Clinical Trial Data Management: From Protocol to Database Lock

Clinical trial data management is the process of collecting, checking, correcting, and locking study data so the final analysis runs on records you can trace to each participant. Your research partner, usually a contract research organization (CRO), runs most of it.

Several decisions still sit with you as the sponsor: what gets collected, which rules clean it, and when the database closes. In a wellness study, they decide whether the dataset can back a claim when someone asks to see it.

Below is each stage, with what to check, so you can approve a data plan knowing what you signed.

What data management covers in a wellness study

Most guides to clinical data management are written for drug sponsors preparing a submission to regulators. A supplement study designed only to look at effects on the body’s structure or function generally does not need an Investigational New Drug (IND) application, according to Food and Drug Administration (FDA) guidance from 2013. A study of a supplement’s effect on a disease is a different matter and requires an IND.

Skipping the IND does not lower the bar for the data. Three things change for a health and wellness brand or an ingredient manufacturer:

• ●The audience changes. Your dataset may be examined by your regulatory counsel, by journal reviewers if you publish, and by the FTC if an advertised claim is questioned.
• ●Studies without peer review get a closer look. The FTC’s Health Products Compliance Guidance (December 2022) says research without rigorous peer review faces greater scrutiny, and that the agency will often ask the advertiser for raw data and source documents.
• ●The data arrive from home. Wearables, app surveys, and at-home lab kits send records on each participant’s schedule, so reconciliation and missing-data rules carry more weight than they would in a clinic.

The reference for the process itself is ICH E6(R3), which the International Council for Harmonisation (ICH) finalized in January 2025 as its standard for good clinical practice. Its data governance section covers the full life cycle, from capture to archiving, and scales the effort to how critical each data point is.

Know who handles each part of the data

Most published guides list long rosters of data roles written for global drug trials. A wellness study usually needs five, and you should know who fills each one before the contract is signed.

Your own role sits outside the table. You approve the plan and the lock criteria, you receive the agreed updates, and you leave edits to the people who entered the data (more on that in the questions below).

Follow your data through three stages

Most published guides describe the same three phases: start-up, conduct, and close-out. What they leave out is what you, as the sponsor, should see at each one.

Stage 1. Set up before the first participant enrolls

Problems that surface at lock often trace back to choices made, or skipped, at this stage.

• ●Data management plan. Your partner writes a plan stating what is collected, from which source, in which system, and how each item gets checked. ICH E6(R3) points to a document like this as the place for a data flow diagram.
• ●Case report forms. Every field on the case report form should trace back to an endpoint or a safety need in the protocol. Fields with no purpose add queries and cost without adding evidence.
• ●Database build and testing. The capture tools are tested against the protocol before go-live. The guideline asks for them to be validated and ready before the study needs them.
• ●Edit checks. Automated range and logic checks run as data come in, so an impossible value raises a query the day it appears. A sleep duration of 19 hours or a survey answer outside its scale should never wait until close-out.
• ●Transfer specifications. Each external feed (lab results, wearable exports, survey responses) gets a written spec covering format, frequency, and how files will be reconciled.
• ●Access and blinding roles. The plan names who can see treatment assignment and who can change which data. In a blinded study, the people handling queries should stay blinded.

Stage 2. Clean the data while the study runs

Cleaning is continuous. A partner who saves it for the end is saving you a larger problem.

• ●Queries. Discrepancies go back to the participant or the study team for confirmation, and every answer and change is kept.
• ●Reconciliation. Records from each external source are matched against enrollment and timepoint records on a schedule. ICH E6(R3) expects reconciliation wherever data move between systems.
• ●Safety events. Events reported through check-ins or the app are matched between the safety records and the study database, then coded to standard terms.
• ●Audit trail review. Someone reviews who changed what, and when, on a planned basis scaled to risk. The trail itself should never be switched off.
• ●Corrections. Each correction is attributed to a person or system, justified, and supported by the source record from around the time of the original entry.
• ●Early signals. On Reputable’s decentralized studies, participants use their own wearables at home, with data logged continuously instead of reconstructed later.

Stage 3. Lock the database before anyone sees results

Lock is the point after which the data are treated as final. The order of operations matters more here than anywhere else.

• ●Final reconciliation and coding. Open queries are closed, feeds reconciled, coding finished, and protocol deviations listed with their likely impact.
• ●Analysis sets. Who belongs in each analysis set, and why anyone is excluded, follows criteria written into the protocol or the statistical analysis plan before lock. An intent-to-treat analysis keeps participants in the groups they were first assigned to, even if they stopped the product early.
• ●Restricted edit access. Before the final analysis, and before unblinding in a blinded study, the ability to edit the data is shut off.
• ●Lock sign-off. Completion of every pre-analysis step is documented and signed, so the record shows the dataset was finished before results were known.
• ●Changes after unblinding. These should be rare, justified, captured in the audit trail, and reported in the study report.
• ●Archive. The data and their metadata are stored so they stay readable and protected from changes for the full retention period.

Prepare wearable data before it reaches the database

Consumer wearables record around the clock, and most of the decisions that make their data usable are made outside the database. Most data management guides skip this layer.

• ●Choose the device for the endpoint. A sleep endpoint needs a device participants keep on overnight; a daytime activity endpoint may not. Settle the device before the data plan is written, since the plan depends on what the device exports.
• ●Keep raw measures beside the scores. Reputable’s protocols use raw measures, such as nightly heart rate variability (HRV) and resting heart rate read against each participant’s own baseline, rather than composite device scores.
• ●Log every software update. FDA’s guidance on digital health technologies for remote data acquisition (December 2023) asks sponsors to record when each device was updated and what changed, since an update, including a phone operating system update, can shift measurements. The guidance was written for medical product trials, and the same log is worth keeping in a wellness study where participants wear their own devices.
• ●Fix the clock. ICH E6(R3) asks for date and time stamps that cannot be misread and gives coordinated universal time (UTC) as an example. Participants in different time zones, and nights of sleep that cross midnight, need a written rule for which date each record belongs to.
• ●Check syncs during the study. The same FDA guidance asks sponsors to confirm that data are being collected and synchronized as planned. A gap found in week two can be fixed with the participant; a gap found at lock is permanent.
• ●Write wear-time rules before lock. Define what counts as a valid night or day of data, how many valid days a participant needs per week, and how missing days are handled in the analysis.

Wearable records are measurements for research. They are not used for diagnosis, and the study report should present raw values next to any vendor score it mentions.

Review the data management plan before you approve it

You do not need to be a data manager to read the plan. Ask for it before enrollment and check each part against this table with your regulatory lead.

Know what clean data cannot fix

Good data management makes a study’s record accurate. The design still decides what that record can show.

• ●Design limits stay in place. Clean data cannot add a control group the protocol left out. A single-arm pilot measures change over time and cannot show that the product caused it, and whether a pilot can support a claim depends on its design and findings.
• ●Searching after the fact does not count. The FTC expects primary and secondary outcomes to be set before the study starts. If the main comparison comes back flat, combining the locked data for a smaller group that looked better gives you an idea to test next, and the FTC generally does not treat it as support for a claim.
• ●Missing measurements stay missing. Nights when a ring sat on the charger can be handled statistically, as the plan specifies. They cannot be turned back into observations.
• ●A finding is still not a claim. A positive finding is not guaranteed, and a clean result still has to be read correctly; the guide to reading clinical trial data covers between-group and within-group results. Turning a result into claim language is work to do with qualified regulatory counsel.

Where Reputable fits

Reputable Health is a full-service decentralized CRO for health and wellness brands and ingredient manufacturers. The guidance above applies to whichever partner you choose.

• ●Model. Remote participation and data collection, with study design, timelines, and costs tailored to the research question.
• ●Measurement. Consumer wearables (Oura, WHOOP, Apple Watch, Garmin, Fitbit), validated surveys, and at-home lab kits processed through CLIA-certified partner laboratories.
• ●Operations. Reputable tracks adherence throughout the study, and the study report includes safety and adverse event reporting.
• ●Review. Studies go through independent Institutional Review Board review, and the review pathway follows the study design.
• ●Deliverables. You receive a complete study report and a participant-level dataset with a data dictionary, subject to the protocol, consent, and agreed data-access scope.
• ●Scope. Every study is scoped to your product or ingredient, your claims, and your budget.

Frequently Asked Questions

Brand and ingredient teams tend to raise these questions when they first see a data management plan.

The bottom line

Clinical trial data management is the part of a study nobody notices until someone asks for the raw data. Set the plan, the checks, and the lock criteria before enrollment, and the record will show what happened to every value.

Your next step: ask your partner for the draft data management plan and walk through the seven rows above with your regulatory lead before the protocol goes to the IRB.