Customer Approval Pack

1 · Status snapshot

MedData is live in a single-org pilot (meddata-pilot) at https://meddata.eyadrasmi.com, with Wave 0 (Departments, Delegation, Two-person rule), Wave 1 (EDC queries, cross-field validation, conditional visibility, cascading dropdowns, visual rule builder, compare-versions), Wave 2 (multi-site studies, subject registry, visit scheduler, per-site record filter), and Wave 3 (21 CFR Part 11 e-signatures, EU Annex 11 CSV, GDPR Article 15 DSAR) all shipped. The first customer (Dr. Sara Al-Mutairi, Cardiovascular Outcomes in Kuwaiti Adults pilot) is reviewing the platform this week.

2 · Brand identity

MedData carries a bilingual EN+AR brand with a strict design system. The system is built CSS-first; the component library is 11 elements; the contrast pass is 56/56 WCAG AA; the Arabic glossary is 610 entries.

3 · System architecture (one-page)

A single-tenant modular monolith in NestJS, a single Next.js 14 web app, and a single Prisma + SQLite database in dev (Postgres in production). All GxP-impacting flows (records, exports, e-signatures, audit) go through the same RBAC + capability layer.

Browser → Cloudflare edge → cloudflared → Next.js :3000
                                          │ (server action / API proxy)
                                          ├─→ NestJS API :3001
                                          │     ├─ Prisma (SQLite / Postgres)
                                          │     ├─ Local FS storage (dev) / S3 (prod)
                                          │     └─ MailService (dev: console.log; prod: SMTP)
                                          │
                                          └─→ /public/dsar (no auth) + /dsar/verify
  

Modular monolith, not microservices. One NestJS process; split when load demands. Decision 11 in docs/decisions.md explains the reasoning.

Capability layer. 32 capabilities (28 → 32 across Wave 0+1+2+3), per-row overrides on StudyMembership, role defaults in apps/api/src/common/capabilities.ts. A single chokepoint can(userId, capability, studyId, {siteId?}) gates every privileged write.

Audit trail. Append-only streams per entity: RecordAuditEvent, ExportAuditEvent, MembershipAuditEvent, RecordQueryAuditEvent, SubjectAuditEvent, SignatureAuditEvent, DsarAuditEvent. The audit timeline module aggregates them into a single per-study view.

4 · Feature walkthrough

The pilot includes the features the first customer will touch in week 1. The descriptions below match the screenshots in the live pilot at https://meddata.eyadrasmi.com.

5 · Demo credentials

Two pre-seeded users are in the live pilot. Use these to walk through the full customer demo. All credentials below are sandbox-only; the production deployment has separate credentials managed by the customer's IT.

The meddata-pilot org has one published study (SUMC-CV-2026, Cardiovascular Outcomes in Kuwaiti Adults) with 5 instruments, 19 records, 24 subjects, 2 sites (DEFAULT + KWI-02), 1 visit scheduled, and 8 in-flight DSARs.

6 · Production readiness

The platform is run-ready for a single-org deployment. The following items are in scope for the first 6 weeks of post-signoff operations.

7 · EU Annex 11 evidence

The formal Annex 11 CSV is the artifact a regulator / inspector reads. It catalogs every module with its risk class, the test counts that constitute the validation evidence, and the mapping to 21 CFR Part 11. The current state is at docs/annex-11-csv.md.

157 / 157 tests pass on the live pilot at https://meddata.eyadrasmi.com. The validation evidence is the test count: every behavior the system is contracted to perform is exercised by at least one test.

8 · Go-live timeline (4 weeks)

A single-org pilot → production go-live takes 4 weeks of effort on the customer's side, run in parallel with the customer's IT onboarding. Each step has a single responsible role on each side.

1. Week 1, Day 1–2 — Customer IT onboarding. Provision the Postgres database (or accept a managed Postgres from MedData). Provision the SMTP relay (SendGrid / Postmark / SES). Provision the storage bucket (S3 / R2). Provision the DNS for meddata.{customer-domain}.com. The customer's IT fills in .env.production with the connection strings.
2. Week 1, Day 3 — Brand + content pass. Replace the brand assets in brand/logos/ with the customer's. The CSS-token swap is 1 file. Edit the cover + Arabic-review brief in docs/dr-ahmad/. Translate the 610-entry glossary to the customer's local language (3 days if new locale).
3. Week 1, Day 4–5 — SSO / IT integration (optional). If the customer wants SAML / OIDC SSO, this is the week to wire it. LDAP / AD support is on the Enterprise roadmap.
4. Week 2, Day 1–3 — Study design + instruments. Customer's data manager seeds the first study. Build the instruments + field set + branching rules. This is the bulk of the work; expect 1–2 days per instrument.
5. Week 2, Day 4 — Validation pass. Run the 157-test Jest suite against the customer's Postgres + SMTP + S3. Walk the customer through docs/annex-11-csv.md + the operator runbook. Sign the validation report.
6. Week 3, Day 1–5 — Pilot data entry. Customer's data entry team uses the platform. 50 records, 5 sites, 3 visits per subject. Expected issues: missing validation rules, ambiguous labels, slow site picker. All fixable in <1 day each.
7. Week 4, Day 1 — Pilot signoff. Customer's data manager + data protection officer + clinical lead sign the pilot report. Standard template in docs/.
8. Week 4, Day 2–4 — Go-live cutover. Promote the pilot DB to production. Switch DNS. Send the welcome email. Onboard 10–25 power users.
9. Week 4, Day 5 — Go-live review. 30-day, 60-day, 90-day reviews. The first review covers what worked, what didn't, and what the next sprint (Wave 4 ePRO + subject portal, or Wave 5 RTSM) should include.

9 · Go-live cost breakdown

Single-org pilot + first year of operations. The pricing assumes a single Postgres instance on a small VPS (or managed Postgres from MedData) and a single SMTP provider.

10 · Sign-off block

To proceed with the pilot, three roles on the customer side must sign below. The MedData side signs the platform readiness at the bottom.