Source documents in, study data out, under your review policy
Version 2.1 · Updated 16 October 2026
For clinical operations, contract research organisation (CRO) and quality teams: what happens between a site's source document and the electronic data capture (EDC) system. The steps, the check at each one, and what has been measured.
A workflow, not one model
Five stages with a check at each: intake, redaction, extraction, review and commit to the EDC.
Redacted before extraction
Redaction uses no large language models, and the site approves every redaction. The AI pipeline only ever sees redacted copies.
You set the review policy
100% human review today, with every action in the audit trail. Risk-based review is coming soon. Coming soon
Study data is retyped by hand, and sending source out raises privacy questions
Most of the data a study needs already exists: in an electronic medical record (EMR), a lab report, a visit summary or a paper worksheet. Getting it into the EDC usually means a trained person reading the source and typing it again.
An AI model on its own does not solve that, for four reasons.
Identifiable records
Sites are reluctant to let records with names and dates of birth leave their control.
Boxes leak text
Black boxes drawn on a digital file often leave the text underneath readable.
Monitors need source
Redacting the only copy breaks remote source data verification (SDV) for monitors and inspectors.
Someone must answer for it
A model's output only becomes study data under a review policy that the sponsor or CRO sets and stands behind, on the record.
What Catalyst does with a document, from upload to EDC
Castor Catalyst is a multi-step workflow that feeds the EDC, not a single AI model with a prompt in front of it. Each stage does one job and has its own check.
-
Intake
Source GatewaySites upload documents of consented participants against a pseudonymised participant ID, or the participant authorises retrieval of their own records through Fast Healthcare Interoperability Resources (FHIR).
Source lands in a study-isolated, encrypted gateway in the site's country.
Check: source stays in the gateway, separate from the AI pipeline.
-
Redaction
Source GatewayNo large language models · No other subprocessorsThe site redacts before upload, or the Castor Catalyst redaction engine redacts unredacted uploads in the gateway, as a service to the site. The redaction engine finds identifiers with rules and small purpose-built recognisers trained only on synthetic documents; no large language models and no external services.
Health records a participant authorises are redacted by the same redaction engine in the Source Gateway, with the participant's consent. The participant submits these records, so no site approval step applies to them.
Check: the site approves the redactions before anything is submitted.
-
Extraction
Catalyst pipeline · AIThe pipeline reads the redacted copy, finds each value the electronic case report form (eCRF) needs, and returns it with unit, date, page location and reasoning.
FHIR data is mapped mostly deterministically; AI checks the mapping and reads free-text notes.
Check: an AI check confirms the redacted document matches the participant.
-
Review
Castor reviewersNothing is pushed outside the review policy. Today the review policy sends every value to a Castor reviewer (100% review). Risk-based review, with the fields the sponsor or CRO picks and values below their confidence threshold going to a reviewer, is coming soon. Coming soon
The reviewer sees each value highlighted on the redacted source and confirms, corrects or rejects the values the review policy sends to a person. Reviewers also check the redacted copy for missed identifiers.
Check: the review policy set by the sponsor or CRO decides which values a person reviews; every action is logged.
-
Commit
The EDCValues cleared under the review policy go to the EDC, with the pseudonymised participant ID and a full audit trail. Each value links to a redacted evidence snippet stored in Catalyst.
Check: no personal identifiers enter the EDC.
Why a workflow and not a single model
Structured data takes deterministic paths wherever it can. AI does the reading that rules cannot, on redacted copies only. People set the review policy and decide every value it sends to them. Because the stages are separate, any value can be traced back through each of them to its source.
One service redacts the source, another extracts the data
The Catalyst Source Gateway, which holds and redacts source, and the Catalyst pipeline, where AI runs, are separate services. The chart shows what each one holds and where the data goes.
Whose service
The Catalyst pipeline is the sponsor's service, under the contract with the sponsor or CRO. If Castor redacts uploads for the site (path C), a separate agreement with the site may be needed, such as a business associate agreement (BAA) in the US or a data processing agreement (DPA) in the EU. Ask your Castor contact.
Regions
AI processing runs in the US for US studies and in the EU for EU studies.
In the EU, sites redact before upload (A or B) by default. For French sites, Castor redacts (C) only once health data hosting (HDS) is confirmed for the study.
UK-hosted studies: Coming soon Ask your Castor contact.
No training on your data
We don't train AI models using your data from Catalyst. Who can open each copy is set out in the Catalyst data journey.
Three ways to redact a document, and how well the engine does it
A site can redact any of its own source documents before upload, or let the Castor Catalyst redaction engine redact unredacted uploads in the Source Gateway. The site approves every redaction, and Castor reviewers also check redacted copies for missed identifiers.
Site redaction tool
The site redacts with the tool it already uses and uploads the redacted copy.
In the browser Coming soon
Redaction runs on the site's own computer before anything leaves it.
Castor redacts
The redaction engine redacts after upload, in the Source Gateway, as a service to the site.
How well the engine finds patient identifiers
Two separate evaluations on different document sets: the engine on Castor's benchmark, and clinicians in a published study.1
Castor's benchmark: 146 documents (585 pages, including 12 real patient records). Results per identifier type and per document type are in the Catalyst redaction guide.
Values reach the EDC only under the review policy you set
Catalyst stages values for review. The AI never commits data to the EDC outside the review policy the sponsor or CRO sets.
The review policy is chosen by the sponsor or CRO
- 100% human review
A person reviews every extracted value before it reaches the EDC.
- Risk-based review Coming soon
Planned: above the confidence threshold set by the sponsor or CRO, values go to the EDC without a person; chosen fields always go to a reviewer.
What the audit trail records
- Every extraction, review, override and approval, from intake to electronic signature
- The original extracted value next to any correction, and who made it
- Each value's exact location on the source page, so a monitor sees where it came from
Built for validated use
- Built to support US Code of Federal Regulations (CFR) Title 21 Part 11 and EU Annex 11 requirements (audit trail, access control), with the sponsor's validation
- Validated under Castor's standard operating procedures for development and validation
- A good practice (GxP) validation package is available on request
Sites in the US and Europe already use Catalyst in live studies. Three anonymised studies are in the case studies.
- 40+sites
- 4countries
- 350+source documents
- 15,000+data points
- United States
- Germany
- United Kingdom
- France
Fewer errors, less time per chart, and the numbers behind it
Each figure is labelled with the kind of evidence behind it: production telemetry from a live study, Castor's internal benchmarks, an anonymised customer case, or a published meta-analysis.
Reviewer override rate on AI-extracted fields: how often a reviewer changed the AI's value. Not an accuracy rate.
Submission success rate for reviewed values committed to the EDC, in the same study.
From enrollment to data in the EDC in a direct-to-participant registry; 40 hours of human effort reduced to under 4 hours.
Reduction in data abstraction cost across 12 comparative studies, 2023 to 2024.
Manual EMR chart abstraction compared with Catalyst
Castor internal benchmarks · manual error rate publishedError rate
Time per chart
Cost per chart
Catalyst error rate is after review. Manual error rate: Garza et al. 2025, meta-analysis of 93 studies.2 All other figures: Castor internal benchmarking.
Castor figures are internal benchmarks, production telemetry or anonymised case results, not peer-reviewed. Faint scans and faxes are as hard for the AI pipeline as for a person.
Pick the route that fits the study, then plan the go-live
Both routes share the same redaction, review, audit trail and EDC. They differ in who starts the flow and where the records come from.
- Any site-based study, any country
Site upload
Sites upload the documents they already produce: PDF visit summaries, scans, paper worksheets with handwritten responses, EMR screenshots and exports.
No interface to build at any site, which makes it the standard route outside the US.
- US participants, no site visits needed
Participant-authorised retrieval
The participant authorises retrieval of their own records, via FHIR or the Trusted Exchange Framework and Common Agreement (TEFCA).
No integration project, interface build or IT cost for the site.
Is the participant's hospital already reachable?
Often yes, and many hospitals are not aware of it. US rules require Epic and Oracle Health (Cerner) sites to offer patient-access FHIR endpoints, and many organisations take part in TEFCA.
Anyone can check Epic sites and TEFCA participation in the public directories below. Sites in neither are confirmed per site, and site upload is the alternative.
One implemented study planned its go-live over eight weeks
- Weeks 1–2
Discovery
Forms, sources, sites and regions in scope.
- Weeks 3–5
Configuration
Form configuration, field mapping and a benchmark on your sample documents.
- Weeks 6–7
Testing
Castor quality assurance, then your user acceptance testing.
- Week 8
Go-live
Site training and the first uploads.
What you bring
- The protocol, with the endpoints and derivation rules that matter most
- The case report forms in scope
- Sample source documents of each type
- Testers for weeks 6 and 7, and the site agreements and approvals the study needs
Building it yourself
- Self-build is allowed: you build your own forms in Castor EDC, and Castor builds the form Catalyst writes to
- Freeze the forms in scope before mapping starts; a later change means re-mapping and re-testing
What a quality or privacy review will ask
Encryption and isolation
Encrypted at rest and in transit, in a study-isolated environment partitioned by study and participant.
Data protection roles
For sponsor-directed processing, the sponsor is controller and Castor is processor under a data processing agreement (DPA).
EU AI Act
Castor's documented classification assessment is available on request under a non-disclosure agreement.
Certifications
ISO/IEC 27001 and ISO 9001 certified. 57 client audits completed.
The platform behind Catalyst (Castor platform totals)
- 6,600+late-phase and registry studies
- 900+registries
- 800+MedTech studies
- 160+countries
What a first conversation looks like
Talk to your Castor contact about Catalyst. Three steps take you from sample documents to a plan you can price.
Your documents
A protocol, the forms in scope and sample source documents. Synthetic samples welcome.
A benchmark on your samples
Castor runs the extraction on your documents and recommends a route.
A plan you can price
An implementation plan and an estimate scoped to your study.