Data Protection

Security in Accordance with MDR Requirements

Security is not an additional feature. It is an integral part of medical device development.

Data Protection & Information Security

RUMA incorporates data protection and information security into the development, operation and monitoring of its digital medical device from the outset.

The MDR requires medical device software to address risk management, information security, verification and validation throughout the software lifecycle.

1. Secure Software Development

Security from the outset

• Development in accordance with the state of the art
• Defined software lifecycle
• Documented security requirements
• Software verification and validation

Benefit: Security is not added retrospectively but is an integral part of product development.

MDR: Annex I, Chapter II, Section 17.2MDR: Anhang I, Kapitel II, Abschnitt 17.2

2. INFORMATION SECURITY

Protecting sensitive information as a product requirement

• Protection of confidentiality
• Protection of information integrity
• Secure processing
• Protection against unauthorised access

Benefit: Sensitive information is processed within a regulatory framework with defined security requirements.

MDR: Annex I, Chapter II, Sections 17.2 and 17.4

3. Access Protection

Access for authorised users only

• Defined user roles
• Regulated permissions
• Controlled system access
• Protection against unauthorised access

Benefit: Access to system functions and information is restricted and can be controlled.

MDR: Annex I, Chapter II, Section 17.4

4. RISK MANAGEMENT

Identify, assess and control risks

• Systematically identify risks
• Assess risks
• Define appropriate protective measures
• Verify the effectiveness of these measures
• Continuously incorporate new findings

Benefit: Security risks are addressed throughout the entire product lifecycle rather than at isolated points.

MDR: Annex I, Chapter I, Section 3

5. Verification & Validation

Security must be demonstrable

• Requirements are documented
• Functions are tested
• Security measures are reviewed
• Software is verified and validated before deployment
• Changes are subject to controlled processes

Benefit: Both system functionality and secure operation are systematically verified.

MDR: Annex I, Section 17.2; Annex II, Section 6

6. Security Throughout the Product Lifecycle

Develop → Test → Monitor → Improve

• Responsibility does not end when the product is placed on the market.
• Ongoing monitoring
• Assessment of emerging risks
• Controlled updates
• Corrective and improvement measures
• Post-market surveillance
• Continuous development

Benefit: The security of the medical device continues to be assessed throughout its operational life.

MDR: Article 10(9), Articles 83 et seq. and Annex III

THE ADVANTAGES

For patients

Protection of sensitive information · controlled access · secure digital processes

For organisations

Traceable security structures · clearly defined responsibilities · verifiable processes

For RUMA

Security as an integral part of the medical device – from development to post-market surveillance.

Sources

Regulation (EU) 2017/745 on medical devices (MDR):

• Annex I, Chapter I, Section 3 – Risk management
• Annex I, Chapter II, Section 17.2 – Software lifecycle, risk management including information security, verification and validation
• Annex I, Chapter II, Section 17.4 – IT security requirements and protection against unauthorised access
• Annex II, Section 6 – Product verification and validation
• Article 10(9) – Manufacturer's quality management system
• Articles 83 et seq. / Annex III – Post-market surveillance

RUMA manufacturer registration: Ruma GmbH is registered in EUDAMED as a manufacturer under SRN DE-MF-000011426.

Medical Device under the MDR/ISO 13485

RUMA develops and assumes responsibility for its digital medical device within the European medical device regulatory framework.

The focus is on manufacturer responsibilities, intended purpose, technical documentation, quality management, risk management and product monitoring throughout the entire lifecycle.

Not Just Software. A Medical Device with Clearly Defined Manufacturer Responsibilities.

MDR · Class I · EUDAMED · Quality Management · Technical Documentation · Risk Management · Post-Market Surveillance

1. Regulated Use Rather Than Ordinary Software

• Defined intended purpose
• Specified scope of application
• Defined users
• Clearly delimited product functionality
• Regulatory requirements for safety and performance

Benefit: The RUMA Digital-System is subject to a regulated medical device development and management process.

MDR: Regulation (EU) 2017/745

2. Manufacturer Responsibilities

Clear responsibility for the product

Ruma GmbH is registered in EUDAMED as a manufacturer.

• Manufacturer status
• Unique registration
• Regulatory responsibility
• Competent authority
• Responsible organisation

Ruma GmbH – SRN DE-MF-000011426.

Benefit: Responsibility for development, quality, safety and monitoring is clearly assigned to the manufacturer.

3. Class I Medical Device

Classification under European medical device legislation.

The available TÜV certificate explicitly includes activities relating to the manufacture and placing on the market of Class I digital medical devices within its certified scope.

Benefit: Development and placing on the market take place within defined regulatory structures.

4. QUALITY MANAGEMENT

Quality through controlled processes

• Defined responsibilities
• Documented procedures
• Controlled changes
• Regulated approvals
• Continuous improvement

The available TÜV certificate confirms a quality management system in accordance with ISO 9001:2015.

Benefit: Quality is systematically organised and managed in a traceable manner.

5. Technical Documentation

The medical device must be comprehensively described and supported by evidence

The MDR requires structured technical documentation, including:

• Product description
• Intended purpose
• Design and development
• Safety and performance requirements
• Risk management
• Verification and validation

MDR: Annex II

Benefit: Safety and performance must be documented and supported by traceable evidence.

6. Risk Management

Systematic control of risks

• Identify risks
• Assess risks
• Define measures
• Monitor effectiveness
• Assess residual risks
• Incorporate new findings

MDR: Annex I, Chapter I, Section 3

Benefit: Medical device safety is considered throughout the entire product lifecycle.

7. Verification & Validation

Not just development – demonstrable compliance

• Define requirements
• Verify functions
• Document results
• Demonstrate safety and performance
• Assess changes through controlled processes

MDR: Annex II, Section 6

Benefit: The product must demonstrably fulfil its intended requirements.

8. Post-Market Surveillance

Manufacturer responsibility does not end with market launch

• Collect experience from practical use
• Assess emerging risks
• Identify trends
• Initiate corrective actions
• Continue developing the product and its documentation

MDR: Articles 83 et seq. and Annex III

Benefit: Safety and performance continue to be monitored after the product has been placed on the market.

The Benefits

For users

Clearly defined functionality · regulated use · traceable product responsibility

For organisations

Regulatory framework · documented quality · structured risk management

For RUMA

Manufacturer status · controlled product development · documented conformity · responsibility throughout the product lifecycle

Sources

Regulation (EU) 2017/745 on medical devices (MDR), particularly Article 10, Articles 83 et seq., Annex I, Annex II and Annex III.

RUMA supporting documentation:

EUDAMED – Ruma GmbH, registered manufacturer, SRN DE-MF-000011426

TÜV Rheinland – ISO 9001:2015 certification, with a scope including Class I digital medical devices

Documented. Traceable. Verifiable.

Technical Documentation · Traceability · Updates · Verification · Change Records · Post-Market Surveillance

The MDR requires product information, supporting evidence and changes to remain clearly documented and traceable throughout the entire product lifecycle.

1. Clear Documentation

Information must be easy to locate and understand

Under the MDR, technical documentation must be presented in a clear, organised, readily searchable and unambiguous manner.

• Structured documentation
• Clear attribution
• Traceable supporting evidence
• Clear product description

Benefit: Relevant information can be clearly identified and verified at any time.

2. Traceability

Products and documentation remain uniquely identifiable

The MDR requires clear product identification and explicitly establishes the UDI system as a basis for traceability.

• Unique product identification
• Attribution of product information
• Traceable product versions
• Traceability throughout the lifecycle

Benefit: It remains possible to determine which product and which version are covered by a particular document.

3. Up-to-Date Technical Documentation

Documentation must evolve with the product

Manufacturers must prepare and keep technical documentation up to date.

• Current product description
• Current safety and performance evidence
• Current risk analysis
• Current verification and validation evidence

Benefit: Documentation reflects the relevant current product status rather than merely a historical version.

4. Documented Development

Development stages must remain traceable

Annex II requires information that makes it possible to understand the device's design stages, together with complete information on manufacturing processes and their validation.

• Documented development stages
• Traceable product design
• Documented validation
• Complete supporting evidence

Benefit: The product's development history and significant decisions remain traceable.

5. Verification & Validation

Claims must be supported by evidence

Technical documentation must include evidence demonstrating compliance with the general safety and performance requirements, including verification and validation.

• Document requirements
• Demonstrate implementation
• Document testing
• Record results in a traceable manner

Benefit: Both the product's status and the evidence supporting its conformity can be verified.

6. Changes Remain Traceable

A medical device is not a static product

The MDR framework requires technical documentation and quality management to be continuously adapted to product changes and new findings. Manufacturer obligations include maintaining a quality management system throughout the product lifecycle.

• Control changes
• Assess their impact
• Update supporting evidence
• Adapt risk assessments

Benefit: Changes are implemented through documented processes rather than without control.

7. Post-Market Documentation

Real-world use is documented too

The MDR requires separate technical documentation for post-market surveillance. This documentation must also be clear, organised, readily searchable and unambiguous.

• Information recorded includes:
• Incidents
• Complaints and user feedback
• Trends
• Field safety corrective actions
• New findings from the market

Benefit: The product documentation does not end with market launch.

8. Continuous Chain of Evidence

From development to post-market surveillance

Intended Purpose → Development → Testing → Approval → Use → Monitoring → Updating

Every relevant product version must remain documented, identifiable and verifiable.

The Benefits

For organisations

• Traceable product information
• Clear documentation status
• Verifiable evidence

For inspections and audits

• Structured records
• Clear attribution
• Up-to-date documentation
• Traceable product development

For the manufacturer

• Controlled product lifecycle
• Traceability
• Documented changes
• Reliable regulatory evidence

Sources

Regulation (EU) 2017/745 on medical devices (MDR):

• Article 10(4) and (9) – Technical documentation and quality management
• Annex II – Technical documentation
• Annex III – Technical documentation on post-market surveillance
• Article 27 / Annex VI – UDI and traceability
• Articles 83 et seq. – Post-market surveillance

LEGAL CERTAINTY

Clear Rules. Clear Responsibilities. Reliable Evidence.

RUMA operates within the binding European regulatory framework for medical devices.

The MDR defines requirements for manufacturer responsibilities, safety, quality, technical documentation, risk management, traceability and post-market surveillance.

This provides a transparent regulatory framework for the development, use and monitoring of the medical device.

1. Binding Legal Framework

Harmonised European requirements

• Regulation (EU) 2017/745
• Binding manufacturer obligations
• Defined safety and performance requirements
• Regulated market surveillance

Benefit: The medical device does not operate in an unregulated digital environment but within a clearly defined European legal framework.

MDR: Articles 1 and 10; Annex I

2. Clear Manufacturer Responsibilities

Responsibility is clearly assigned

Ruma GmbH is registered in EUDAMED as a manufacturer.

• Clearly identified manufacturer role
• Defined regulatory obligations
• Responsible organisation
• Competent authority
• Unique manufacturer identification

Benefit: Responsibility for safety, quality and conformity is clearly assigned.

Ruma GmbH – SRN DE-MF-000011426.

3. Defined Intended Purpose

Clear boundaries rather than unrestricted use

A medical device is developed and assessed for a specified purpose.

• Defined application
• Defined users
• Defined functions
• Clear product boundaries

Benefit: It is clear what the product is intended for and within which boundaries it may be used.

MDR: Article 2 and Annex II

4. Demonstrable Conformity

Requirements must not only be met but also documented

• Technical documentation
• Safety and performance requirements
• Risk management
• Verification
• Validation
• Documented supporting evidence

Benefit: Regulatory claims are based on documented evidence rather than unsupported manufacturer statements.

MDR: Annexes I and II

5. Documented Accountability

Decisions and processes remain traceable

The MDR requirements for quality management and technical documentation establish a clear process structure:

• Defined responsibilities
• Regulated approvals
• Documented changes
• Controlled processes
• Traceable product versions

Benefit: During inspections, it is possible to establish who was responsible for what, when and on what basis.

MDR: Article 10(9) and Annex II

6. Traceability

Product information must remain clearly attributable

Through UDI and EUDAMED, the MDR provides mechanisms for identifying and tracing medical devices.

• Unique product identification
• Manufacturer attribution
• Traceable product information
• Regulatory traceability

Benefit: The product, its manufacturer and relevant regulatory information can be clearly linked.

MDR: Article 27 and Annex VI

7. Post-Market Surveillance

Legal responsibility does not end at market launch

• Post-market surveillance
• Assessment of new findings
• Incidents and trends
• Corrective actions
• Updates to risk assessments

Benefit: The manufacturer remains responsible for monitoring safety and performance throughout the product's use.

MDR: Articles 83 et seq. and Annex III

8. Reliable Chain of Evidence

From development to post-market surveillance

Intended Purpose → Development → Risk Assessment → Testing → Documentation → Placing on the Market → Monitoring

This brings together the preceding areas:

Data Protection → Protected information

Medical Device → A product subject to regulatory manufacturer responsibilities

Audit-Ready Documentation → Documented and traceable evidence

Legal Certainty → A clear legal framework and reliable structures for responsibility and evidence

The Benefits

For patients

• Clearly defined responsibilities
• Regulated product standards
• Traceable safety requirements

For organisations

• Reliable regulatory foundation
• Traceable documentation
• Clear responsibility structures
• Verifiable evidence

For RUMA

• Clearly established manufacturer status
• Documented conformity framework
• Controlled product lifecycle
• Reliable regulatory evidence

Sources

Regulation (EU) 2017/745 on medical devices (MDR):

• Article 10 – Manufacturer obligations
• Article 27 – UDI system and traceability
• Articles 83 et seq. – Post-market surveillance
• Annex I – General safety and performance requirements
• Annex II – Technical documentation
• Annex III – Post-market surveillance documentation
• Annex VI – Registration and UDI

RUMA supporting evidence: Ruma GmbH is registered in EUDAMED as a manufacturer under SRN DE-MF-000011426.