No duplicate people, no exposed identities

EnaResearch keeps the person and the participation in separate records. The organization-wide person record (PS) holds only the minimum identity needed for matching: first name, last name, sex and date of birth (a year alone is accepted). The study participation (SP) defines the person’s place in a specific study: a study-specific pseudonym (P001, P002…), start and end dates and a status.

A person is registered in a study only once. The identity details of a person who also takes part in another study cannot be changed from a single study’s screen, so that the other study is not affected. Participants can only be registered while the study’s recruitment is open.

During registration the system checks whether the person already exists in your organization. If a person identifier is entered, an exact identifier match is searched first; an identifier match means the same person and cannot be ignored. If the identifier matches but the name or birth year does not, the researcher sees a warning. A person with a different identifier is never proposed because of a similar name.

Without an identifier, candidates are found by date of birth (year precision is supported) and folded-name similarity. Name folding covers European letters such as ß, æ, ø, œ, ł, đ and þ as well as Turkish letters, so different spellings do not hide the same person.

While a candidate exists, a request to create a new person is stopped on the server. The researcher either links the existing person or deliberately ignores the candidate; the decision is written to the audit trail. The matching search itself is audited as an access event.

Person identity is not tied to one country; the organization chooses the identifier used for matching on the Person identifier screen under System management. Supported types: Turkish ID number or foreigner ID (Türkiye), NHS number (England and Wales), BSN (Netherlands), AHV/AVS number (Switzerland), KVNR (Germany; format check only), an institution or hospital record number, or another national identifier; for the last two the organization sets the display name and an optional format rule.

The identifier is not stored in clear. For exact matching, an HMAC hash with a versioned, HKDF-derived key is kept, together with the last 4 characters to help recognition on screen. If the organization chooses, an AES-GCM encrypted copy can also be kept; only members with study management permission can reveal the clear code, and every reveal is written to the audit trail. Turning the option off deletes the encrypted copies.

A participation starts as active and ends as completed, withdrawn or lost to follow-up. Lost to follow-up is used when consent has not been withdrawn but the person can no longer be reached: the participation ends and the collected data stays. Participant counts are shown by status.

In a running study, an active participant shows a “Not connected” warning when no data source is connected, and a “No data” warning when nothing from the study’s metrics has arrived for more than 7 days; the tooltip shows the time of the last data.

When a participant withdraws, the researcher chooses in the confirmation window whether the collected data is kept or deleted; the choice is written to the audit trail. If deletion is chosen, only this participation’s data window (including pre-enrollment data) is deleted, and late data for that participation is no longer accepted.

Because measurements belong to the person, deletion never touches data that falls within the person’s participation window in another study. The data of a finished participation can also be deleted later.

Each participant’s panel has a day-by-day “data / no data” strip for every metric of the study; no measurement values are shown. The panel also shows completeness and quality-flagged days per metric, the data sources and the last sync.

If the study keeps clinical records, hospital stays and clinical events, manual measurements (such as pain and fatigue scales or lab values) and the eligibility check are recorded in this panel too. Details are on the clinical context page.

Researchers see match candidates masked: initials, birth year and, where present, the last 4 characters of the identifier. Full names are for the owner role. A researcher can confirm the right match without learning the identity of a person they did not register in their own study.

In research data a person appears under the study pseudonym (P001). Identity details and the person identifier never enter research datasets or exports.