has a wealth of experience in the field of digital health and is always looking to learn more about the world of MedTech and connect with other players in the industry.

To be or not to be a medical device, that is the question...

Tue, 14 Feb 2023 13:59:22 GMT

A few weeks ago, I was at an event filled with ambitious health entrepreneurs and health professionals. Bright people, with very interesting stories to tell. During the several keynote sessions, it became clear that preventive medical apps are becoming increasingly popular and gaining a lot of traction in the medical space.

And this got me thinking. Preventive applications are often not required to go through the stringent regulatory requirements that classical medical devices need to go through in order to get into the market. I’m a strong believer in the fact that to prevent is always better than to cure. But, I also think in the interest of patient safety, we should not lose the reins on regulating preventive medical applications.

The issue with not regulating preventive medical apps

Subscribing to a preventive medical app will always be cheaper than traditional healthcare services, as you are able to monitor and track your health from your phone and other devices, instead of having to visit a doctor or other healthcare professional and paying a lot more for a consultation.

On the surface, the idea of using preventive medical apps is a very positive one. You are actively looking into improving your health by following the guidance of the app. However, you are also trusting your future health in apps that are often not as regulated as you, as a user, might expect. As long as the algorithms and instructions present in the app are of very high quality, and created by bright and wonderful people, all is well. But what if this is not the case? What if the instructions you are following turn out to be less effective, or even wrong, in the end? I’m not stating that creators or preventive health applications should be held accountable, but I am arguing that even preventive medical applications should be regulated a tad more in order to prevent incorrect prevention.

How the FDA is already improving this situation

Given the rather slow European decision-making process in this regard, it is important to look across the pond. In this context, on the 27th of September 2022, the FDA published a particularly interesting document called the Guidance for Industry and Food and Drug Administration Staff . In the first condition of this document, they seem to exclude many digital health solutions from escaping the strict medical device regulations. They pose the question: is my software function acquiring, processing, or analysing medical images, signals, or patterns? If the answer is yes, you will be subjected to FDA oversight, which is not necessarily a bad thing.

How to move forward

Moving forward on this matter should have two common goals in mind: patient (or user) safety and long-term patient well-being. Even though many people will keep relying on preventive medical apps (which is great), I strongly feel that a better-regulated framework could improve patients’ lives tremendously. Yes, this will mean that these kinds of medical apps will have a more difficult time entering the market, but this will also mean that when they do get into the market, their preventive solutions are of much higher quality by meeting the regulation standards, which is something we should always strive for in the digital health space.

If you are planning on building your digital medical application from scratch, all by yourself, it might be a good idea to consider building it with a medical Backend-as-a-Service like our own. Find out more here.

Looking back at 2022

Wed, 14 Dec 2022 08:58:40 GMT

2022 has been a landmark year for Extra Horizon, with our official spin-off from Qompium N.V. establishing us as a fully-independent company. Together with our continued presence at MedTech events all over the world, we are creating a name for ourselves in the digital health sector as we continue on our mission to drive the digital transformation of healthcare.

Spin-off from Qompium N.V.

After becoming a separate business unit at the beginning of 2022, Extra Horizon officially spun-off from Qompium N.V. on 8th September 2022. This spin-off sets us off on our own growth path as a separate entity, as we continue towards our goal of transforming how digital health solutions are brought to market. This change also saw Hans De Leenheer appointed as our new CEO, having previously served as our Managing Director. Together with Kobe Leysen, CTO, and Tom Dufour, VP Engineering & Operations, they form a solid management team.

“With Extra Horizon transitioning from a business unit into a separate company, 2022 has been a year with a lot of exciting changes. With the spin-off now behind us, we are ready, well-equipped, and extremely motivated to really start our journey. 2023 here we come!”

- Kobe Leysen, CTO

We kicked off this exciting new chapter with a 2-day offsite event with the entire team. As well as further shaping our Extra Horizon brand identity, we spent a lot of time discussing and shaping our company values, and finally finishing off with team building activity - driving Citroën 2CVs through the beautiful province of Limburg!

Conferences and events

All throughout the year, we have been attending a number of conferences and events, both nationally and internationally. Highlights have included The Medtech Forum 2022 in Barcelona , the EU Health Summit in Brussels, and the MedTech Conference in Boston, USA.

We have also (co)hosted two of our very own conferences, which provided us with the invaluable opportunity to share technical and software-related knowledge with other companies in the MedTech sector.

We value these opportunities to connect with the wider MedTech community, and we are excited to attend more conferences and events in 2023.

Helpful and insightful content: our top 3 picks of the year

This year, we have produced a great deal of useful and interesting content surrounding topics in the MedTech field. Here are our top 3 picks of the year!

1. How can your SaMD pass the clinical evaluation phase with flying colours in EU markets?

The clinical evaluation phase in EU markets is not easy to get your head around. In this blog, we break down this difficult process and provide you with useful pointers for how to pass this phase with flying colours.

2. Our latest IEC 62304 ebook: a thorough yet simple guide

IEC 62304 is one of the most important regulatory standards in the MedTech field - but it’s also one of the most difficult ones to follow. In our IEC 62304 ebook, we break this tricky standard down into manageable chunks to help you on your path to certification.

3. Our brand new Extra Horizon Coffee Corner

The Coffee Corner is a place where our team share their thoughts and insights on a variety of topics in the MedTech sector. Especially in light of our recent spin-off, the Coffee Corner provides a valuable opportunity to get to know the minds behind Extra Horizon, and see just how passionate we are about driving the digital revolution of healthcare.

As we move into 2023 as our first full year as an independent company, we continue to strive towards our goal of changing the way digital health solutions are brought to market - and getting these solutions to the people who need them as quickly and easily as possible. We are creating a name for ourselves in this exciting and promising industry, and we have higher hopes than ever for 2023. So, keep your eyes out for more exciting things to come!

The blurring line between wellness and health

Wed, 16 Nov 2022 14:38:48 GMT

Would you buy a thermometer where the manual states "only designed for general fitness and wellness purposes"? I recently read a critical article on at-home urine tests. The authors of the article discovered that the tests were inaccurate in some cases. When they contacted the company to ask for scientific evidence, the company answered that the team was still working on that.

It became the inspiration for this post: a critical question as to whether companies can market their products as providing health insights without being a medical device. However, my tone quickly changed when I checked the hour on my wrist. The Apple Watch I was looking at also measures heart rate and tracks my sleep. The Apple Watch is a special case, as it has received FDA clearance for its ECG feature, but not for the blood oxygen monitor. That feature is only for general fitness and wellness purposes. The reality is, as always, more complex.

Medical devices are complex

At Extra Horizon we typically work with customers who are pursuing a medical device certification for their product. They have to engage in clinical validations. They have to implement ISO 13485 quality management systems. Their medical device software needs to be developed according to the IEC 62304 standard. They have to go through a lot of processes and validations before they can put their product on the market. Once their product is on the market, they have to engage in post-market surveillance activities. It’s a lot of processes and requirements to follow.

Health and Wellness: close but not equal

A medical device gives a diagnosis while wellness applications are informational only. Should every health-related app go through the same level of scrutiny? Definitely not.

But at least every health-related app should be transparent about their capabilities and accuracy. And they should be careful with your personal health data. In August 2021, a new IEC/ISO standard 82304-2 was published. Next to setting quality requirements for health apps, it also defines a label that visualises the quality and reliability of health apps. It’s similar to the energy consumption label for electrical appliances. If this kind of label becomes required, it becomes an incentive for companies to build trustworthy applications. It also makes it easier for customers to spot the difference.

I’m a big advocate of technologies that empower people to be more proactive about their health. If a company truly wants to empower people in this way, making sure it works reliably and accurately should be a requirement, not an afterthought.

Why connecting Electronic Health Record (EHR) solutions with a medical cloud backend will be the future of centralised digital healthcare

Wed, 16 Nov 2022 07:36:23 GMT

What is an Electronic Health Record (EHR)?

An Electronic Health Record (EHR) is a digital version of a person’s medical record. EHRs make it easier and quicker for authorised users to access a patient’s medical information, and they are widely used in the healthcare world.

There are many different EHR systems available, and the system used can differ from hospital to hospital. The main challenge in the MedTech world is to make sure that EHR information can be exchanged easily between these different EHR systems.

An EHR may contain a number of different kinds of health information, including, but not limited to:

A patient's medical history and diagnoses
Medications
Treatment plans
Immunisation dates
Radiology images
Laboratory results
Allergy details

What are the benefits of Electronic Health Records (EHRs)?

Electronic Health Records (EHRs) offer considerable benefits to patients, clinicians, healthcare professionals (HCPs), and researchers. They allow clinicians to access a patient’s medical record quickly and easily, which leads to more efficient care, particularly in emergencies. Information can also be exchanged between different clinicians in real time, ensuring that all doctors and specialists have access to an accurate, up-to-date medical record for their patient.

EHRs also provide easy access to health analytics, which help clinicians recognise any patterns, thus helping them provide a diagnosis and recommend suitable treatment options. The same health analytics can also be used to track treatment progress as time goes on. For example, an AI model can use patient data from the EHR to help make a diagnosis.

The historical medical information available in EHRs can also be very valuable for the further clinical development of therapies, as EHRs are a source of Real World Data (RWD)/Real World Evidence (RWE). RWD/RWE is data collected relating to patient health or the delivery of healthcare, outside of traditional clinical trial settings. This data can then be used to help design new clinical trials, and therefore develop new, innovative treatments for patients.

New legislation surrounding Electronic Health Records (EHRs)

On 3rd May 2022, the European Commission published a draft regulation for a European Health Data Space, which includes new rules about the use of EHRs. The European Health Data Space is a health-specific ecosystem of rules, common standards, infrastructures and governance framework that aims to strengthen links between national healthcare systems by means of secure and efficient access and exchange of health data. It also aims to create a uniform legal framework, particularly for the use, development, and marketing of EHRs.

What are the main interoperability challenges faced in the EHR field?

One of the main and frequently-discussed topics within the EHR field is the issue with interoperability. Interoperability means the ability of different information systems to access, exchange, integrate and cooperatively use data in a coordinated manner, within and across organisational, regional, and national boundaries.

The first and foremost issue surrounding EHRs is that they do not (yet) interconnect with each other. This means that, for example, a patient will have to re-enter all of their information every time they visit a new hospital or specialist.

Also, since the recent explosion in the use of remote monitoring applications/Software as a Medical Device (SaMD), it has become increasingly necessary for HCPs to have access to this data in order to monitor their patients properly. Problems with interoperability are a huge barrier when it comes to allowing HCPs to access this data easily and quickly.

With EHRs, it is essential that patient health data is shared between different systems and healthcare providers in a secure and efficient manner. However, there are many different EHR systems out there, and the system used often differs from centre to centre, region to region, or country to country. This is where interoperability becomes a challenge, as it can be difficult to share information between completely different EHR systems.

Tackling interoperability with Fast Healthcare Interoperability Resources (FHIR)

A solution for tackling interoperability issues with EHRs is using Fast Healthcare Interoperability Resources (FHIR). FHIR is a standard that defines exactly how healthcare information can be exchanged between different systems, regardless of how that information is stored in those systems. It allows healthcare information to be shared securely to those who need to access it. FHIRs also contain an application programming interface (API) for the exchange of EHR data.

What is an API?

API stands for application programming interface. APIs are a way for two or more computer programmes to communicate with each other. In this case, it allows the exchange of data between different EHR systems.

The FHIR standard was created in response to an increasing need for faster and easier methods to exchange data, especially due to the rapidly increasing amount of data in the healthcare space. Additionally, as the use of medical applications has become more and more commonplace, it has created the need for clinicians and patients to be able to share health data in an easy, real-time fashion.

So, how do FHIRs help solve this issue?

FHIRs act as a link between platform users and EHR systems, allowing the exchange of health data between different and dissimilar EHR systems. FHIRs reduce the issues surrounding interoperability, as they save the hassle of creating all of these integrations yourself by providing a readily-available link between different EHR platforms.

App --> FHIR --> EHR --> FHIR --> APP

At Extra Horizon, we have an extensive knowledge of FHIR and EHR integrations. Leveraging our existing knowledge will save you the significant time and money it would take to figure everything out yourself.

The FAIR data principles and EHRs

Another significant challenge is the FAIR data principle. Indicated by its name, the FAIR principle states that all research objects should be:

Findable
Accessible
Interoperable
Reusable

The FAIR principles were created to encourage the use of the large number of patient registries and administrative databases in Belgium. Many people are unaware that these registries and databases exist, or how to access them, and this is what the FAIR principles aim to change. The idea is that by having a thorough set of guiding principles and practices, it will be easier to discover, access, integrate, and cite the health data collected in these registries and databases. Breaking the barriers towards accessing this data is hugely beneficial to patients, as the information provided can be used to help determine the best way to care for patients with particular conditions.

Using a medical cloud backend for EHRs can help significantly with meeting the FAIR principles, particularly the accessibility and interoperability elements. This is because a medical cloud backend makes it easier to access data from multiple locations.

You can read more about the 4 FAIR Guiding Principles here .

So, how can a cloud-based Medical Backend-as-a-Service be useful when it comes to EHRs?

EHR systems generally fit into one of two categories; client-server systems or cloud-based systems. With client-server systems, data is stored on in-house servers, and clients communicate with the servers through a computer network. With cloud-based systems, data is stored on external servers, and any authorised user can access the data through the internet on their own device.

Although client-server systems were popular in the past, medical providers are now increasingly opting for cloud-based systems for storing their EHRs. This is due to a number of reasons, including:

1. EHRs with cloud-based systems are easier to implement

Unlike client-server systems, cloud-based systems do not require the installation of hardware and software on-site. This makes implementation both faster and easier.

2. Cloud-based EHRs come with reduced costs

As no physical hardware or software needs to be installed for cloud-based systems, this saves you significant amounts of money in installation costs, as well as on other expenses such as software licenses.

Cloud-based system providers also generally offer fixed monthly prices, so the costs are predictable with no hidden surprises.

3. Reduced workload

Using an external medical cloud backend provider means that many tasks, such as installing hardware and updating software, are outsourced to the medical backend provider. This significantly reduces the workload for your team, allowing them to focus on other important tasks, such as developing your business logic.

4. EHRs with a cloud-based backend offer better scalability

Medical backends are highly flexible, and are able to deal with sudden changes with ease. As more patients join a medical facility, the medical backend can easily adapt to accommodate an increased number of users. Thus, using a medical backend drastically reduces the chances of technical issues when there is a sudden surge in user numbers.

5. Cloud-based EHRs have better interoperability

Medical backends often have capabilities that allow different EHR systems to communicate with each other, thus enabling information to be shared across different centres, where the EHR systems used are often different.

6. Cloud-based EHRs offer stronger security

Lastly, but arguably most importantly, cloud-based systems offer a high level of security, which is vital when it comes to EHRs. As EHRs contain confidential and often sensitive personal health data, keeping this data on a secure platform is essential.

When using a cloud-based system, data is encrypted, meaning that the information cannot be read by anyone except the authorised users of the EHR system. This also means that sensitive health data is protected in the event of a security breach.

Additionally, using a cloud-based Medical Backend-as-a-Service for your EHR system means that all data is thoroughly backed up in several different locations. This prevents data from being lost in the case of emergencies such as fire or flooding. With client-server systems, data can easily be lost if the server is damaged or destroyed. With cloud-based systems, this is not an issue.

How can Extra Horizon help?

We can help you navigate the jungle of EHR systems and how you can connect them to all the larger integration platforms. With our extensive knowledge in both FHIR and EHR integrations, we can help you figure out how to set these up for your own systems. Leveraging our knowledge will help you to streamline your operations, reduce the time and money spent tackling interoperability issues, and improve the overall care to the users of your product.

Choosing to use a cloud-based Medical Backend-as-a-Service, such as Extra Horizon, also offers considerable benefits in terms of accessibility of data. With cloud computing, it is possible to access medical records from multiple locations, without the need to physically visit each location. This allows easy communication of EHR data between different hospitals and clinics, and saves the patient from having to fill out their details each time they visit a new hospital or clinic - a huge advantage over traditional paper records and client-server systems.

Above this, as there is no need to install hardware facilities with cloud-based systems, this will save you a lot of money in purchase and installation costs.

To conclude

Although very valuable in the healthcare space, EHRs certainly don’t come without their challenges. However, by harnessing the power of a medical cloud backend, you will be able to overcome these challenges with ease. By leveraging our readily-available Medical BaaS, you will save yourself the headache of working out all of the EHR integrations, as well as overcoming the looming issue of interoperability. To find out more, please do not hesitate to get in touch.

IEC 62304 - A thorough yet simple guide

Tue, 11 Oct 2022 09:41:07 GMT

Building and releasing medical device software is hard, very hard. Here at Extra Horizon we have had a lot of experience in successfully building, launching and scaling Medtech products that are IEC 62304 compliant.

We often get lots of questions regarding the IEC 62304 standard, as it is not the easiest of standards to follow.

There are a lot of concepts and terms that you need to familiarise yourself with, which can often seem quite daunting.

That’s why we took it upon ourselves to write an elaborate guide on IEC 62304 with the main purpose of navigating the reader through the most important concepts of the standard.

Qompium announces the spin-off of its Extra Horizon business

Mon, 03 Oct 2022 07:01:34 GMT

Hasselt, Oct 3, 2022 - Extra Horizon, a leader in the Medical Backend-as-a-Service (MBaaS) market, has officially demerged from its parent company, Qompium N.V.. For almost a decade now, Qompium has been a leading pioneer in the Software as a Medical Device (SaMD) market with FibriCheck, a device-agnostic mobile application for arrhythmia detection and monitoring.

Extra Horizon is the fully-mature and medical-grade cloud platform that has been the infrastructure foundation of FibriCheck for all these years. It is fully certified and complies with the highest standards in terms of data privacy and security. Since it has been running in production for multiple years already, it can drastically reduce the time to market for new medical innovation startups. This allows startups to bypass the steep learning curve of how to build medical software, and helps them avoid wasting time building core infrastructure blocks. As a result, they can dedicate their time to implementing their business logic instead.

Lars Grieten

CEO

Qompium NV

“When we started building FibriCheck, we quickly realised that a lot of our time and resources were being invested in making and keeping our product up to date with compliance requirements, scalability needs and offering flexibility. We took the decision to re-invent the way of working and we built a platform, Extra Horizon, that serviced all the needs to support the current and future roadmap of FibriCheck. It quickly became clear that Extra Horizon brings also tremendous value for other companies that aim to develop and commercialise a medical application. By spinning out Extra Horizon, we are proud to see this dream become a reality and that at FibriCheck, we now can maximise the focus of our engineering resources on building value for our end-users.”

This demerger clears the path for both organisations to set their own growth path. Although FibriCheck and Extra Horizon as products are both operating in the medical software space, they are serving different customer bases.

Whereas FibriCheck directly serves doctors and patients as their end users, both directly and through partnerships and integrations, Extra Horizon will serve other medical software startups, and expects to start operating globally very fast through an international partner network of software studios.

The belief in Extra Horizon’s potential as an independent entity is reflected in the fact that the shareholder structure and the board are now mirrored in both companies. Additionally, the board appoints Hans De Leenheer as its new CEO. Hans, who joined the team a little over a year ago, had already been leading the Extra Horizon business unit as its managing director. Extra Horizon will be looking to secure a seed capital round over the next few months to enable the team to grow its sales and partner network activities.

Hans De Leenheer

CEO

Extra Horizon NV

“I’ve seen quite a few scale-ups from the inside over the last five years as a strategy advisor. But it’s been very rare for me to find a team and a product with as much potential as Extra Horizon. Without a single exception, everyone on this team specifically joined the company to make a true impact on people’s lives. It will be up to us to create an environment where they can make that happen, and I am extremely honoured for the confidence the team and the board have given me.”

Governments are doubling down on health cybersecurity

Mon, 04 Jul 2022 11:59:12 GMT

At the Agoria Health Tech summit, which I attended at the end of June, cybersecurity in health was an important topic, and rightfully so. According to the Cyber Incident Tracker for Health, there were 253 attacks against healthcare organisations in 32 countries in 2021. These incidents can affect lives, with 15% of these cases resulting in an impact on incoming patients. If you still believe that hacking is difficult or that they won’t target your small business, it’s time to revisit that opinion. The plethora of free tools makes it easy to get started and hackers are opportunistic - they hack whatever might bring them money. If you are a hacker, it’s also unlikely that you will be prosecuted for your acts. In the UK, the risk of being injured in a motorcycle accident is three times higher than being prosecuted for hacking. So, hackers do get away with it.

So, we have to increase our cybersecurity efforts. Then, the next question is: whose responsibility is this? The opinion that cybersecurity is something only for IT is quite outdated. Similar to safety in the aviation industry, cybersecurity is everyone’s responsibility and should be embedded in the company culture, in the processes, tools, and technical systems.

To increase the general security posture, governments are increasingly creating legislation that forces companies to take up their responsibilities. In 2016, the NIS directive was the first piece of EU-wide legislation concerning cybersecurity. Because of the difficulties in implementing this directive, the EU Commission started working on a proposal to replace the NIS directive to further strengthen cybersecurity throughout the EU. A provisional agreement was reached on 13 May 2022.

Next to addressing issues with the current directive, the expectation is that more entities will be considered critical and important from a cybersecurity perspective. Entities manufacturing medical devices or in-vitro medical devices will be considered important and in some cases even critical. That means that they will be under increased scrutiny and face more regulations. One of the consequences of these regulations will be that you’ll have more responsibility in checking that your suppliers adhere to these regulations as well.

A lot of the companies we talk to are focused on getting their unique medical innovation on the market. They’re focused on lab work, clinical trials, fine tuning algorithms, and getting their CE certification…. These new regulations might feel like an additional burden to them. However, it presents a particular opportunity. When you’re serious about cybersecurity in a data-sensitive environment like health tech, it’s a trust enabler. On the other hand, it does reinforce my belief that choosing the DIY method and trying to do it all yourself is a bad idea. Having partners that can handle a lot of the surrounding things can help you stay focused. Today, there’s the NIS2 directive, but surely tomorrow will bring something else.

Sources

Hack4Health recap: a hackathon for health

Wed, 18 May 2022 14:13:00 GMT

On 12 May 2022, the BlueHealth Innovation Center organised the Hack4Health hackathon event in Sint-Truiden, Belgium. The event focused on two key areas of health; caring neighbourhoods, and care tourism. The caring neighbourhoods aspect focused on achieving better communication between caregivers in the community and the main healthcare institutions, thus helping people to stay at home for longer instead of being admitted to hospitals or other care facilities. The care tourism element focused on how to better support people with a mental or physical disability to go on holiday.

Extra Horizon’s Product Owner Christopher Hex participated in the Hack4Health event, and as a part of a 5 person group, they came up with their winning solution: a micro-learning platform through which people can learn, through very easy-to-take courses, about how to understand people better, and how to start conversations with people who may struggle.

On his participation in Hack4Health, Christopher had this to say:

Christopher Hex

Product Owner

Extra Horizon

“Working on the engine that powers digital health solutions, it’s easy to get lost in the technical aspect of healthcare. These events help me to stay curious and focused towards our and our customers’ true end goal: improving people’s lives.”

Although the topics of Hack4Health were quite far from the more technical topics we encounter here at Extra Horizon, we think it is incredibly important to keep links with the broader health space. Participating in events such as Hack4Health helps keep the focus on the ultimate goal, which is to help patients.

We're looking forward to joining the next Hack4Health event around the topic of telemonitoring, which is Extra Horizon's sweet spot!

Find out more about Hack4Health here .

How can your SaMD pass the clinical evaluation phase with flying colours in EU markets?

Tue, 10 May 2022 12:06:00 GMT

Before we dive into clinical evaluation, what is SaMD (Software as a Medical Device) exactly?

A SaMD (Software as a Medical Device) refers to software that is used for a medical purpose, without being part of a physical medical device. For example, it may refer to an application for a computer, mobile phone, or tablet that is intended to treat, diagnose, relieve, monitor, or cure a medical condition or disease.

A pure example of SaMD is the certified and successful app FibriCheck . FibriCheck is a smartphone app that can check your heart rhythm, detecting any irregularities and therefore preventing strokes. FibriCheck is not part of a physical medical device, but is instead installed directly on the user’s smartphone. Almost any smartphone, that is! This is why FibriCheck is classified as SaMD.

SaMD offers many useful benefits. It can facilitate rapid data collection and analysis, which is far quicker and more efficient than what can be achieved by clinicians in the same timespan. It can also pick up on any sudden changes in a patient’s condition very quickly, even detecting subtle changes that may not have been noticed by the patient or their monitoring clinician. For this reason, SaMD can have considerable benefits to the patient, as detecting abnormal patterns early means that these can be investigated and addressed, thus opening the possibility of preventative care and preventing the patient from becoming more seriously ill.

Clinical evaluation for SaMD in EU markets

In essence, the purpose of performing clinical evaluation is to make sure that the SaMD conforms with the required regulatory requirements. In the process of clinical evaluation, the clinical data related to the SaMD is analysed and assessed to verify that the SaMD is safe to use and that the data is clinically useful. Performing clinical evaluation also enables any risks to be identified that have not already been identified and assessed as acceptable in the risk analysis, thus preventing any unexpected and potentially dangerous side effects.

Why do you need to perform clinical evaluation for SaMD (Software as a Medical Device?

In the EU, the path for clinical evaluation of SaMD is split into 5 stages. These are illustrated in the figure below:

The requirements for the clinical evaluation of SaMD are outlined in Article 61 of the MDR. When it comes specifically to the clinical evaluation of SaMD, the path for this is outlined in the document ‘MDCG 2020-1 Guidance on Clinical Evaluation (MDR) / Performance Evaluation (IVDR) of Medical Device Software’; a document endorsed by the Medical Device Coordination Group (MDCG) of the European Commission.

What is the MDR and the IVDR, and why do they matter when building SaMD?

The MDR (Medical Device Regulation) is a set of regulations that governs the manufacture and distribution of medical devices in the EU. It came into effect on 26 May 2021. The MDR aims to ensure a high quality and safety of medical devices in the EU.

The IVDR (In Vitro Medical Device Regulation) is a regulatory framework for in-vitro medical devices in the EU. It was entered into force on 26 May 2017, and will apply fully in all EU member states by 26 May 2022. The IVDR sets rules on how in-vitro medical devices are classified, and how they are regulated and kept under surveillance.

Both the MDR and the IVDR are especially important when building SaMD, as they are used as the basis of the requirements for building SaMD. Therefore, being compliant with the MDR and the IVDR is essential for any company developing SaMD.

The three main components in the EU clinical evaluation stage

The three main components in the EU SaMD clinical evaluation stage are as follows:

1. Valid Clinical Association of the SaMD

For this component, you must be able to prove a valid association between the output of your SaMD (e.g. measurements, conclusions) and the clinical condition that it is intended to target. You can prove a valid association by using things such as findings from clinical research and trials, secondary data analysis, etc.

2. Analytical / Technical Validation of the SaMD

Here, you must prove that your SaMD correctly processes input data to produce accurate and reliable output data. Not only must you prove that your SaMD processes data properly, but you must also show that your software has been built properly.

3. Clinical Validation of the SaMD

For the clinical validation element, you must prove that any data produced by your SaMD is clinically meaningful and beneficial. For example, with the FibriCheck app, it must be proven that the data produced is clinically useful for detecting cardiac arrhythmias.

For more information on these three main components, you can read this document here.

There are many ways to obtain the necessary clinical data for the clinical evaluations of a SaMD. Here are several possible ways to collect the data:

Published data on clinical experience with the device or equivalent
Clinical investigation
Clinical investigation with a similar device
Combination of the above

How to improve the likelihood of passing the dreaded clinical evaluation phase for a SaMD

Your secret weapon for the Clinical Evaluation phase: The Lifecycle Tool

Extra Horizon offers a Lifecycle tool; a tool that makes it easier to manage software lifecycles. Lifecycle management refers to the specification, design, development, and testing of a software application, from the initial conception of the application, right up until the discontinuation of the product. The documentation generated by the Lifecycle Tool can be used as valuable evidence to prove that your SaMD conforms to the necessary regulatory requirements - something that is extremely important during the Clinical Evaluation Phase.

How Extra Horizon can help carry the burden of passing the Clinical Evaluation phase for your SaMD

Saving precious time and money

Using Extra Horizon’s medical Backend-as-a-Service (BaaS) offers numerous benefits during the Clinical Evaluation phase. As we provide a leveraged platform, this means that companies are able to simply configure their own backend platform instead of building it from scratch in-house. This will save you a lot of time and money, which means you will have more time and effort to focus on tackling the often-daunting SaMD Clinical Evaluation phase.

Regulatory certifications

Extra Horizon holds a number of regulatory certifications, including, but not limited to, the list below:

How does the SaMD clinical evaluation process differ in FDA-regulated markets?

In the FDA controlled regions, which includes the 50 United States, the District of Columbia, Puerto Rico, Guam, the Virgin Islands, American Samoa, and other U.S. territories and possessions, the clinical evaluation phase is quite similar to that of the EU markets, although there are some differences that are well worth mentioning. We're currently writing a piece that dives a bit deeper into this aspect, so keep your eyes open or stay in the loop via our newsletter.

To conclude

The Clinical Evaluation phase can be a very daunting process, but by paying close attention to the regulatory requirements and making sure that your SaMD has a good and thorough QMS, you will be able to pass the Clinical Evaluation phase with flying colours. By using Extra Horizon’s ready-made, already-compliant medical BaaS, you will relieve yourself of even more pressure during the process. To find out more, please do not hesitate to get in touch.

ISO 13485:2016: Thirteen Boxes to Tick on the Path to Certification

Wed, 27 Apr 2022 15:08:37 GMT

In this ebook, we will dive into the ISO 13485:2016 standard for Quality Management Systems, through a series of key checkboxes that you can tick on your path to certification.

The goal of this ebook is to help you understand what ISO 13485:2016 is all about, why it is important, and how you can take the necessary steps to achieve ISO 13485:2016 certification for your digital health solution.

Conference recap: a knowledge sharing event between 4 companies

Fri, 01 Apr 2022 10:25:41 GMT

On Friday 25th March, Extra Horizon co-hosted a mini-conference at the Corda Campus in Hasselt, Belgium. As well as Extra Horizon, three other software development companies were present; Prato HR, Kunlabora, and Hootsuite. This conference was an opportunity for the companies to share technical and software-related knowledge, as well as gain fresh insights from one another.

Four engaging and interesting presentations took place, led by both Extra Horizon and the attending companies.

Read a brief summary of the presentations below:

1. Challenges when developing Software as a Medical Device. Kobe Leysen, Chief Technical Officer at Extra Horizon

Developing software as a medical device comes with many challenges, with the ultimate aim being to deploy your product to market in good time and with confidence. However, human lives can be at risk when developing medical device software. For this reason, you must pay close attention to complying to regulations, implementing a quality management system, and performing clinical studies of your product. This can make it harder to get your product, and any new features, onto the market.

Kobe Leysen explained how developing medical software differs hugely from traditional software development, using our customer FibriCheck as a case study.

2. Segregating customer infrastructure in medical backends. Christopher Hex, Product Owner at Extra Horizon

As Extra Horizon provides a backend for medical applications, keeping customer data separate is a top priority. This is why we deploy dedicated backend environments for each customer. Christopher Hex explained how we leverage AWS Organisations and Terraform, in order to properly segregate customer information in a maintainable way.

3. Serverless, Kunlabora.

Kunlabora, a Leuven-based software development company, gave a presentation about the benefits of serveless technology, such as Amazon Web Services (AWS), for their applications.

With Kunlabora having applied serverless technologies to their projects for many years already, they explained how to use the serverless framework to build successful applications, useful techniques to solve integration use cases, and how AWS can be used as an alternative to the serverless framework.

4. Microservices from the trenches, Prato HR

Prato HR, a developer and supplier of HR software and services, talked about their microservices architecture. This architecture forms the basis of their payroll engine, which was developed over 4 years ago.

In this session, we found out why Prato HR chose microservice architecture, the advantages and disadvantages of this choice, how they organised their teams, and the organisational and architectural lessons learned in the process.

5. GraphQL, Hootsuite.

Hootsuite, a social media management tool, explained what GraphQL is and how you can implement GraphQL into your API, as well as the common pitfalls of GraphQL. Using themselves as a case study, Hootsuite explained how GraphQL aggregates data from their microservices before displaying it in their web application.

We are very pleased that our first internal mini conference was such a success! We are really looking forward to continuing to share our expertise with other companies, whilst also receiving theirs in return.

FibriCheck, built with Extra Horizon at its core, has received a 100/100 score for the DTAC

Tue, 29 Mar 2022 10:30:14 GMT

FibriCheck, a pioneering digital health app that enables users to check their heart rhythm with their smartphone, recently received the top score of 100/100 in the DTAC.

FibriCheck is just one example of the digital health solutions that uses Extra Horizon’s medical Backend-as-a-Service (BaaS) in the core of their product.

What is DTAC all about?

DTAC stands for Digital Technology Assessment Criteria for health and social care. DTAC was developed by NHSX; a government unit in the United Kingdom that drives the digital transformation of health and social care. The DTAC is a new advisory assessment criteria for commissioning digital health technologies. Essentially, it helps developers understand what it takes to make their digital health solutions suitable as an offering to the NHS.

DTAC was developed in response to developers and those making buying and commissioning decisions, looking to NHSX for clear direction on how to build and buy high-quality digital health technologies. By listening to those who were seeking to understand what the NHS is looking for when it comes to buying technologies, NHSX developed DTAC to help companies incorporate this criteria into their product development ‘by design’.

DTAC is not currently mandatory, but it brings together legislation and recognised good practice into one place - something that is very important in the medical startup field.

What is the purpose of DTAC?

DTAC aims to ensure that digital health applications meet the high NHS standards that patients deserve, with regards to clinical safety, data protection, technical security, and usability and accessibility standards.

For developers, DTAC sets the standard for what is expected to enter into the NHS and social care field.

How FibriCheck got scored for the DTAC

FibriCheck underwent a self-assessment, which was then subjected to an external review by Orcha; an external company that provides digital health assessments and certifications.

The assessment criteria focuses on 5 core areas.

1. Clinical Safety

Products are assessed to ensure that baseline clinical safety measures are in place, and that organisations undertake clinical risk management activities to manage the risks.

2. Data Protection

Products are assessed to ensure that data protection and privacy is ‘by design’ and the rights of individuals are protected. Essentially, making sure that the protection of patient data is not an afterthought.

3. Technical Assurance

Products are assessed to ensure that products are secure and stable.

4. Interoperability

Products are assessed to ensure that data is communicated accurately and quickly, whilst staying safe and secure at the same time.

5. Usability and accessibility

Products are allocated a conformity rating, having been benchmarked against good practice and the NHS service standard.

Areas 1 through 4 are assessed on a pass/fail basis. For area 5, a combined percentage score is given.

How did Extra Horizon’s Medical BaaS help achieve this 100/100 score?

Regulatory certifications

FibriCheck was built with Extra Horizon’s medical BaaS at its core. Thus, a great deal of the regulatory burden is already taken care of. This is because our medical BaaS is certified to a wide-range of regulatory standards, such as ISO 13485:2016, ISO 27001:2017, and ISO 27701:2019, as well as being compliant with GDPR and HIPAA. In the context of the DTAC, this helped FibriCheck to achieve a passing grade in the Data Protection criteria, as it ensures that Data Protection is an integral feature of their digital medical solution.

In particular, our compliance with the ISO 13485:2016 standard helps tremendously with the Clinical Safety criteria, as this standard specifically addresses the manufacturing of medical devices, including safety criteria.

Safe and secure cloud-based platform

With digital health solutions such as FibriCheck, data often needs to be communicated from one platform to another. For example, from the patient’s smartwatch to the device of a doctor or other clinician. Therefore, it is extremely important that your solution is as secure as possible, to avoid possible data breaches and to reassure patients that the device or service will store their personal data securely. By using our medical BaaS as opposed to one that was made in-house, users are ensured that FibriCheck is built on a tried and tested, secure platform, which will handle their data safely. This feature of our medical BaaS is what helped FibriCheck pass the Interoperability criteria, ensuring easy yet safe communication of patient data.

How can Extra Horizon help your organisation with the DTAC?

By choosing to work with the Extra Horizon medical BaaS, you can relieve a huge amount of pressure if you need to adhere to the DTAC somewhere down the line. It will increase your chances of scoring a staggering 100/100 on the assessment, just like FibriCheck did. Our already-compliant, safe and secure medical BaaS will help you tick every box on your way to adhering to the DTAC. To find out more, request a demonstration, or take a look at our insights.

The 6 Essentials To Building A Successful Digital Health Application

Wed, 16 Mar 2022 13:41:07 GMT

This ebook explores the 6 essentials that digital health companies should ensure they have in place in order to build and successfully deploy their product. The ebook features the example of FibriCheck , a heart-monitoring start-up now with over 800,000 users across 40 countries, which is built on the IEC 62304-compliant Extra Horizon platform.

How does ISO 13485 compare to ISO 9001?

Tue, 08 Mar 2022 14:01:45 GMT

When developing a medical device, it is essential to build a strong quality management system (QMS). When building your QMS, it is of utmost importance to adhere to the relevant national and international regulatory requirements. In the context of quality management, the two main ISO standards are ISO 9001 and ISO 13485. Although ISO 13485 is based on ISO 9001, it is important to remember that there are considerable differences between the two standards.

In this blog, we will explore their similarities and differences, to help you decide which standard is best for your digital health solution.

What is a Quality Management System (QMS)?

A quality management system (QMS) is a formalised system that documents the relevant processes, procedures and responsibilities for meeting the regulatory and customer requirements related to the product. A good QMS helps a company ensure that continuous improvements are made to their products and services, provides a baseline for training staff, and enables correction action to take place for any problems that arise.

Where a certified QMS is generally a validation of good practice, in a regulated market such as the medical device field, it is also mandatory. Having a good QMS is your first step towards bringing a compliant solution to the market. It also helps tremendously with compliance, which is very important if you are active in the digital health industry, where adherence to regulations is mandatory in order to protect patients and their data.

Read more about the importance of building a strong QMS here .

ISO 9001 vs. ISO 13485

ISO 9001 is an international standard for quality management systems. It is not specific to the medical device sector, and can be applied to any kind of organisation. The current version was published in 2015.

ISO 13485 is a quality management standard specifically for the design and manufacturing of medical devices. The current version was published in March 2016.

How are the two standards similar?

First and foremost, ISO 9001 and ISO 13485 both strive to achieve an effective quality management system.

Here is how ISO 9001 and ISO 13485 are alike:

Both standards strongly feature risk management, in which risks are assessed and subsequently minimised.
They have a common emphasis on having properly-trained staff and a robust infrastructure in order to ensure overall quality and safety.
Both standards provide a foundation for creating quality products by taking into account the customer’s opinions and requirements.
The two standards are based on the same cycle model, which is called the PDCA (Plan-Do-Check-Act) cycle. The PDCA is a 4-step quality improvement model that enables continuous enhancements to a product or service.

So, how do ISO 13485 and ISO 9001 differ?

1. The general idea…

ISO 9001 is a general standard for any type of organisation, regardless of industry. ISO 13485, however, is specifically for the design and manufacturing of medical devices, as it contains additional requirements for the medical device industry. One example here is the keeping of documentation and the control of records.

2. Different requirements

Although both standards take customer satisfaction into account, each standard approaches this factor differently. ISO 9001 focuses on customer needs as a measure of quality, without additional requirements related to things such as contamination control. In contrast, ISO 13485 has more in-depth specifics, such as the validation of processes, equipment, cleanliness, and risk management. Thus, ISO 13485 places greater emphasis on the safety and efficacy of medical devices.

3. Management roles

Each different ISO standard has different requirements in terms of how roles are defined within an organisation. With ISO 9001, there are no specific staffing requirements, and the management team can assign responsibilities without defining roles. ISO 13485 specifically states that organisations must identify a member of the management team to be responsible for the QMS.

4. Documentation

ISO 9001 requires documentation to be kept about the QMS processes, whereas the document requirements for ISO 13485 are much more stringent. ISO 13485 additionally asks for documentation such as product specifications and installation and maintenance processes, in addition to the description of processes also required in ISO 9001.

Does your organisation need both certifications?

It never hurts to have an ISO 9001 certification, as it is the widely-accepted quality standard across all industries. However, when building a medical device, not being compliant with ISO 13485 may prevent you from entering the market, especially if you need to get a CE or FDA approval.

Partnering with Extra Horizon will make you sleep better at night. Not only do we understand your compliance challenges through our experiences with all of our other clients, but Extra Horizon is also an ISO 13485-certified organisation. This means that we are already implementing all of those processes, procedures, and documentation initiatives, which in turn gives you the benefit of Extra Horizon being a trusted supplier. You will not even have to think about the regulatory aspects of everything that we have built for you.

Galenus Health: a digital health solution for respiratory conditions

Wed, 16 Feb 2022 09:55:21 GMT

The mission of the Galenus Health app is to help patients to achieve a better quality of life, support doctors in their daily clinical practice, and to set up research activities. Galenus Health noticed that there is an unmet need for real-life data in this domain.

Sven Seys

Co-founder and Digital & Research Lead

Galenus Health

“Galenus Health has created a digital healthcare solution to monitor symptoms and treatment in patients with respiratory conditions. Galenus Health was founded in 2019. Today, our class I product has been launched, and the class IIa preparations are ongoing.”

Galenus Health is a fully-functional product with mobile and web-based interfaces . It functions as a symptom and care pathway tracker, a way to manage treatment adherence, and an unbiased, medically validated tool for personalised patient education. Galenus Health is a horizontal solution that can function solely for the patient (user), and can also be linked to a physician to enable them to follow-up with their patients.

Galenus is one of very few applications that has been developed together with leading doctors in the field . It forms the basis of an international outcome registry for chronic rhinosinusitis. As such, there is a huge potential to scale the application across Europe.

Currently, the Galenus Health application is available in 8 countries ; Belgium, the Netherlands, Germany, Austria, Finland, Norway, Denmark, and the UK. They are also starting new initiatives in Sweden, France, Spain and Italy. Galenus Health is also active in up to 25 academic centres and several non-academic centres.

What was the problem?

In the digital health field, regulatory compliance is extremely important. Galenus Health was faced with meeting the new MDR guidelines . Additionally, after the initial launch through EMEA, Galenus Health aspires to enter into the Canadian and US market in the next 3 years. Building a solution with global regulations in mind, such as HIPAA and FDA compliance, is crucial for its success.

Achieving regulatory compliance can be a long and difficult process . The time it takes to achieve compliance generally causes the biggest delay in the time it takes to get the product to market. This, in term, can lead to less traction when initially entering the market.

Why did they choose to work with Extra Horizon?

Extra Horizon has a proven track record when it comes to bringing medical applications to market. We have a strong regulatory foundation, with our medical Backend-as-a-Service (BaaS) being GDPR and HIPAA compliant from a Privacy and Security perspective, and also operating under the necessary ISO certifications for building Medical Software, following the IEC 62304 standards. Using a medical backend supplier that already has the necessary certifications, like Extra Horizon, does not mean that a company becomes automatically certified. However, it does mean that it is easier and quicker for a company to achieve their own certifications, as did Galenus Health.

How do they benefit from working with Extra Horizon?

Galenus Health was built with our medical BaaS at its core. This covers the necessary privacy and security requirements , and helps create the foundation for building a Class IIa regulated device.

Galenus Health had discussions with Extra Horizon’s Chief Compliance Officer, Jo van der Auwera, who helped bring the regulatory compliance requirements to a successful conclusion. As the Extra Horizon backend is built according to MDR requirements, this means that all documentation is MDR compliant . This includes all documentation concerning requirements and testing records, Data Processing Agreements, and versioning and end-of-line record keeping.

Although Galenus Health also needed to achieve their own regulatory certifications, this process was much quicker since the bulk of the underlying building blocks of their solution is already certified by a Trusted Supplier .

What is the added value?

The main benefit of working with Extra Horizon is that the solution was ready to launch in less than 9 months . As Galenus Health was built on Extra Horizon’s compliant medical BaaS, this meant it was quicker and easier for Galenus Health to achieve their own regulatory compliance certifications.

Without this compliant backend, the process to become certified as a medical device would have taken much, much longer. This is because our backend already covers the necessary privacy requirements and provides a foundation for building a Class IIa regulated device . From day one, your system is already built with scalability in mind by a dedicated team of experts. This removes a lot of design anxiety and helps to achieve your end goals more efficiently.

The speed of this process is what ultimately allowed Galenus Health to become active in so many different countries so quickly.

Why working with Extra Horizon is the way forward for Galenus Health

A cloud-based platform means that there is no longer a need to install and maintain software solutions on the premises. This offers a flexible and secure dashboard solution for the doctors who use the application, which can be used from anywhere at any time.

Some hospitals were initially suspicious of cloud-based solutions, but the secure, ISO compliant backend provided by Extra Horizon reassured users that the platform is safe and secure for collecting patient data. This enabled hospitals to harness the power of the cloud for their benefit.

Want to learn more about our solutions?

Send us a message with your question(s)!

Why Medical Device Startups Need to Build a Strong Quality Management System Foundation from Day One

Thu, 10 Feb 2022 12:20:08 GMT

Establishing a medical startup is a challenging and risky process. A lot of things can go wrong, particularly at the beginning. Hence, it is important for startups to pay close attention to the formation of their policies, procedures, and documentation, in order to minimise the chance of delays in your regulatory readiness for clinical trials and time to market. In order to do all of the above things successfully, startups must implement an effective QMS, or at least the foundation for a good QMS, from the very beginning.

What is a Quality Management System (QMS)?

A Quality Management System is a formalised system that documents the relevant processes, procedures, and responsibilities for meeting the customer and regulatory requirements related to a product. This information applies to the initial delivery of the product, as well as any post-delivery activities, such as addressing customer feedback and complaints. The QMS focuses on ensuring continuous improvements in effectiveness and efficiency. In medical software development, this can include the execution of internal audits to identify areas of improvement, providing a baseline for training staff, and enabling corrective action for any problems that arise.

Quality Management Systems are more than just proper documentation. They are first and foremost there to guarantee the safety of people and the environment, and in the medical space, specifically the safety of the patients.

What are the regulatory foundations of a QMS?

There are two main ISO standards that are used as the basis for a QMS. These are ISO 13485, and ISO 9001. ISO 9001, which was last reviewed in 2021, is a generic standard that specifies QMS requirements for any type of organisation.

So when does ISO 13485 come into play?

ISO 13485 becomes relevant when dealing with medical devices. Published in 2016, it acts as a stringent QMS standard specifically for medical devices.

Having a compliant QMS is also one of the requirements under the EU Medical Device Regulations (MDR), which came into effect on 26 May 2021. All medical device manufacturers and distributors in the EU have to comply with the EU MDR, including those that produce self-certified Class I devices

The steps you, as a medical device startup, will probably need to take:

First, you must form your multidisciplinary team. This should include some team members who are responsible for quality management, such as the Quality Manager. It is very important that employees with a thorough knowledge of Quality Management are involved in this process.
Create a detailed plan for setting up the QMS. Identify which processes and procedures are needed, based on the relevant regulations, customer requirements, and any additional requirements defined by the organisation itself.
Now, you can start constructing your QMS. Create detailed standard operating procedures (SOPs) for these processes and procedures. The system documentation must be created, including the organisational structure, the quality policy, the quality objects, risk management, and the manufacturing process, testing, and validation. You should also create a Design History File (DHF). These documents will form a process map for your organisation.
Start implementing the processes and procedures. All employees that have to follow these processes and procedures must be trained on the SOPs. Make sure to collect feedback from the people who use them, and use this feedback to make changes if necessary. Any changes must be communicated to the relevant personnel.
Execute the first internal audit. This is typically done by a third party. Any issues discovered during this internal audit should be used as the basis for any improvements.
Next, a management review meeting should take place. This ensures that the top management are involved by evaluating the performance and adequacy of the QMS.
An external body, notified body, or consultant then performs an external audit of your QMS. Any issues identified by the external audit can then be resolved.
After all major issues have been addressed, the certification can be granted.

Even after certification, your QMS processes and procedures should be continually monitored, with improvements being made when necessary.

How a well-implemented QMS can be beneficial to medical device startups

A well-implemented QMS is hugely beneficial to any startup. As a QMS provides a strong foundation that directs and documents the startup’s activities, it helps tremendously with compliance, especially when achieving regulatory certifications. This is because a lot of the documentation needed to meet certain regulations is already available in the QMS. This saves valuable time and money - two things that can often be in short supply when establishing a startup.

The QMS also provides a useful training baseline for current and new employees. This helps the management team remain accountable, as it makes sure that every employee hired has the appropriate skills and training, including a thorough knowledge of the startup’s procedures and processes. The QMS also helps eliminate unnecessary activities and closes gaps in performance, thus improving overall efficiency and saving precious time.

Why must startups start building the foundation of their QMS from day one?

Startups should establish a QMS as early as possible in their development process. Having detailed documentation about the processes of the business and why decisions were made is extremely important. When a startup is only just beginning their activities, the environment can be very rapid and unregulated, due to the high-risk and flexible nature of most startup environments. This can mean that the reasons for decisions can be lost or forgotten. The thorough documentation provided by a QMS means that this issue is avoided, and the product quality is not compromised as a result. In a startup space, this can secure the long-term existence of a company on the market, and ensure that the product is safe and reliable.

Not beginning to establish a QMS from early on can have a significant impact on your operations. This is because as development progresses, there is less time available to dedicate to forming a QMS, as other tasks will become a priority. Furthermore, startup teams can find it hard to adapt to new processes further down the line, as this can cause huge and difficult changes in the working culture. Thus, starting to build the QMS from day one saves having to play catch-up later in the development process, therefore saving time and keeping a consistent working culture. Establishing a QMS from the start will most certainly have its benefits down the line, especially during the auditing phases your company will go through.

You'll be happy to know that by building your solution on Extra Horizon as a certified supplier, large chunks of the Design and Manufacturing documentation will no longer be yours to worry about. To find out more, request a demonstration here, or have a look at our insights.

5 Reasons Why The In-House Development Of IVD Software Often Backfires

Tue, 18 Jan 2022 13:52:56 GMT

With the use of software in the IVD space, we are able to digitise measurements, share results, process data, and create workflows for remote care and monitoring, which is pivotal in the future of digital healthcare. If you are using IVD software, it is very likely that you'll need a cloud solution for storage, managing your processes, and computing results. Developing such a system in-house has risks and can backfire.

Below, we are going to explain why this happens. Although it may seem like a good idea to develop your own software in-house, we will explore why it is fundamental to have a tried-and-tested medical BaaS at the basis of your product.

Increased time to market

Developing IVD software in-house takes a lot of time. Not only do you need to program the backend from scratch, but you also need to make sure that the software is compliant to the various data regulations. The process of becoming compliant to these regulations is time-consuming, and often ends up delaying the time it takes to get the product to market.

It is essential for IVD software to be IVDR compliant . This new regulation, which came into force on 26 May 2017 and will be in effect as of May 2022, is much more stringent than the previous In Vitro Diagnostic Directive (IVDD). All IVDs manufactured with a CE mark will be affected by the IVDR and its corresponding new risk classification. Using our medical BaaS will relieve the pressure of meeting these regulations of this big upcoming change.

Extra Horizon has a strong regulatory foundation. We have all the company-level certifications you, as a digital medical solution company, would dream of ( ISO13485 :2016 , ISO27001 :2017 , ISO27701 :2019 and so on). Our medical BaaS is also the perfect fit regarding the GDPR and HIPAA data protection laws. On a product and process level, the Extra Horizon medical BaaS helps to enable our customers to achieve CE (MDR, IVDR), FDA, TGA and other local approvals . As a result, this drastically reduces the time it takes to get to market, as there are less issues within the regulatory compliance space.

Additionally, using our medical BaaS will save time on finding and educating an entire team to produce the software in-house. Recruiting and training a team of skilled developers takes up a lot of valuable time. Therefore, using a readily-available medical BaaS, such as Extra Horizon’s, saves precious time and gets the product to market much quicker.

High and unexpected costs

Although getting into the market in time is very important, having a cost-efficient solution, especially in the early stages, is very important as well. Developing IVD software in-house can often result in unpredictable and unexpected costs . This is because in-house software is not always able to cope effectively with unexpected issues. If you make wrong decisions in the start of your IVDR journey, it might become a very expensive ordeal in the end.

High quality IVD software can usually compensate for any potential system malfunctions. If the IVD software is built in a flexible and sophisticated way, such as by using a medical BaaS like ours, the system should be able to deal with these issues by itself. However, if the software cannot cope, additional costs can be incurred from the additional error handling.

Therefore, leveraging a tried and tested medical BaaS , as opposed to building one from scratch in-house, will reduce these unexpected costs and help you stay within your budget. When using Extra Horizon’s BaaS, you pay a fixed monthly license fee, so the costs are predictable and there are no hidden surprises.

Lack of thorough documentation

As well as keeping the budget under control when developing IVD software, it is extremely important to keep a meticulous documentation record. This is very important for adhering to the In Vitro Medical Devices Regulation (IVDR) , for which all technical documentation is required.

Also, should a data breach occur, keeping a detailed log of everything enables you to see the exact extent of the damage. The documentation will allow you to see the cause of the breach, whether that be simply an error made by an employee, or a hacker who managed to access the backend.

Therefore, in-house development of IVD can lead products to be more vulnerable to data breaches, and can make it hard to establish the reasons for a data breach. Thus, it is in the best interests of a company to use a sophisticated medical BaaS, like Extra Horizon, to make sure that everything is recorded properly.

Lack of scalability

In addition to keeping thorough documentation, it is important to keep up with the constantly-evolving healthcare industry and adapt to changing patient needs, as well as the increased usage of medical applications. Therefore, IVD software needs to evolve fast to keep up with the newest developments and increased user capacity.

These updates and changes need to be made quickly and easily, in order to keep up with the fast-changing industry. In-house developed IVD software often lacks the flexibility to be scaled up and down as necessary, which means that developers will be forced to start from scratch again. By using a medical BaaS, software can be scaled up to address new trends and increased usage with relative ease, saving valuable time.

Updates are slower and it's more difficult to adapt to new challenges

Next to making sure your software can be scaled appropriately, it is extremely important that the software remains up to date and able to handle new challenges, as IVD software products normally stay on the market for a long time. Therefore, new processes and methods need to be continually incorporated as new best practices become available. If this does not happen, the software can become outdated very quickly.

With technological advancements taking place daily in the digital medical landscape, most medical solutions will need to be connected with electronic health records (EHR) at some point in time. Making sure that your cloud-based IVD solution can be compatible with HL7 (Health Level 7) and FHIR (Fast Healthcare Interoperability Resources) is, therefore, one of the key aspects not to overlook when building a future-proof and scalable solution.

The problem with in-house solutions is that they are generally made to fulfil just one purpose, and are therefore not very adaptable. This makes it hard to adapt the software to the ever-changing new best practices of the IVD space. By using Extra Horizon’s medical BaaS , you do not need to worry about software becoming outdated, as our backend is highly adaptable and updates are rolled out quickly and easily.

To see for yourself how using Extra Horizon’s tried-and-tested medical BaaS can be the answer you need for your IVD software, contact us here .

Extra Horizon is now listed as a trusted provider in the EU Cloud Code of Conduct

Mon, 10 Jan 2022 15:11:16 GMT

We are pleased to announce that we are now listed as an official cloud service provider in line with the EU Cloud Code of Conduct (CoC), demonstrating our commitment to providing a safe and compliant cloud backend environment to our customers.

This announcement comes after a thorough review by the EU Cloud CoC’s Monitoring body, where our medical Backend-as-a-Service was verified as being compliant with the security and data protection requirements of the EU Cloud CoC.

What is the EU Cloud Code of Conduct (CoC)?

The EU Cloud CoC aims to help cloud providers, such as Extra Horizon, on the path to achieving GDPR compliance. The EU Cloud CoC consists of a set of requirements that cloud service providers have to meet in order to comply with the GDPR . It is a code that covers the whole of Europe, addressing the obligations of all cloud providers under the GDPR, thus supporting data protection and transparency across the EU.

The list of adherent services to the EU Cloud CoC, which now includes Extra Horizon, can be found here .

How does this benefit our customers and partners?

As a provider of a medical Backend-as-a-Service (BaaS) , we are obliged to meet a number of compliance and data protection regulations, including those under GDPR. Using our regulated platform allows you to focus your attention and resources on your application, confident in the knowledge that your infrastructure is - and remains - GDPR compliant.

As our medical BaaS has been proven to meet the security and data protection requirements as defined in the EU Cloud CoC, this reassures our customers that our medical BaaS is safe, secure, and compliant with the GDPR. This also makes it easier for our customers to achieve their own regulatory compliance, as they are using a backend that is already compliant with the GDPR.

We are proud to be recognised under this reputable and trustworthy code of conduct. Extra Horizon has been verified to be compliant with the EU Cloud Code of Conduct (EU Cloud CoC). Please visit the Public register and report (with verification ID 2021LVL02SCOPE318) on the EU Cloud CoC website. Read more about the EU Cloud Code of conduct here .

FibriCheck: a case study in the global scaling of a digital health app

Sat, 01 Jan 2022 10:52:59 GMT

FibriCheck is a pioneering digital health app that enables users to quickly and simply check their heart rhythm with their smartphone and get immediate and actionable results. The app is medically certified and trusted by clinicians around the world.

Currently FibriCheck has over 700,000 users across 40 countries . More than 6 million PPG recordings have been made with the app, and more than 40,000 cases of arrhythmia have been detected – thereby helping to prevent strokes and save thousands of lives.

The speed at which Fibricheck was developed and brought to market, and the app’s continuing fast pace of growth, is made possible by use of the IEC-62304 regulatory compliant cloud infrastructure and General Data Protection Regulation ( GDPR )-safe data storage of our Extra Horizon medical Backend-as-a-Service.

The Extra Horizon platform has played a key role in helping FibriCheck meet the strict compliance issues that apply to medical software and has allowed FibriCheck to stay ahead of the curve - creating a sophisticated medical solution that pushes the conventional boundaries of digital health.

Creating a scalable SaMD solution

Scaling a Software-as-a-Medical-Device (SaMD) solution requires a solid foundation and an infrastructure that can grow with the app and accommodate necessary changes along the way.

It’s essential to set up and manage the technical domains (such as development, scaling, DevOps) whilst ensuring ongoing compliance with the varying regulatory requirements of different territories.

Extra Horizon was able to provide the entire backend (or technical framework) for the FibriCheck heart rhythm monitoring app, and ensure full compliance with the many strict and complex regulations applicable to digital health solutions.

By supplying a medical backend as a service , Extra Horizon accelerated FibriCheck’s technological readiness, and by taking on most of the burden of regulatory compliance significantly reduced the level of investment risk for FibriCheck.

Want to read more?

Download the full case study here!

Any questions?

Send us a message with your question(s)!

Extra Horizon: 2021 end-of-year recap!

Thu, 16 Dec 2021 12:28:38 GMT

In 2021, Extra Horizon’s activities have continued to expand rapidly. With our list of reputable customers and partners increasing, and with Extra Horizon achieving more regulatory certifications, we are asserting ourselves as a leading figure in the digital health sector.

Revolutionising COVID-19 testing

Extra Horizon’s backend cloud infrastructure was chosen by ams OSRAM , a leading worldwide supplier of high-performance sensor solutions, to power a range of innovative point-of-care spectral sensor-based solutions. In particular, for their spectral sensor-enhanced lateral flow test; an easy-to-use, lab-free COVID-19 testing solution which produces highly reliable results in only 15 minutes. The collaboration between ams OSRAM and Extra Horizon in response to the COVID-19 pandemic was instrumental in providing fast and accurate testing in the interest of safeguarding public health.

Further expanding our regulatory framework

We have also considerably expanded our regulatory certifications, by achieving 4 additional certifications: ISO 13485 :2016 , ISO 27001:2017 , ISO 27701:2019 , and the Cyber essentials certification. With regulatory compliance being a fundamental part of any digital health solution, achieving these certifications allows us to fast-track our customers with achieving their own regulatory compliance, saving them time and money in the process. Our high profile clients, including Senova and ams OSRAM, benefit from our thorough regulatory compliance.

Moreover, we enhanced our position as a trusted name in the cloud industry by becoming a member of The EU Cloud Code of Conduct’s General Assembly . Being part of this important initiative gives us the opportunity to contribute to the international alignment of cloud-related data protection standards.

Jo Van der Auwera

Chief Compliance Officer

Extra Horizon

“Extra Horizon’s mission is to drive the digital transition of the healthcare industry and reshape the future of healthcare. Being part of the EU Cloud CoC’s initiative brings us closer to accomplishing our mission and further enhances customer’s trust.”

Supporting the fight against COVID-19

In collaboration with the leading in-vitro diagnostics manufacturer Senova , Extra Horizon’s secure and compliant medical BaaS was chosen for use in Senova Greenlight; a groundbreaking new user-friendly digital COVID-19 rapid test. Senova Greenlight takes lateral flow test results and processes and analyses them in real time, providing much-needed fast and accurate test results.

Our proven medical backend was pivotal in accelerating the time it took to get this innovative solution to market. This powerful weapon in the global fight against COVID-19 has enabled quick and accurate testing, complete with the secure and reliable processing of information. This was all possible thanks to our secure and compliant medical BaaS, which set the foundation for fast, efficient, and secure data processing.

New collaboration with Henkel Printed Electronics

We also joined the ecosystem of partners of Henkel Printed Electronics , to provide the certified backend platform for advanced healthcare applications in printed electronics. With Henkel’s high expertise in medical-grade wearable solutions and smart patches, this new partnership sees Extra Horizon help accelerate the growth and innovation of digitisation in healthcare. Our tested and proven medical BaaS helps Henkel to adhere to strict medical device regulations in both Europe and the US, and enables fast launches and easy upscaling.

Lars Grieten

CEO

Extra Horizon

“A collaboration with a leading global player such as Henkel will broaden our international growth and network. Combining our strengths, we cover critical elements in the value chain for MedTech and digital health companies and are able to support end-to-end solutions. Together, we’re well positioned to support and accelerate the rapid growth MedTech/Digital Health solutions are undergoing”.

With our tested and proven medical BaaS being the ideal solution for the ever-evolving digital health space, we persist to become more and more renowned in this dynamic and exciting sector, with high aspirations for 2022. So keep your eyes peeled for more exciting things to come next year. Cheers!

Extra Horizon's statement on Log4j vulnerability

Tue, 14 Dec 2021 13:13:53 GMT

Extra Horizon is aware of the Log4j zero-day vulnerability in the Java logging framework. This vulnerability is being tracked as CVE-2021-44228 1 / 2 and currently has the highest severity score [10/10]. Therefore our technical team immediately started an internal investigation, on Saturday, December 11th.

The team confirms that customers and their data are currently not affected by this vulnerability.

During this investigation we have confirmed that although Java is used in our application, none of the services of Extra Horizon are currently using Log4j as its logging mechanism. The CVE 3 does not have an effect on the Extra Horizon codebase and remediation is not needed.

We are currently monitoring all our 3rd party service suppliers to ensure that their services are also not impacted and are patched immediately where needed.

If you need additional details or assistance, please contact the Extra Horizon technical support team at requests@extrahorizon.com .

At Extra Horizon, we have always had and continue to have the highest standards when it comes to customer data security.

https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-44228
"CVE is the common term that stands for “Critical Vulnerability and Exposures”

MDR and IVDR - Are they a threat or an opportunity for your medical product?

koen.schoofs@extrahorizon.com (Extra Horizon) — Tue, 26 Oct 2021 11:01:46 GMT

The Medical Devices Regulation (MDR) has been in force since May 2021. The In Vitro Diagnostic Medical Device Regulation (IVDR) replaces the IVDD (In Vitro Diagnostic Directive) on 26 May 2022. Both place significant new regulatory requirements on device manufacturers, which are more comprehensive and far-reaching than the Directives that they replace.

In particular, the new Regulations seek to increase transparency and bring EU legislation in line with technological advances and progress in medical science – recognising the increasing role and importance of digital technologies and use of ‘software as a medical device’ within the MD and IVD space.

But if you are an existing device manufacturer, or a new technology company seeking to enter the market, should you see this additional regulatory burden as a threat or an opportunity?

What is the MDR?

In imposing stronger rules on medical devices, the MDR seeks to establish a modern and more robust regulatory framework to protect public health and patient safety.

Specifically, the MDR aims to improve the quality, safety and reliability of medical devices, with tighter controls on certification; strengthen transparency and information for patients, so that vital information is easy to find; and enhance vigilance and market surveillance – once devices are available on the market, manufacturers must collect data about the devices' performance.

The MDR revises the classification of medical software products, including the introduction of a high risk software class. In addition, standalone software is (for the first time) classified in its own right as a medical device if the software fulfils a medical purpose. This applies whether the software is being used in a clinical setting or not.

Many software solutions that were Class I under the MDD are reclassified Class II or higher under the MDR. This includes almost all software 'intended to provide information that is used to take decisions with diagnosis or therapeutic purposes.'

This higher classification requires digital health companies to put in place a Quality Management System (QMS) that includes, for example, processes and procedures for clinical evaluation, post-market surveillance (PMS) and post-market clinical follow-up (PMCF) for every product. The QMS will be assessed as part of the MDR conformity assessment conducted by a Notified Body – a QMS to ISO 13485 :2016 is the generally accepted standard (see further details later in this article).

What is the meaning of IVDR?

In vitro diagnostics (IVDs) are broadly defined as non-invasive tests used on biological samples (for example blood, urine or tissues) to determine the status of a person’s health.

The EU IVDR replaces the current In Vitro Diagnostic Medical Devices Directive (IVDD), introducing new regulatory requirements that are more rigorous, more complex and more far-reaching than those of the IVDD. For example, the IVDR:

Increases monitoring by Notified Bodies and Competent Authorities
Tightens requirements for clinical evidence and conformity assessment
Requires significant upgrades in technical documentation and quality management system
Introduces a risk-based classification system, under which IVD devices are placed in one of four risk categories, from class A (lowest risk) to class D, the highest risk
Broadens the definition of an IVD to include, for example:
tests intended to predict a medical condition or a disease
software
companion diagnostics (those required for the safe and effective use of a corresponding medicinal product)
devices for ‘near-patient’ testing (devices designed for use by health professionals but outside a laboratory environment)

The IVDR also places emphasis on the lifecycle management and continuous evaluation of products through an effective quality management system.

Monitoring throughout the lifecycle

For both MDR and IVDR, manufacturers must demonstrate their products are safe and reliable not only before they are put on the market, but also throughout their lifecycle. Therefore, continuous and efficient monitoring and record-keeping is required.

Manufacturers need to have ready access to all data relating to use of their device in the market, with the analytics capability to promptly address any issues identified in postmarket surveillance and vigilance. The deadline for reporting incidents that did not result in death or serious impact upon health, for example, has been reduced from 30 to 15 days.

This can be seen as an opportunity to optimise development and management processes to stay ahead of competitors. For example, implementing a data management strategy that provides a complete view of data not only enables data-driven decision-making, but also helps with ongoing regulatory compliance.

Manufacturers are required to address all the steps needed, from requirements management and system architecture to unit, integration, and system-level testing and verification. State-of-the-art workflows for software development therefore provide not only competitive advantage but also contribute to sound quality management.

But establishing these backend quality processes can be costly and time-consuming. This is where a cloud supplier certified to ISO 13845:2016 can be a game-changer.

About ISO 13485:2016

ISO 13485:2016 was written to support medical device manufacturers in designing a quality management system (QMS) that establishes and maintains the effectiveness of their processes. It ensures the consistent design, development, production, installation, and delivery of medical devices that are safe for their intended purpose.

A QMS to ISO 13485:2016 is accepted as the basis for CE marking medical devices under European Directives and Regulations, and UKCA marking medical devices under the UK MDR. What’s more, ISO 13485:2016 has gained significant recognition around the world and its application extends far beyond Europe.

A quality management system based on the ISO 13485:2016 standard is an internationally accepted model for compliance to many laws and regulations of the medical device industry. The list of countries that require an ISO 13485:2016 compliant QMS includes the USA, Canada, Australia, Japan and Malaysia.

Seizing the MDR/IVDR opportunity with the Extra Horizon Backend-as-a-Service platform

The MDR and IVDR regulations raise the barrier for entry into the MD and IVD market. But for technology companies seeking to enter, or adapt to, the new market requirements, the regulatory landscape need not be a threat. Instead, it can be an opportunity.

You will be able to take advantage of the full power of cloud connectivity – with the assurance that the administrative burden and investment risk of MDR compliance of the platform is already taken care of.

You will have verification that your infrastructure is fully compliant with the MDR and IVDR, including the SLAs you need for a medical (and IV) device and the necessary documentation and procedures to enable the necessary ongoing quality assurance.

Don’t be held back in the new, more complex digital health landscape. Instead, find the direct route to market with Extra Horizon’s medically compliant cloud platform. Talk to us today.

With the certification in Cyber Essentials under our belt, alongside those in ISO 27001:2017 and ISO 27701:2019, we are well placed to keep working with NHS trusted partners

Wed, 25 Aug 2021 13:53:43 GMT

After recently obtaining both ISO 27001 :2017, which covers security management, and ISO 27701 :2019, on the management of privacy, we are pleased to announce that we have been certified under the UK’s Cyber Essentials scheme.

What is Cyber Essentials?

Devised and backed by the UK government, Cyber Essentials is a key standard that healthcare providers can meet in order to demonstrate that they have a robust set of cybersecurity controls in place.

The standard has been designed to help protect against 80% of all cyberattacks, and is a key part of the cybersecurity apparatus that organisations in the digital health space in the UK have been advised to have in place before the end of 2021.

Why does cybersecurity in healthcare matter?

Cybersecurity matters everywhere—but it is especially important across the entire digital health space, a fact that has recently been recognised with some urgency and not a little trepidation, as providers have seen the consequences of not having adequate protections in place.

The fact is, this space is a magnet for cyberattacks, for a number of reasons. Data on personal health is highly valued on the black market. And with ever-greater amounts of data going online, and health systems being stretched to capacity by the pandemic, it’s no surprise that hackers are having a real field day. The WannaCry attack on the NHS is just one example—there are scores of others. Cyber Essentials is part of the response to this urgent and evolving situation.

Jo Van Der Auwera

Co-founder and CRO

Extra Horizon

"This latest certification is one more feather in our cybersecurity cap—a further sign of our abiding commitment to data security and privacy."

Another brick in the firewall

To be awarded the Cyber Essentials certification, we had to show that we have a robust digital apparatus in place to protect against the most common cyberattacks. Among other things, this certification means that we can continue to do business with trusted NHS partners, while at a more general level, this certification complements our ISO 27001:2017 and ISO 27701:2019 certifications. It is another tool in our company’s arsenal against the increasingly sophisticated methods that hackers have been using to profit both from hijacking entire health systems and selling individuals’ data.

Extra Horizon has joined the EU Cloud Code of Conduct's General Assembly

Wed, 18 Aug 2021 11:16:11 GMT

PRESS RELEASE

Brussels, 06 August 2021– The EU Cloud CoC’s General Assembly proudly announces Extra Horizon as its newest member. Undoubtedly, this meaningful addition enhances trust in the cloud industry and contributes to international alignment under robust data protection standards.

The Code puts forward a comprehensive and reliable framework capable of responding to the specific needs of the cloud industry, allowing for interoperability, efficiency as well as the broader dissemination of cloud services.

Seeing and seizing the Codes benefits for Small and Medium-sized companies, Extra Horizon successfully joined the EU Cloud CoC’s General Assembly, in order to set a high default level of data protection in the digital health industry, which is one of the key drivers of the digital transition.

Jo Van Der Auwera

Co-founder and CRO

Extra Horizon

Jörn Wittmann

Managing Director

SCOPE Europe

“We strongly believe in the importance of fostering a wide and diverse membership in order to significantly contribute to the building of trust in cloud computing. In this spirit, we are proud and thrilled to welcome Extra Horizon to our initiative. As a digital health company focused on providing a regulatory compliant cloud infrastructure and GDPR safe data storage, Extra Horizon is a valuable extension and will certainly diversify and strengthen our working groups.”

GDPR and HIPAA for digital health apps: why it matters, and how to fast-track your route to compliance

Tue, 01 Jun 2021 11:19:56 GMT

Regardless of whether or not your company is based in the European Union (EU): if you hold or process personal data of European citizens, you must comply with the General Data Protection Regulation (GDPR).

The regulation, which is in effect in the EU since May 2018 (and at present continues to be applied in the UK as well), is aimed at strengthening both data privacy and data security, and gives EU citizens more rights relating to how their data can be used. GDPR also addresses the transfer of personal data outside the EU and the European Economic Area (EEA).

Accordingly, if your digital health app and/ or medical device collects personal data from individuals in the EU, you need to ensure GDPR compliance.

What is the difference between HIPAA and GDPR?

HIPAA (The Health Insurance Portability and Accountability Act, passed in the US in 1996) considerably predates GDPR, but GDPR has a much broader focus and legal implications. Businesses whose operations comply with HIPAA cannot assume compliance with GDPR - and, in fact, vice versa. Security is at the core of both regulations, but there are distinct differences between them.

For example, HIPAA standards apply only to ‘covered entities’, such as healthcare and insurance plan providers, and their business associates, for example IT providers or transcription services.

Furthermore, HIPAA only concerns PHI (Protected Health Information), which includes any personal health information that can potentially identify an individual, and which was created, used, or disclosed in the course of providing healthcare services.

GDPR, by comparison, applies not only to PHI, but also covers any information that can be used to directly or indirectly identify people in the EU - for example, information pertaining to political, cultural, or religious group affiliation.

In addition, GDPR applies to all organisations, regardless of sector, holding or processing personal data.

Explicit consent required for data processing

Explicit consent is mandatory under GDPR for the processing of personal health data (which is categorised as sensitive data). Article 9 of GDPR asserts a comprehensive scope, with limited exceptions. These exigent circumstances, i.e. where it is essential for the life of the data subject or that of another natural person, are just that - exceptional, and not standard business practice.

In contrast, HIPAA is less restrictive, allowing for the disclosure of personal data without patient consent for treatment purposes, securing payment, and in connection with the operations of a healthcare provider.

GDPR requires that you identify ALL data processing activities, not just disclosure. This includes, for example, data storage and transfer within an organisation. A legal basis must be established for each and every activity.

The right to be forgotten

HIPAA, along with most data privacy and security regulations, sets out the right of patients to receive copies of their own PHI held by the organisation. GDPR goes a step further to assure the rights of data subjects to be forgotten.

The timeframes around these procedures are explicit, and therefore need to be specifically addressed within the system design in order to ensure compliance. This is but one element, as system compliance requirements also extend to theft/ misuse, un/intended disclosure or breach, and erasure/ disposal of records.

You must have procedures and mechanisms in place to receive and reliably manage these process tasks so that, in the event of a request to be forgotten (i.e. for the deletion of personal information), it is possible to validate the request, and ensure the information is indeed deleted and no longer held anywhere in the system.

You also need to be able to manage related processes, for example to provide an individual with copies of their private data held by your organisation, along with the ability to edit data (and record and validate any changes) should corrections be necessary.

Mandatory Data Protection Impact Assessments

Under GDPR it is not enough simply to have the systems in place to meet the regulatory requirements, you must be able to demonstrate that you have the necessary capabilities to fulfill the regulations.

Job roles, such as data protection officer (DPO) and data controllers, are specified, as well as staff training.

In addition, Article 35 of GDPR mandates an impact assessment. The impact assessment must cover all aspects related to the collection, storage, processing, and management of personal data. In addition, it must continually evaluate data processing practices and activities, including risk assessment and mitigation measures.

Data breaches under GDPR can incur large penalties

By contrast, if you use a cloud supplier who is ISO 13485:2016 certified, many of these tasks are already taken care of. Procedures for documenting changes, responding to any issues, notifying you of updates, and more, are already in place.

Through their certification, the supplier is demonstrating, to you and your certification body, that their platform and quality management systems are suitable for a medical device.

Further, with a certified quality management system and many of the technical MDR and GDPR requirements already in place, using a regulated cloud supplier can typically reduce time to market for new app development by 6-9 months.

Pseudonymization and separate data storage

Pseudonymization is a critical strategy for preserving data privacy in compliance with HIPAA and GDPR.

Pseudonymization is defined within GDPR (Article 4(3b) as “the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organizational measures to ensure non-attribution to an identified or identifiable individual.”

But note that under GDPR, even with the identifying fields removed, the data is still considered personal data, and use of de-identification and pseudonymization is not intended to exclude other measures of data protection. Furthermore, explicit consent is also required for any extended use of personal data, such as for scientific or statistical purposes, and these data must also be anonymized.

Also of note for GDPR compliance, de-identified data must be stored separately and subject to technical and organizational measures to ensure it cannot be attributed to an identified or identifiable person.

GDPR and ISO 27001:2017

ISO 27001:2017 represents an international standard for security certification, and as such provides an ideal framework for implementing the technical measures necessary for data security compliance with GDPR.

However, GDPR and ISO 27001:2017 are in no way interchangeable, and having ISO 27001:2017 certification does not mean you comply with GDPR. GDPR is wider, and encompasses both data security and data privacy.

Cutting the complexity of GDPR compliance

Compliance with GDPR involves a great deal of complexity, encompassing both the health app/medical device itself and the infrastructure that supports it. If you are starting from a blank slate, such as an unregulated cloud platform, it can add months to the development timeline,diverting valuable resources.

Extra Horizon: medical back-end as a service

Unlike most cloud infrastructure providers, Extra Horizon provides a medical back-end as a service, certified to ISO 27001:2017 (information management system) and ISO 27701:2019 (privacy information management system) amongst others.

Extra Horizon alleviates most of the compliance burden from your organisation by taking responsibility for protecting the infrastructure and systems that support your app. Using our regulated platform allows you to focus your attention and resources on your application, confident in the knowledge that your infrastructure is - and remains - GDPR compliant.

Extra Horizon alleviates most of the compliance burden from your organisation by taking responsibility for protecting the infrastructure and systems that support your app. Using our regulated platform allows you to focus your attention and resources on your application, confident in the knowledge that your infrastructure is - and remains - GDPR compliant.
Extra Horizon will be responsible for the management of software updates and security patches, as well as the networking configurations underlying the system. Customers can leverage Extra Horizon’s control and compliance documentation to perform their control evaluation and verification procedures as required under GDPR.
Our platform uses the best-in-class encryption standards, and makes it easy to move to pseudonymized data and ensure that personal information and pseudonymized data are stored separately.
Our user and group service makes it simple to manage users, offering you granular access control opportunities, audit trails, consent management, and management of the right to be forgotten.
Building your digital health application on Extra Horizon’s regulatory-compliant framework will significantly advance your GDPR and MDR compliance trajectory , flexibly, scalably and reliably future-proofing the development of your medical software.

For more information and to discuss any aspects of GDPR and the Extra Horizon cloud platform, contact us anytime .

MDR: the impact of the new regulation on your choice of cloud provider

Wed, 26 May 2021 09:01:59 GMT

The new Medical Device Regulation (MDR) comes fully into force in the EU as of 21st May 2021, with the new IVDR (In Vitro Diagnostic Medical Device Regulations) on 26th May 2022.

The MDR introduces changes to the classification of medical software products, including the introduction of a high risk software class; this covers software that can cause ‘death or an irreversible deterioration of a person’s state of health’.

Furthermore, for the first time, standalone software is classified in its own right as a medical device if the software fulfils a medical purpose. This applies whether the software is being used in a clinical setting or not.

Consequently, to market your app in the EU, you must gain certification of compliance with the MDR. This places significant requirements on your cloud provision - specifically, that a suitable quality management system is in place throughout the product life cycle (currently for medical devices this is ISO 13485:2016 and IEC 62304:2006), and that the technologies are GDPR-compliant .

In this article we look at some of the key aspects of the new regulation, and how these impact upon choice of cloud supplier.

Does your software qualify as a medical device under the MDR?

Software is regarded as a medical device under the MDR if it is used to treat or diagnose, to drive clinical management, or to inform treatment. The determining question is how the data is being used, as opposed to whether you’re hosting a specific type of data.

So, for example, if your app simply displays usage of a device, such as an inhaler, this does not fall under the MDR. But if the intended use of data includes interpretation and analysis – for example, if the app delivers dosage recommendations based on individual data analysed on the platform – then the software qualifies as a medical device and is regulated under MDR.

Or to take another example: If a doctor reviews the raw patient data collected via a wearable device and makes a clinical decision based on that data, that is an unregulated use. However, if the wearable incorporates a Software as a Medical Device (SaMD) algorithm that analyses data on the platform and makes clinical recommendations, that is a regulated use case.

ISO 13485:2016 - A rigorous focus on safety

ISO 13485:2016 is the acknowledged quality management standard for medical devices, and goes much further than ISO 9001 in its focus on safety. ISO 13485:2016 places a strong emphasis on managing risk throughout the product life cycle, and on anticipating possible problems and having a fix in place before they occur.

Compliance therefore means you need to document everything, and ensure traceability from design and development through all aspects and periods of usage.

In addition, importantly, compliance with ISO 13485:2016 requires that you ensure all your critical providers are also compliant. So, when using cloud for MDR, you need to ensure:

that the platform delivers a suitable service for digital health
that there is a suitable quality management system in place, equivalent to ISO 13485:2016
that you will be kept informed of any service changes over time
that you have a plan for dealing with provider failure

The relation between MDR and GDPR

Essentially, GDPR applies to any company holding or processing personal data in the EU. Accordingly, if your app falls under the MDR, and collects personal data, it also falls under the GDPR.

GDPR compliance is therefore a prerequisite for MDR compliance, and will require:

the availability of pseudonymization, so that personal information and data are stored separately
the use of encryption at record-level, with each user’s data secured via a unique key
a legally-valid audit trail, so that you can track and prove all actions taken
user consent management, tracking each user’s consent to process their data

A suitable platform for MDR compliance

As outlined above, compliance with MDR is not a straightforward matter, and will involve considerable effort both during the software development phase and throughout the product life cycle.

Of particular relevance is that compliance with ISO 13485:2016 requires that you ensure all your providers - including your cloud service - are also compliant.

It is not mandatory to use an ISO 13485:2016 certified cloud supplier, but if you decide to use a standard, unregulated supplier (for example AWS, Google, Microsoft Azure, etc.), you have to take on all the responsibility for ensuring compliance with MDR. Measures will include:

Checking that the supplier can deliver the required service, including verifying that their SLAs ensure compliance with all the regulated processes
Using the supplier’s ISO 9001 and 27001 certification reports to verify they have suitable procedures in place to manage software quality and mitigate security threats
Carrying out ongoing audits and monitoring your supplier’s news feeds to ensure any changes or updates do not affect your compliance
Carrying out risk analysis and putting measures in place to mitigate failure of the service

All these requirements can add significantly to development time, as well as requiring you to maintain an ongoing audit to ensure all aspects of your cloud service remain in compliance.

Advantages of an ISO 13485:2016 certified cloud supplier

Through their certification, the supplier is demonstrating, to you and your certification body, that their platform and quality management systems are suitable for a medical device.

Limitations of an unregulated platform

At the earliest stages of product development, when you’re thinking perhaps of only developing a simple companion app, a habit tracker, say, that simply logs device usage, it can be tempting to opt for an unregulated cloud platform.

However, it’s important to remember that, as the companion app gains users, you are likely to want to build on this and make more use of the data you collect - for example, to improve patient engagement by delivering notifications or dosing recommendations.

At this point the software will need to comply with the MDR, and be supported by a regulated infrastructure, suitable quality system, full documentation, and more.

You are then faced with the cost and upheaval of having to move all your existing data to a regulated platform. Or, alternatively, continuing to use an unregulated supplier and taking on the burden and continuing responsibility to ensure compliance with MDR.

It is likely to be much more cost-effective and efficient to plan your app roadmap and from the start put in place the type of regulatory strategy you need to support your digital health solutions into maturity.

Extra Horizon: a platform built for eHealth

Extra Horizon provides a fully customizable, medically compliant cloud platform certified to ISO 13485:2016 (as well as ISO 27001:2017 and ISO 27001:2019 , relating to PII processing - read more here).

This enables creators of digital health products and technologies to take advantage of the full power of cloud connectivity - with the assurance that the administrative burden and investment risk of guaranteeing MDR regulatory compliance of the platform is taken care of, including:

Verification that we provide the required service, including the SLAs you need for a medical device
Having a suitable ISO 13845:2016 certificate and able to provide the necessary quality agreements
The necessary documentation and procedures in place to enable quality assurance
Notification of any service changes with the licensed modules

In the complex medical device landscape, this has numerous advantages. It ensures full security, privacy and regulatory compliance. It greatly accelerates time-to-market and, most importantly, it ensures technology companies can focus their efforts and resources on their product - where their IP resides - rather than the surrounding infrastructure.

How Extra Horizon enriches the Henkel Printed Electronics ecosystem of partners

Thu, 29 Apr 2021 14:36:33 GMT

Hasselt, Belgium, April 29, 2021 - Henkel Printed Electronics is proud to be able to add start-up Extra Horizon to its ecosystem of partners focusing on the joint development of advanced healthcare applications in printed electronics. This new collaboration has the potential to further accelerate innovation in the digitisation of healthcare, by combining Henkel’s expertise in advanced material solutions with the leading medical and technical skills of Extra Horizon, who are able to provide a certified backend platform and technology to medical applications.

By providing the entire backend or technical framework for medical applications, Extra Horizon’s platform enables faster launches or upscaling while at the same time ensuring strict compliance with all regulation required for obtaining product approvals under the new medical device regulations in Europe (CE approval under MDR regulation) or FDA approvals in the US. In combining these strong technical capacities with Henkel’s experience in materials for medical grade wearable solutions and smart patches, the partners can offer MedTech companies all the capabilities they need to bring their projects to fruition – from software to wearable solutions.

Stijn Gillissen

Head of Printed Electronics

Henkel

“I am very pleased to be able to add a MedTech pioneer like Extra Horizon to our network of partners. Their vast experience in digital health is an excellent complement to our expertise in material solutions for smart patches – which is more relevant than ever in the e-health market that is proving its huge potential.”

Lars Grieten

CEO

Extra Horizon

Senova brings new weapon in the fight against COVID-19, powered by us

Wed, 21 Apr 2021 14:25:16 GMT

News facts

Extra Horizon connects Senova’s new GreenLight test strips to secure, compliant cloud
Sophisticated digital lateral flow tests enable fast, efficient, secure and compliant data processing
Anonymised real-time data helps safeguard public health and limit the spread of Covid-19
Digitising immunoassay tests opens up all-new possibilities in in-vitro diagnostics
Extra Horizon’s proven medical backend significantly accelerates time to market for all kinds of digital health innovations

Hasselt, Belgium, April 21, 2021 - The Covid-19 pandemic has placed enormous strain on global healthcare systems. Moreover, it has revealed just how important it is to be able to gather and process reliable information quickly and efficiently in combatting an emergency of this magnitude. So it’s heartening to see the equally rapid pace with which digital technologies are being developed and adopted in the fight against Covid-19. Not least of which the state-of-the-art digital lateral flow test strips recently developed by Senova, ams and Extra Horizon which are now already in production. Read on to see how our powerful and proven medical cloud solution is enabling millions of rapid lateral flow tests and thereby helping to stop the spread of the novel coronavirus.

Real-time solution

Imagine not only being able to get instant results from lateral flow tests for SARS-CoV-2 but also process and analyse those results securely and in real time, while protecting sensitive user data! A new partnership between Extra Horizon and the leading in-vitro diagnostics device manufacturer Senova is making all that possible. In the form of a new user-friendly device that enables rapid testing in a variety of point-of-care situations. By powering Senova’s GreenLight technology with fully compliant and fully scalable cloud connectivity, Extra Horizon’s medical platform enables more informed decision-making on the basis of fully encrypted and anonymised test results, thus adding a powerful weapon to the arsenal of public health authorities around the world to stem the tide of Covid-19.

Connecting innovations

Senova’s innovative digital lateral flow or immunoassay tests are the result of a unique pooling of specialised expertise. Each strip contains a highly sensitive optical spectral sensor developed by ams , a leading worldwide supplier of high-performance sensor solutions. This hardware is wirelessly connected to Senova’s GreenLight smartphone app which, thanks to Extra Horizon, is in turn connected to secure medical cloud infrastructure. All data is stored and analysed on dedicated, secure local servers and protected by medically compliant data encryption and technical data security measures. From there, it can be seamlessly transmitted back to the mobile application and, if applicable, shared in anonymised form with national and international monitoring systems.

Hans Hermann Söffing

Founder

Senova

“As we venture further and further into the digital health space, Extra Horizon’s proven track record makes them the perfect fit for our company, enabling us to process sensitive data while complying with regulatory requirements. Just the support we need to make our future ambitions a reality.”

New perspectives in IVD

The ability to digitise lateral flow tests opens up endless possibilities with the potential to revolutionise the domain of intro-vitro diagnostics. Centralising the collection and processing of data, for instance, not only paves the way for new types of (highly sensitive) tests but also greater efficiency, reliability and scalability, even on a mass scale. And while in the first instance, Senova’s GreenLight technology is being deployed for the detection of SARS-CoV-2 antibodies, the solution’s fully scalable cloud infrastructure delivered and secured by Extra Horizon means the platform will be able to host a full library of tests in the future. That means greater convenience and quality of care for patients, enhanced efficiency and reliability for healthcare professionals and a powerful, connected resource with the potential to safeguard public health.

Fuelling the digital health revolution

New and innovative eHealth solutions such as Senova’s GreenLight rapid tests are being developed with increasing speed around the world. However, many digital health companies hit a wall in their development when it comes to processing the sensitive medical data they generate and ensuring full compliance with all regulatory standards. And that is precisely where Extra Horizon comes in. Rather than reinvent the wheel, companies like Senova can take advantage of Extra Horizon’s easily customisable cloud services to acquire a readymade and uniquely deployed medical backend for their solution that meets international software-as-a-medical-device (SaMD) standards. So they can focus their energies and resources on their core business, bring their solutions to market faster and acquire the agility and flexibility they need to adapt in the ever-evolving digital health space.

Our partnership with Senova is a text-book case of how Extra Horizon is helping to make digital health a reality on a global scale. Want to find out how Extra Horizon can drive your digital health solution beyond the horizon? Contact us here!

Antelope DX to join forces with In The Pocket and Extra Horizon

Thu, 15 Apr 2021 12:27:10 GMT

Ghent and Hasselt, Belgium, April 15, 2021 - Antelope DX to join forces with In The Pocket and Extra Horizon for the development of its easy-to-use, high-quality home testing device.

The first test on the market will be the Covid 19 & Flu self-test

Ghent and Hasselt, Belgium, April 15, 2021 - Antelope DX to join forces with In The Pocket and Extra Horizon for the development of its easy-to-use, high-quality home testing device.

Antelope Dx’s offering consists of a reusable connected palm-size reader device together with single-use test cartridges and an app to download on a smartphone. The app and the secure and compliant cloud connectivity feature are crucial components as they allow communication with the user to provide step-by-step guidance on how to perform the self-test, enable positive test reporting and provide meta-data on positive Covid-19 cases to healthcare authorities. These unique features set the Antelope Dx self-test solution apart from the current rapid and self-tests (lateral flow) on the market. In addition, the performance is better than lateral flow tests (aiming to reach over 90% sensitivity) and multiple parameters, such as Covid-19 and the flu, can be measured in one single test.

Hilde Windels

CEO

Antelope Dx

“Since the beginning of the Covid-19 pandemic, we have seen a quantum leap in how healthcare and in particular diagnostics are being deployed. Most recently, the door was opened for self-tests in Belgium and in many countries across the globe. With Antelope’s proposition, we can truly make the difference in a post-pandemic setting, once Covid-19 has become endemic and most people will be vaccinated. Because the performance of the app and its connectivity to the cloud are so important, we are pleased that we can work together with trusted parties and specialists in the field like In The Pocket and Extra Horizon. They will help us reduce the risk in this part of the development of our self-test and bring high-quality output to our product offering, while ensuring full compliance with strict security and privacy regulations”

Jeroen Lemaire

CEO

In The Pocket

“In The Pocket, a digital product studio, is the trusted partner to take care of the application-side of the self-test solution. With over a decade of experience, we know mobile apps like no other and have a strong focus on user experience. Complexity kills, so we aim for an easy-to-use and straightforward app. The app will guide the user step-by-step to complete the self-test, show the result without adding negligible information and will propose useful next steps based on the result.”

Lars Grieten

CEO

Extra Horizon

“We’re very proud to provide the medical cloud for this exciting project! With Extra Horizon we will not only be able to support Antelope Dx to stay vigilant and agile in their trailblazing journey, but also support the international scalability that is envisioned! During this process we assure that all sensitive data is managed safely and provide the necessary regulatory compliance for international market access!”

Interested in how we are able to provide the regulatory compliant and GDPR cloud solution? Get in contact here.

We obtained the ISO 13485:2016 certification to become a supplier to MDR/IVDR regulated customers

Thu, 18 Mar 2021 15:30:53 GMT

ISO 13485:2016

Extra Horizon has achieved the ISO 13485:2016 certification for its quality management system. This certification demonstrates our Extra Horizon services are compliant with the international standard that specifies the requirements for providers of medical devices and related services.

ISO 13485:2016 focuses on how companies manage and implement a risk- based approach to control and monitor processes such as purchasing, design, development, manufacturing, quality control activities and product monitoring. With the certification, Extra Horizon can demonstrate to regulators and partners that it meets the applicable regulatory requirements.

A solution accelerator

Extra Horizon provides fully compliant and fully scalable cloud connectivity and GDPR-compliant data storage through a medical backend-as-a-service platform. The Extra Horizon platform delivers a medical infrastructure based on agility, global regulatory compliance and scalability with a full suite of essential functionalities.

The ISO 13485:2016 requirements had already been implemented a while back, but SGS Belgium (notified body 1639), an official certification company, has now given its formal certification after a thorough audit process.

This certification is of crucial importance to Extra Horizon because of its partnerships with pharmaceutical companies, medical device manufacturers and in vitro diagnostic (IVD) companies who, by nature of their work, operate in highly regulated environments. Extra Horizon, being a critical supplier to these medical device manufacturers, must be able to demonstrate compliance with regulatory requirements, manage risk, ensure best practice for quality and safety, improve processes and provide confidence to patients and users.

The key element of risk management

Because companies are required to consider the risk associated with their products, it is vital for them that their suppliers be compliant with ISO 13485:2016. For that reason, it was critical for Extra Horizon to be certified because ISO 13485:2016 broadens the scope of the entire risk management process, including risk-based analysis and risk-based control. It does so by placing the burden of verification on the organization that is creating the product or service. That not only affects medical device companies, but it is also a determining factor for firms providing a critical service or a critical component to that device, as it goes to market.

The ISO certification enables Extra Horizon’s partners to focus their energies and resources on their core business, allowing them to bring their solutions to market faster and acquire the agility and flexibility they need to adapt in the ever-evolving digital health space.

Jo Van Der Auwera

Co-founder and CRO

Extra Horizon

“Securing this ISO 13485:2016 certification is another major milestone that Extra Horizon has achieved. Since COVID-19 has accelerated the growth of the digital health space, and with MDR/IVDR regulation around the corner, we're able to provide a much-needed solution for those digital health companies that face regulatory approval, by offering our medical grade backend-as-a-service.”

9 Million euros in funding for ehealth pioneer Qompium - extra growth spurt for Qompium and its business units FibriCheck and Extra Horizon as a result of covid-19

Wed, 03 Feb 2021 13:16:28 GMT

Hasselt, Feb 3, 2021 - Qompium, the pioneering Belgian digital health company, has received an additional 9 million euros in funding after a new capital round. With its business units FibriCheck (medical app which detects heart rhythm disorders) and Extra Horizon (secure, scalable platform that accelerates the launch of medical apps for other eHealth companies), Qompium stands at the cutting edge of innovation in eHealth. This capital injection will enable Qompium to continue to play a leading role in the digital transition of the healthcare sector. A transition which is now in overdrive due to the Covid-19 pandemic, bringing Qompium that much closer to achieving its international ambitions.

Qompium completed the new capital round with success, retaining the full trust of its current investors (including LRM) and medical experts. Qompium was founded in 2014 with the aim of accelerating and improving the implementation of digital health solutions. The company comprises two business units:

FibriCheck is a medical app that lets people monitor their heart rhythm and thereby detect hidden heart rhythm disorders such as atrial fibrillation (AF). It is the world’s first CE and FDA approved medical smartphone app for heart rhythm disorders using the camera signal. Since its launch, FibriCheck has helped more than 450,000 people in 43 countries, performing over 4 million heart rhythm measurements and detecting around 40,000 heart rhythm disorders. FibriCheck has already signed contracts with such companies as Samsung and Fitbit.
Extra Horizon is a platform that enables medical applications to go to market with far greater speed and scalability. By providing the entire backend or technical framework of such applications, Extra Horizon also ensures full compliance with the many strict and complex regulations applicable to digital health solutions. As well as powering the FibriCheck app, Extra Horizon recently formed a partnership with ams, a world leader in optical sensor technologies. Thanks to Extra Horizon’s customisable platform, ams was able to develop an extremely accurate digital rapid test for the detection of SARS-CoV-2 antibodies in as little as 3 months.

Covid-19 sparks accelerated growth

Both FibriCheck and Extra Horizon have experienced exponential growth as a result of Covid-19. The pandemic sparked a significant rise in the use of mHealth (mobile health) solutions. During the lockdown, cardiologists began using FibriCheck on a massive scale in order to monitor patients remotely as part of the TeleCheck-AF project. At the same time, both new and established players rapidly began developing new medical applications and looked for solutions to bring them to market faster.

Qompium will use the newly invested 9 million euros to further accelerate the growth of both its business units. FibriCheck has international growth in its sights, among others in Australia where the application was recently given the green light by the local regulator. As such, the app is rapidly evolving into a true integrated solution, making remote monitoring a reality via a full range of consumer devices including wearables and hearables. Extra Horizon, in turn, is also seeing an increase in demand for technological support from companies looking to build secure, compliant and scalable medical applications. The transformation of the healthcare sector is progressing at lightning pace. And in order to compete, time is of the essence.

Pioneer in digital health

Lars Grieten

CEO

Extra Horizon

“We have played a pioneering role in the field of digital health for 6 years now. Covid-19 has had an enormous impact on Qompium. The digital health market is in full transition mode and over the past year, we have been able to get a very accurate picture of our sweet spot in the market. Thanks to our investors, we are now in an even better position to realise our ambitions and expand our team not only to continue our growth but to remain at the forefront of digital health.”

Tom Vanham

General Manager

LRM

“Qompium operates at the intersection between IT and the healthcare sector. It has succeeded in uniting its expertise in both domains to develop a ground-breaking application. As a strong Limburg-based company, we are very proud to have been able to count Qompium as part of our portfolio from the very beginning. We are sure that, with the help of our ‘smart money’, Qompium will be able to take its next giant leap towards achieving its international ambitions.”

About LRM

LRM is an investment company dedicated to stimulating economic growth in Limburg, Belgium. Focusing on initiatives that create jobs in Limburg, LRM opens up new avenues for growth by laying solid foundations. Combined with the many benefits of the Limburg region, the company’s financial resources and expertise create unique fertile ground for a wide range of innovative businesses and projects. More info: www.lrm.be .

ams AG selects Extra Horizon to power innovative point-of-care cloud solution for its lab-quality, spectral sensor-enhanced lateral flow test solution to help fight covid-19 (sars-cov-2)

Tue, 02 Feb 2021 12:56:16 GMT

News facts

ams and Extra Horizon team to fight the pandemic by creating a medical-cloud connected spectral sensor-based solution for Lateral Flow Test (LFT)
ams provides an easy-to-use, lab-free Covid-19 (SARS-CoV-2) antigen or antibody test read-out solution which provides highly reliable results in around 15 minutes at the point-of-care

Extra Horizon provides it's world leading, high-performance, medical-grade cloud solution for almost instant results to your smartphone
The proven capabilities of Extra Horizon’s global platform ensures test results can be processed over a wide geographical reach securely, reliably, in real time – up to millions at a time –, all the while ensuring full compliance with local data processing regulations, including GDPR for handling sensitive data
A full production line for ams spectral sensor-based SARS-CoV-2 antibody digital rapid tests has already been inaugurated with Germany-based Senova

Premstaetten, Austria and Hasselt, Belgium, February 3, 2021

Today, ams (SIX: AMS), a leading worldwide supplier of high-performance sensor solutions, announces that it has chosen the high-performance cloud infrastructure developed by Extra Horizon to power a range of innovative point-of-care, spectral sensor-based solutions that harness the full power of digital health. Particularly in the context of the ongoing COVID-19 pandemic where fast and accurate testing is crucial to safeguarding public health, ams and Extra Horizon’s connected sensor solution and the highly accurate and efficient point-of-care tests it enables, together offer a unique response to a global problem.

An extra weapon in the fight against COVID-19

The COVID-19 pandemic has underlined the importance of highly accurate and secure rapid testing and instant data availability, particularly when that data is critical to developing and managing lockdown strategies. The combination of the ams spectral sensor and Extra Horizon’s connected solution pave the way for a range of digital point-of-care tests, including extremely fast and highly accurate lateral flow (immuno assay) tests. In fact, a full production line for SARS-CoV-2 antibody digital rapid tests has already been inaugurated as a result of the technology . Moreover, the proven capabilities of Extra Horizon’s global platform ensure a wide geographical reach. This means the results of those tests can be processed securely, reliably and in real time, up to millions at a time – all the while ensuring full compliance with local data processing regulations, including GDPR for handling sensitive data.

Pierre Laboisse

Executive Vice President Global Sales and Marketing

ams AG

“Governments and authorities need to enable fast, reliable and effective testing with the results available through a fast, secure and GDPR-compliant medical-grade cloud solution. Extra Horizon offers best-in-class medical cloud solutions through their deeply proven expertise in medical cloud. The company’s professional expertise in developing customized solutions, leveraging an extensive backbone knowledge, makes it an ideal partner for this important undertaking. We hope that this solution will eliminate complicated logistics and clinical processes and streamline approaches to mass testing and effectively become an essential tool in the effort to help control the pandemic and resume the many economic and social activities that comprise what we call normal life.”

Driving the digital transition of IVD technologies

Lars Grieten

CEO

Extra Horizon

“This global partnership is a powerful demonstration of how state-of-the-art health tech sensors can be enhanced with digital infrastructure to deliver point-of-care testing solutions both in the professional and home environment. Rapid testing will become more relevant in our digitized future. And by enabling critical decisions to be taken faster, it is already providing much needed support for managing the COVID-19 crisis.”

An easy replicable formula

The software component of the point-of-care sensor solution is powered by Extra Horizon’s robust and fully compliant backend solution. The platform relieves the burden of regulatory compliance and reduces investment risk, providing companies with the technical framework and complementary services they need to build sophisticated medical applications with greater speed, flexibility, scalability, and reliability.

About ams AG

ams is a global leader in the design and manufacture of advanced sensor solutions. Our mission is to shape the world with sensor solutions by providing a seamless interface between humans and technology.

ams’ high-performance sensor solutions drive applications requiring small form factor, low power, highest sensitivity and multi-sensor integration. Products include sensor solutions, sensor ICs, interfaces and related software for consumer, communications, industrial, medical, and automotive markets.

With headquarters in Austria, ams employs around 9,000 people globally and serves more than 8,000 customers worldwide. ams is listed on the SIX Swiss Exchange (ticker symbol: AMS). More information about ams can be found here .

ams is a registered trademark of ams AG. In addition many of our products and services are registered or filed trademarks of ams Group. All other company or product names mentioned herein may be trademarks or registered trademarks of their respective owners. Information provided in this press release is accurate at time of publication and is subject to change without advance notice.

5 questions to ask before building a medical software infrastructure

Sat, 23 Jan 2021 16:02:51 GMT

Connected devices, combination products, Software-as-a-Medical Device (SaMD), digital therapeutics, clinical decision-making solutions, … They all have at least two things in common: they are all evolving at rapid pace and they all need sophisticated infrastructure to ensure full regulatory compliance.

When it comes to delivering this digital health infrastructure, MedTech, IVD and pharmaceutical companies face two options: they can build it themselves or they can buy a pre-built solution. The decision becomes an especially relevant one when you look beyond a project’s research or pilot phase and start to focus on the go-2-market phase where regulatory approvals and international scaling are most critical.

That’s precisely when you need to consider what sets you apart and what your actual IP is. Is it your device, your algorithm, the mobile application or a mix? Most importantly, do you really want to re-invent the wheel in building your own infrastructure?

5 critical questions

As your idea or company grows, there are several such critical questions you should ask yourself when it comes to building your infrastructure:

How should we build our product? Do we have the right team in-house to set up, develop, maintain and scale global medical software and cloud infrastructure?

How can we reduce the time to market for my medical product?

How can we avoid trade-offs to ensure a future-proof setup that supports our evolving business requirements?

What is the best way to manage regulatory updates and submissions to maintain compliance?

How do we ensure the secure and compliant processing of sensitive data in every new region we move into?

When you dig deeper into these questions, it becomes clear that buying a pre-built platform is a smart and strategic move. As well as being more cost-effective, it mitigates your security, privacy, regulatory and technical debt risk!

Introducing the Extra Horizon solution

Extra Horizon is the leading provider of globally regulated medical software infrastructure for Software as a Medical Device, pharma and MedTech suppliers. Every line of code in our platform is built to IEC62304 standards and managed via an ISO 13485:2016 certified medical quality management system. To guarantee the meticulous and fully compliant processing of sensitive (medical) data, we are also certified as a Cybersecurity Information Management System (ISO 27001:2017) and Privacy Information Management System (ISO 27701/2019). Once you decide to work with Extra Horizon, you can choose to “build it yourself” or rely on our support to maintain and scale your product while ensuring full compliance.

Want to learn more about the many benefits of our world-leading platform? Contact us anytime!

FibriCheck smartphone/smartwatch application for arrhythmia monitoring

Thu, 12 Nov 2020 08:42:38 GMT

What was the problem statement?

FibriCheck is a Software-as-Medical-Device (SaMD) product capable of recording and analysing PPG data from consumer devices (smartphones/smartwatches) for heart rhythm evaluation to support medical diagnostic decision-making.

The software needed to resolve the following challenges:

Ability to scale to meet acute user load and system utilisation
Have a centralised control structure for uniform algorithm deployment across all users at all times
Have the ability to service 3 different business models next to each other
Meet strict GDPR/Cybersecurity regulations
Enable continuous product changes and adaptations depending on geographical-, market- and business case-related requirements.

The solution

The FibriCheck solution is built on top of the Extra Horizon system and was configured to service its functions. The entire FibriCheck system has the following components and functionalities:

Wearable application (Fitbit and “other wearable provider”)
Mobile application (iOS, Android)
Web application (for patients, for doctors)
Reporting (tailored to type of customer)
Different deployed state-of-the-art AI algorithms (B2C & B2B)
APIs for integration with EMR (HL7/FHIR)
Admin dashboard for user/subscription/data management
Handling of spot-check data >< continuous monitoring data
Dedicated communication channeling and interrogation capabilities for informational as well as outcome/research purposes

Device classification

Class II - Medical device (MDD)

Number of Extra Horizon services used

19 services: Algo Service, Auth Service, Configuration Service, Data Service, Dispatcher Service, Event Service, File Service, Group Service, Image Service, Localization Service, Mail Service, Notification Service, Prescription Service, Profile Service, Report Service, Stripe Service, Task Service, Template Service and Users Service.

Type of customer

Digital health company, cloud native, scale up (25FTE)