Where patient data goes, and who can open it
Version 2.1 · Updated 16 October 2026
How study data moves from the site's electronic health record (EHR) to the electronic data capture (EDC) system, and who is responsible at each step.
How study data moves from the hospital record to the electronic data capture (EDC) system, and who is responsible at each step.
No large language models in redaction
The redaction engine finds identifiers with rules and small purpose-built recognisers trained only on synthetic documents; no large language models and no external services.
The site approves the redactions
No document a site uploads goes to the Catalyst pipeline until the site approves the redactions, also when Castor's engine redacted.
No identifiers in the EDC
The EDC holds study data only.
From the hospital record to the EDC, step by step
Two Castor services, kept apart. The Catalyst Source Gateway holds and redacts source for the site, with no large language models. Hosted on Microsoft Azure; no other subprocessors. The Catalyst pipeline works for the sponsor, on redacted copies only.
No document a site uploads goes to the Catalyst pipeline until the site approves the redactions, also when Castor's engine redacted. Each extracted value links to its redacted source. Today every extracted value goes to a Castor reviewer; risk-based review is coming soon.
Three ways a site sends a document
Site redaction tool
The site redacts the document before upload.
In the browser Coming soon
The site redacts on its own computer before anything is uploaded.
Castor redacts
The site uploads unredacted; Castor's redaction engine removes its identifiers in the Source Gateway. For French sites, Castor redacts (C) only once health data hosting (HDS) is confirmed for the study.
Can participants reach the hospital's records?
Records a participant authorises are their own choice and need nothing from the site.
Two public web pages list connected organisations: Epic's endpoint directory, and the map of the Trusted Exchange Framework and Common Agreement (TEFCA).
A redacted copy is still personal data
Redaction removes identifiers, but under the General Data Protection Regulation (GDPR) the copy stays personal data in Castor's hands.
Who can open unredacted source
Only the site can open unredacted source. Castor reviewers, and every AI step, work on redacted copies, which are still personal data.
| Who | Unredacted source? | What they work with |
|---|---|---|
| Site team | Yes | The site's own records and uploads. Approves every redaction. |
| Castor Catalyst redaction engine | Automated, no large language models | Reads path C uploads only to redact them. |
| Castor's AI pipeline | No | Redacted copies only.Redacted copies only, in the EU. |
| Castor reviewers | No | Redacted copies only. US-based for US studies.Based in the European Economic Area. |
| Sponsor and its contract research organisation | No | Study data in the EDC, with no personal identifiers. |
Agreements and approvals for the study
For the study, Castor works under the contract with the sponsor or CRO. If Castor redacts uploads for the site (path C), a separate agreement with the site may be needed, such as a business associate agreement (BAA). Ask your Castor contact.
For the study itself, the sponsor is controller and Castor its processor, under an Article 28 data processing agreement (DPA) with the sponsor. If Castor redacts uploads for the site (path C), a separate agreement with the site may be needed, such as a data processing agreement (DPA). Ask your Castor contact.
The clinical trial agreement (CTA) allocates responsibilities; it is not a GDPR ground. Site-controlled activities, co-sponsorship and investigator-initiated studies are assessed and documented separately.
Before the first upload
Institutional review board (IRB) approval
The study protocol is approved.
Informed consent
Uploads are for consented participants only.
Authorisation or waiver
Under the Health Insurance Portability and Accountability Act (HIPAA): an authorisation, a documented IRB or Privacy Board waiver, or another permitted pathway.1
Within scope
Upload only what that permission covers.
Ethics approval
The study protocol is approved.
Lawful basis
The controller confirms its Article 6 basis, Article 9(2) condition and any national rules.1
Participant information
Covers the processing, recipients, retention and transfers. Running trials may need an update first.2
Consent
Uploads are for consented participants only.
National rules: Germany, the Netherlands, France
Medical secrecy in Germany and the Netherlands
Redaction supplements medical secrecy; it does not replace it. The site establishes the permission for disclosing unredacted records to Castor and for monitor access, under the German Criminal Code (Strafgesetzbuch, StGB) § 203 or the Dutch Medical Treatment Contracts Act (WGBO).a
France: health data hosting
Health data hosting certification (hébergeur de données de santé, HDS) applies to hosted health records of French patients, including redacted copies. For French sites, Castor redacts (C) only once health data hosting (HDS) is confirmed for the study.b
Where data is stored and processed
US
Source Gateway in the site's country; AI processing in the US. Castor reviewers and support staff for US studies are based in the US.
EU
Source Gateway in the site's country; AI processing in the EU. Reviewers and support staff for EU studies are based in the European Economic Area.
UK
Coming soonUK-hosted studies: coming soon. Ask your Castor contact.
Access by a separate entity outside the European Economic Area (EEA) is a transfer and needs cover under the EU-US Data Privacy Framework or standard contractual clauses.3 The providers used in a study, such as Google for AI extraction, are in Castor's sub-processor list.
Security
Encrypted at rest and in transit, and isolated per study. Company certifications:
ISO/IEC 27001
Information security management, certified since 2017
ISO 9001
Quality management, certified since 2018
NEN 7510
Dutch healthcare information security standard, since 2017
Documents sites can ask for
A site's privacy officer, IT security lead or IRB can ask the site's Castor contact for any of these before the first upload.
A site's data protection officer, IT security lead or ethics committee can ask the site's Castor contact for any of these before the first upload.
Sub-processor list
The hosting and AI providers used in the study, with their locations.
Validation package
Risk assessment, requirements and validation plan from Castor quality assurance.
EU AI Act assessment
Castor's documented classification assessment, under a non-disclosure agreement.