Governed study record
The study record on the server is the only authority for a study. The browser shows and edits that record, but nothing kept in the browser can decide a study's protocol, consent, enrolment, launch or results.
This matters because a research record has to stay coherent when several people on the team work at once, when a panelist follows a link from an email, and when the protocol has to change after launch.
Sign-in and access
Staff sign in with a link sent by email. There is no password and no self sign-up; a person joins a workspace when they are invited. Each deployment serves one organization.
Access inside a study comes from study roles: principal investigator, steering committee, steering confirmer, coordinator, coder, adjudicator and biostatistics. A person can hold more than one role. See Roles and access and Study team.
The main boundaries are:
- Every page, form action and download checks the session and the person's role on the server. Hiding a button is never the control.
- A study the person may not see reads exactly as one that does not exist: no title, owner or figure is shown.
- An organization administrator holds no study authority without a study role.
- Panelists never sign in. They use signed links that work only for their own invitation, consent and rounds.
Saving and conflicts
Each Setup section is saved as one versioned document with an append-only revision history. A save carries the version it was made from. If a colleague saved the same section in the meantime, the later save is refused rather than merged, so nobody's work is silently overwritten. The page then shows the current version so the change can be reapplied.
Panelists' answers work the same way. Each answer is saved against the version the page loaded, and an answer changed meanwhile in another tab or device is not overwritten.
Identity and pseudonyms
Names and email addresses are stored sealed, in a separate place from answers and results. A person's name is shown only while they are being recruited, and only to roles allowed to see it. After enrolment, ordinary study screens show a pseudonym such as "ABC-0004".
That is not a claim that every download is pseudonymized. Study-report CSVs omit panelist names and email addresses. Two downloads available to a principal investigator contain them: the identifiable panelist list, which requires a written reason, and the results-request list. The organization audit download can contain a staff member's display name. It is not a panelist list.
Revealing an enrolled person's name takes a written reason and is audited, including refusals. A coordinator can only request a reveal; a principal investigator or an administrator approves it, and the requester can never approve their own.
Imports
Imports show a preview and validate the whole file before anything changes.
| Import | Required | Also accepted |
|---|---|---|
| Statements (Item bank) | A Statement column | Area, status, source, setting. Duplicates and empty rows are shown and skipped. Up to 500 statements at a time. |
| Panelists | Name and email | Organization, group, notes and the study's participant fields. Columns that are not recognised are listed as not imported. Up to 500 rows. |
Comma, semicolon and tab separators are detected. A panel import never sends an invitation: selecting, inviting, consent and enrolment stay separate steps.
Ethics documents
The ethics review is recorded in Setup: approved with its reference number and contact, exempt with who determined it, or not required with the reason. Approval documents are recorded as entries; files are not uploaded. A missing required document, an expired approval or a missing ethics decision blocks launch. Only the principal investigator can waive a document, with a reason.
Consent and enrolment
Joining a study is separate records, not one automatic path. A person is enrolled only after they are approved. If they declined the invitation, they have to accept a new one before enrollment. If they declined consent, they have to agree before enrollment. When the study requires consent before enrollment, consent has to be recorded first. When it does not, enrollment can happen while consent is still pending. When screening is on, the eligibility assessment has to be recorded as eligible before enrollment.
- A consent form is published as a numbered version. The published history cannot be rewritten, and the version number cannot go backwards. The editor refuses free-text edits once recruitment is open, which launch turns on. The server check that compares frozen Setup fields does not compare every consent wording field, so that editor lock is not a refusal of every possible save. No invitation can be queued while no version is published.
- Consent is the person's own act on a published version. Consent, decline and withdrawal are append-only records.
- Publishing a new version does not re-ask earlier agreers automatically and emails nobody.
- When screening is on, a person must be recorded as eligible before they can be enrolled.
Email
What is sent depends on the deployment's settings. With sending unset, nothing is sent. Live sending to the whole panel is refused outside production. A deployment that is not production can still deliver to an allowlist when that mode is turned on.
Delivery words are kept apart: Queued, Accepted by provider, Delivered (only when the provider reports it), In test inbox, and Prepared by you. Opens and clicks are never tracked. A person who stops a study's emails is told apart from a person who withdraws.
Launch and amendments
Launch is a separate action from creating a draft, and it does not send an invitation. The server accepts it only while the study is still a draft, only from a person who may edit Setup, and only when the ten ready steps count as ready. Review & launch is the eleventh screen and is not one of those ten. A step marked Needs attention still counts as ready. A step marked Blocks launch or Required later does not. Launch is also refused when a Study team error is open, when the round plan has no rounds, or when counted groups cannot meet the Round 1 group check until that fact is explicitly acknowledged. In the role matrix, Setup edit belongs to the principal investigator. Launch creates the planned rounds and marks the study active.
Not every configuration field becomes immutable at launch. A control the screen hides is not the same thing as a save the server refuses. A lock that starts when a round opens is not the same thing as a lock that starts at launch.
Frozen at launch, including against a consensus amendment. The scale, the zones, the consensus method, and the spread measure cannot be changed by an ordinary edit or by the consensus amendment. The same launch boundary covers the identity confirmation, the retention policy, the withdrawal terms, the protocol document, and a document waiver; eligibility, screening, profile fields, disclosure timing, the authorship policy choice, and the late-enrollment policy; the method as it was launched; and the analysis plan. Other publication wording is not part of that authorship-policy comparison. Subgroup-comparison settings are saved with the rating rules and freeze with them. They do not compute a subgroup comparison. The pilot freezes at launch as well.
Still editable after launch, or locked only later. Size & mix, apart from the late-enrollment policy, and geography are not in that launch comparison. Stability settings can still be saved, and they do not compute stability. The consent editor refuses free-text edits once recruitment is open; the server comparison described above does not itself compare that free text. A round's time zone locks when round 1 opens. The late-response policy locks when round 1's collection closes. A round's comment policy, whether it takes suggestions, how its questions are shown, and the time panelists were told it takes all lock when that round opens.
What a recorded amendment can still change. Each of these needs a written reason of 10 to 500 characters. None of them re-judges a round that has already been rated. Those rounds keep the rules they were rated under.
- The consensus numbers, from the next round that has not opened: the retain percentage, the exclude percentage, the interquartile-range limit, the minimum number of numeric ratings, whether a median condition is on, and the two median cutoffs. This amendment is refused for a RAND/UCLA study. It is also refused while the protocol rule set is on.
- The stopping rule. It is advice shown with the round plan. It does not move a round by itself.
- One further rating round, added by the principal investigator after the last round's decisions are confirmed. The new round is still prepared, approved, and opened on its own. The plan the method confirmation signed stays the launched plan.
- A correction to a statement's primary subgroup, taking effect from a round that has not opened.
There is no consensus amendment for the scale, the zones, the consensus method, or the spread measure.
Rounds and results
- A round is approved by the principal investigator. The approval is bound to the round's content, its rules, the consent version, and the schedule. For a later rating round it is also bound to the feedback it was approved against, including the results version, the feedback switches, the sharing choice, and the smallest reportable group. A relevant change makes the approval stale.
- Content is frozen when the round opens, and the round's panel is set at that moment. If the study's late-enrollment policy is approval, the screen says an investigator can include someone after that, with a recorded reason. Otherwise someone who becomes eligible after opening is not added to that round.
- Results are computed after collection closes and stored as sealed versions. The seal is checked whenever results are read. If it fails, the results are not shown, decided on or exported.
- A correction is a new results version with a reason. Finalized research data is never changed in place.
Audit in the same transaction
Every governed change and its audit entry are written in one database transaction, so a change cannot happen without its entry, and a refused change does not leave a success entry behind. The study audit download does not contain panelist names or email addresses: a panelist appears by pseudonym, and a team member by a reference. The study audit page can show a team member's name. The organization audit download can contain a staff member's display name. Entries do not carry a panelist's answer, comment, or message body. If the chain does not verify, the study audit page says so and still lists the rows, and the download still proceeds. See Audit trail.
Completion
Completing a study is one-way and only the principal investigator can do it. The button that opens the confirmation is Complete this study…. The heading is Complete this study now? and the confirm control is Yes, complete the study. Setup becomes read-only. Reporting can still be read and downloaded. An approved removal writes a new results version and keeps the earlier one. Retention and deletion requests stay available on the Completion page. See Completion and retention.