KCL-00001686 · BID EVIDENCE

Research operations,
with every decision visible.

A complete researcher and clinician workspace across participant operations, governed study configuration, connected data, safety, AI operations, analysis, and trust. One canonical study dataset keeps every number, status, date, and identifier consistent across all 70 screens.

Open live dashboard Open questionnaire suite

ACCEPTANCE EVIDENCE

The rebuild checks itself.

These checks are computed from the route manifest and contract registry. A missing contract, state, trace or questionnaire route fails visibly here.

PASS Anti-cloneEvery primary route has a unique content contract; generic section labels removed.

PASS Contract coverage70 of 70 primary routes contract-backed.

PASS Canonical truthGWS-234 Garmin routes not set up; register corrected; dashboard composition present; 2026 operational dates.

PASS StatesEvery screen links alternate prerendered states; hero-path screens carry three or more.

PASS QuestionnairesQ1–Q6 live; Q2 contains all 14 answer patterns; simulation links Q4, Q5 and schedule.

PASS LanguageNo personal names, filler copy, or banned generic action labels.

PASS TraceabilityEvery screen retains an ITT tag; coverage includes Q1–Q6 and 62b.

CAPABILITY COVERAGE

Every ITT requirement has a route.

The matrix includes the questionnaire suite and proactive daily exceptions view.

5.1 Participant experience7, 8, 9, 10, 11, 12, 17, 18, Q1–Q6, 21, 22

5.2 Study operations5, 13, 14, 15, 16, 19, Q1–Q6, 22, 23, 24, 25, 39, 40, 64

5.3 Randomisation & adaptive designs26, 27, 28, 29

5.4 Data acquisition & integration20, 30, 31, 32, 33, 34, 35

5.5 Data spine & interoperability36, 37, 38, 60

5.6 AI-enabled participant support47, 48, 49, 50, 51, 52, 53

5.7 Researcher & clinician tools3, 4, 5, 6, 9, 41, 44, 52, 62, 62b

5.8 Secure analysis environment54, 55, 56, 57

5.9 Clinical safety & safeguarding11, 21, 41, 42, 43, 45, 46

5.10 Trust fabric1, 58, 59, 60, 61

§8 Service levels · §7 SDLC46, 63, 64

WORKSHOP HERO PATH

One governed story, end to end.

Participant operations, consent-scoped sensing, isolated safety, human-led AI, configuration, simulation, approval, localisation and release.

COMPLETE PRODUCT SUITE

70 screens. Nothing cloned.

Each card links its primary screen and every named alternate state.

Shell & entry

4 screens

01 · /signin

Sign-in with passkey

Phishing-resistant MFA moment. Passkey card, hardware-key fallback. 5.10.

5.10

Statesstep up

02 · /studies

My Studies

Multi-study home proving multi-tenancy. Study cards with phase chips and capacity mini-bars. §2.

§2

Statesempty filtered new study

03 · /search

Global search

Cross-entity search, pseudonymised results. 5.7.

5.7

Statesno results participant only audit only

04 · /notifications

Notification centre

Role-scoped, severity-ordered. 5.7.

5.7

Statesfiltered to safety all read unread

Dashboard & participants

8 screens

05 · /dashboard

Study dashboard

Operations at a glance: KPI row, recruitment funnel, composition, engagement, channel coverage. 5.2, 5.7.

5.25.7

Statesdegraded filtered site calm

06 · /participants

Participants register

220 rows: status, survey/visit progress, device-health chip per row, filters, bulk actions. 5.7.

5.7

Statesfiltered bulk empty search

07 · /participants/onboarding

Participant onboarding journey

NEW. The full onboarding funnel (312 invited → 21 first-data) with per-stage drop-off, stalled list (GWS-231), and median time-per-stage. Answers "where do participants get stuck" at a glance. 5.1.

5.1

Statesstage drilldown stalled only completed

08 · /participants/GWS-234/journey

Participant onboarding timeline

NEW. One participant's onboarding as a vertical timeline: invited → registered → consented → first sync → countersigned → silent. Every step timestamped from the audit trail. 5.1, 5.4.

5.15.4

Stateshealthy comparison audit detail recovered

09 · /participants/GWS-234

Participant 360

Tabs: Screening · Consent · Visits · Surveys · Devices · Documents · Communication log. Pseudonymous header, dyad link. 5.1, 5.7.

5.15.7

Statessurveys communication log devices

10 · /participants/queues

Verification & countersignature queues

122 unverified + 73 awaiting countersignature as two work queues with ages. 5.1.

5.1

Statesbulk verify overdue only empty

11 · /participants/GWS-230/consent

Withdrawal & re-consent

Partial-withdrawal toggles per consent block, re-consent rollout status, humane-withdrawal note. 5.1, 5.9.

5.15.9

Statesfull withdrawal reconsent complete audit

12 · /participants/dyads

Dyads & family linkage

Primary–partner links, child linkage through maternal record, own-consent-own-role. 5.1.

5.1

Stateslink partner unlinked child link

Study Designer: governed configuration

18 screens

13 · /designer

Configuration explorer

NEW · the configurability proof. The entire study as one versioned, editable tree: eligibility, consent, instruments, schedule, sensing, randomisation, notifications, localisation, roles. Every node shows its version badge and last-changed. One glance = "a study is configuration." §2 central idea, 5.2.

§25.2

Statesnode drawer unsigned changes signed only

14 · /designer/new

New study wizard

8 steps: Basics → Eligibility → Consent → Instruments → Schedule → Sensing → Randomisation → Review. 5.2.

5.2

Statesstep 1 step 2 step 3 step 4 step 5 step 6 step 7 step 8

15 · /designer/clone

Clone to new country

NEW · the configurability demo. Garmin Wi-Fi Study duplicated as a Spain deployment: language variant, residency plane, emergency contacts, local pathways, site — switched in one flow, zero engineering. Side panel: "what changed / what carried over." 5.2 localisation, fixed constraint study-first operation.

5.2

Statespost clone validation blocked

16 · /designer/eligibility

Eligibility rules builder

Visual rule composer with calculated fields (Pregnant eligibility · Partner eligibility · Evaluation Engine), preview against synthetic cohort. 5.2.

5.2

Statesrule edit invalid preview

17 · /designer/consent

Consent package builder

Block palette (Title · Statement · Checkbox · Signature · Picture · Input · Multiple choice · Video), granular sub-consents, countersignature toggle, version badge, reading-age meter showing the age-9 pass. 5.1.

5.1

Statesdraft edit es variant unsigned

18 · /designer/instruments

Instrument builder

Branching-logic view, calculated fields, multimedia/diary items, versioning. 5.1, 5.2.

5.15.2

Statesediting invalid signed

65 · /designer/questionnaires

Q1 · Questionnaire library

Six governed instruments with versions, languages, item counts and package use. 5.1, 5.2.

5.15.2

Statesempty filtered import

66 · /designer/questionnaires/item

Q3 · Item editor & logic

Deep item authoring with validation, research binding and isolated safety-trigger routing. 5.1, 5.9.

5.15.9

Statessafety trigger on validation error signed

67 · /designer/questionnaires/logic

Q4 · Branching & flow map

Visual branching, calculated fields and simulation-linked unreachable-path validation. 5.1, 5.2.

5.15.2

Stateswarning present clean calculated fields

68 · /designer/questionnaires/translations

Q5 · Translations & reading age

Per-item EN/ES review, coverage and age-nine readability evidence. 5.1, 5.2.

5.15.2

Statescomplete missing needs review

69 · /designer/questionnaires/preview

Q6 · Preview & versioning

Participant-faithful preview, signed history and in-flight version handling. 5.1, 5.2.

5.15.2

Statespreview item 2 history diff item 3

19 · /designer/schedule

Schedule, phases & visits

Visit windows with deviation tracking, T1–T4 timeline, milestone triggers. 5.2.

5.2

Statesdeviation drawer milestone edit calendar

20 · /designer/sensing

Sensing scopes

Per-study channels and categories; blinded-CGM toggle with participant-hidden preview. 5.4.

5.4

Statesscope change blinded cgm approval pending

21 · /designer/notifications

Notifications & messaging

NEW. Push/email/SMS templates, schedules, quiet hours, safety-critical non-disablable flags, per-language variants. 5.1, 5.7, 5.9.

5.15.75.9

Statestemplate editor es variant quiet hours

22 · /designer/localisation

Localisation console

Country tabs (UK · Spain · Ghana · Peru · Canada): language variants, emergency contacts, support resources, site pathways. "Pathways defined by study teams, enabled by platform." 5.2.

5.2

Statesghana planned uk live incomplete

23 · /designer/simulation

Simulation runner

NEW · promoted to its own screen. Synthetic cohort walks the entire study pre-go-live: simulated event timeline, issues caught (unreachable consent branch · schedule conflict · missing Spanish variant), coverage stats, and a PASS badge that the approval gate requires. 5.2 "safely simulable before go-live."

5.2

Statesrunning fail pass

24 · /designer/approvals

Approval gates

Full-screen gate stepper: Clinical safety → Data protection → Sponsor; simulation-pass shown as a precondition. 5.2.

5.2

Statesblocked pending approved

25 · /designer/versions

Config versions & diff

Version list with signed badges; side-by-side diff v1.3 → v1.4. 5.2.

5.2

Statesrollback confirm diff only signed

Randomisation & adaptive designs

4 screens

26 · /designer/randomisation

Randomisation designer

Simple / blocked / stratified / cluster / crossover / minimisation; stratification factors; server-side concealment notice. 5.3.

5.3

Statessigned summary design picker validation

27 · /designer/adaptive

Adaptive designs: MRT & SMART

MRT decision points, availability rules, decision-record schema; SMART re-randomisation stage map. Hero layout — the ITT says most of the market cannot do this in-platform. 5.3.

5.3

Statesdecision record smart stage 2 policy edit

28 · /designer/blinding

Blinding & emergency unblinding

Blinding-enforcement map across every revealing path; governed emergency unblind with step-up auth and reason capture. 5.3.

5.3

Statesstep 1 step 2 step 3

29 · /designer/allocation-audit

Allocation audit

Seed, version, per-allocation reproducible log, export. 5.3, fixed constraint.

5.3

Statesrole view reproduce export

Devices & data acquisition

6 screens

30 · /devices/fleet

Device fleet

Study-issued fleet: custody chain, provenance-preserving replacement, device version + validation status. 5.4.

5.4

Statesreplacement returned only drawer

31 · /devices/sync

Sync assurance board

Participants × channels grid: live / silent / not-set-up; non-wear vs sync-failure distinction; intervention queue. 5.4.

5.4

Statesfiltered to silent auth expiry healthy

32 · /participants/GWS-234/devices

Participant Devices & Sync

The differentiator: 3 Garmin routes + 2 phone routes as route wires, silent-channel alert, sync history with Sync-to-KCL timestamps. 5.4, SQ30.

5.4SQ30

Stateshealthy participant recovered audit detail

33 · /devices/integrations

Integration catalogue

Live SDK/API integrations (Garmin Companion SDK · HealthKit · Health Connect) and planned classes (CGM · BP · scales · sleep · baby monitor · dynamometer), per-integration typical elapsed time and assurance stepper. 5.4 pass/fail SDK competence.

5.4

Statesnew connector regression due planned

34 · /devices/ehr

EHR connections

NEW. Standards-based EHR integration: FHIR endpoints, connection status, consent-scoped record classes, per-country readiness. 5.4 clinical records via EHR.

5.4

Statesauth expired country readiness scope

35 · /devices/blinded-cgm

Blinded CGM configuration

Participant-never-sees-values config with masked participant preview. 5.4.

5.4

Statesunblinded study safety exception preview

Data spine & interoperability

5 screens

36 · /data/spine

Data spine overview

Ingestion → native high-rate store → FHIR R4 canonical boundary → IEEE 1752.1 mapping → CDISC export; pseudonymisation marked at service boundaries. 5.5.

5.5

Stateslineage degraded boundary

37 · /data/dictionary

Data dictionary

Item, meaning, units, provenance, ICD-10/SNOMED chips, "frontier — convention agreed with KCL" flags for unmapped modalities. 5.5.

5.5

Statesitem detail frontier only search

38 · /data/mappings

Mapping studio

One dataset traced field-by-field through FHIR R4 → 1752.1 → CDISC SDTM. "Demonstrated in working systems." 5.5, fixed constraint.

5.5

Statesunmapped modality field detail validated

39 · /data/releases

Dataset releases

Versioned, receipted releases: checksum, recipient, delivery verification. 5.2.

5.2

Statespreparation reissue verified

40 · /data/queries

Data queries (GCP-grade)

Raised → answered → resolved register; every change references a query; no silent overwrites; aging chart. 5.2.

5.2

Statesraise query aging resolved

Safety & safeguarding: isolated pathway

6 screens

41 · /safety/alerts

Alert inbox

Severity-ordered, SLA timer chips, step-up auth banner, one-click escalation to named on-call. Critical-red pathway treatment. 5.7, 5.9.

5.75.9

Statesstep up empty p1 only

42 · /safety/alerts/AL-2214

Alert detail & lifecycle

Lifecycle rail: generation → prioritisation → delivery with end-to-end receipt timestamps (created → gateway → push provider → device receipt) → acknowledgment → escalation → closure; per-leg cause-of-failure attribution. 5.9 + clarification Q2.

5.9

Statesescalated closed receipt missing

43 · /safety/safeguarding

Safeguarding cases

Validated-instrument trigger, coercive-control and shared-device protections (discreet-mode flag), duty-to-act checklist. 5.9.

5.9

Statescase closed checklist restricted

44 · /safety/adverse-events

Adverse events & incidents

AE/SAE register: clinical events, device malfunctions, AI-related issues, data problems; complete audit trail. 5.7.

5.7

Statesnew ae clinical only closed

45 · /safety/on-call

On-call & escalation

Country-aware rotas, out-of-hours trees per country, signed-off-by-Clinical-Safety-Lead badge. 5.9.

5.9

Stateshandover out of hours spain

46 · /safety/pathway

Pathway health

99.95% board: trailing availability, last DR exercise vs RTO/RPO targets, synthetic full-path monitoring with per-leg latency, error budget. 5.9, §8.

5.9§8

Statesdegraded incident healthy

AI Operations: HAIA

7 screens

47 · /ai

HAIA operations home

Split-of-responsibility banner (KCL owns models/prompts/policies; platform operates the pathway); gateway status; 24h gate stats. 5.6.

5.6

Stateskill switch armed degraded calm

48 · /ai/gateway

Model gateway & pinning

Per-role model assignment as configuration (no hard-wired provider); pinned versions with signed badges; staging/production lanes. 5.6, fixed constraint.

5.6

Statespromote candidate rollback staging

49 · /ai/safety-gate

Safety gate policies

Deliver / hold / block policies; escalation-to-human rules; red-flag, safeguarding, mental-health and pregnancy-complication routing. Header: "No raw model output reaches a participant." 5.6, fixed constraint.

5.6

Statespolicy editor signed blocked only

50 · /ai/artefacts

Artefact registry

Prompts, policies, eval suites, grounding content with citations — all versioned, signed, promoted through gates. "Nothing hot-edited." 5.6.

5.6

Statespromotion blocked artifact detail signed only

51 · /ai/evaluation

Evaluation & experiments

Offline eval runs, A/B and shadow lanes, MRT variant comparison, reproducible outputs export. 5.6.

5.6

Statesfailing run ab detail shadow

52 · /ai/coach

Coach console

Human-in-the-loop queue: review / endorse / rewrite with grounding citations per message. Human-led, AI-supported. 5.6, 5.7.

5.65.7

Statesitem open rewrite empty queue

53 · /ai/controls

Kill-switches & deprecations

Per-capability kill-switches with scope and audit; provider-deprecation board (published notice → re-eval → clinical sign-off → re-pin → baseline/hazard-log update; safe-state armed if the timeline slips). Mirrors KCL clarification Q3. 5.6.

5.6

Statesswitch thrown audit entry safe state

Secure analysis environment

4 screens

54 · /analysis/query

Query & report builder

No-code query over pseudonymised data, chart output, save-as-report. Banner: identifiable data never enters this environment. 5.8.

5.8

Statessaved reports filtered empty

55 · /analysis/code

Code workspace

Notebook with controlled package sources, reproducibility manifest, environment hash. 5.8.

5.8

Statespackage request run log locked

56 · /analysis/plans

Analysis plans & intent

Pre-registration: hypotheses, primary outcomes, derivation/confirmation split, locked-before-data-view; pre-specified vs exploratory visibly distinct. 5.8.

5.8

Statesregister plan exploratory locked

57 · /analysis/egress

Egress review

Reviewed-egress queue, outgoing-artefact diff, approver trail, TRE transfer as governed access not replication. 5.8.

5.8

Stateschanges requested approved tre transfer

Governance & trust fabric

4 screens

58 · /governance/audit

Audit explorer

Append-only, tamper-evident trail with hash-chain visual; filters; export-to-immutable-storage status. 5.10, fixed constraint.

5.10

Statesevent provenance filtered exported

59 · /governance/residency

Residency map

Per-country data planes (UK live; Spain/Ghana/Peru/Canada planned; China as a separate future profile, explicitly unpriced); per-country keys; cross-border flows pseudonymised-only. 5.10, fixed constraint.

5.10

Statescountry uk planned keys

60 · /governance/identity

Identity & access

Joiner-mover-leaver board, access-recertification cycle, MFA enforcement, re-identification request queue (audited, justified). 5.10, 5.5.

5.105.5

Statesrecert overdue reidentification leavers

61 · /governance/model-training

Model-training approvals

NEW. The governed route for any use of participant data in model training: request → privacy budget → attested isolation → approval; default state: none approved. 5.10 fixed constraint.

5.10

Statesrequest rejected approval

Platform & researcher analytics

3 screens

62 · /platform/analytics

Adherence & analytics

NEW. Adherence and completeness monitoring, survey completion by package, export to recognised reporting standards. 5.7.

5.7

Statescohort filter missing data export

63 · /platform/slo

SLOs, error budgets & capacity

Two-tier board (general vs safety-path, independently monitored), error budgets gating releases, capacity envelope with load-test evidence. §8.

§8

Statesbudget exhausted degraded healthy

64 · /platform/releases

Releases, change & sites

Gated release train (regression pass → error budget → approval), change log including AI-component changes, sites register with roles. §7 SDLC pass/fail, §8 change management, 5.2 sites.

§7§85.2

Statesrelease blocked close out site readiness

Platform, SLOs & release

1 screens

71 · /platform/exceptions

Daily exceptions

Proactive daily operations view replacing manual surveillance. 5.7.

5.7

Statesend of day clear device only assigned

Research operations,with every decision visible.

Sign-in with passkey

My Studies

Global search

Notification centre

Study dashboard

Participants register

Participant onboarding journey

Participant onboarding timeline

Participant 360

Verification & countersignature queues

Withdrawal & re-consent

Dyads & family linkage

Configuration explorer

New study wizard

Clone to new country

Eligibility rules builder

Consent package builder

Instrument builder

Q1 · Questionnaire library

Q3 · Item editor & logic

Q4 · Branching & flow map

Q5 · Translations & reading age

Q6 · Preview & versioning

Schedule, phases & visits

Sensing scopes

Notifications & messaging

Localisation console

Simulation runner

Approval gates

Config versions & diff

Randomisation designer

Adaptive designs: MRT & SMART

Blinding & emergency unblinding

Allocation audit

Device fleet

Sync assurance board

Participant Devices & Sync

Integration catalogue

EHR connections

Blinded CGM configuration

Data spine overview

Data dictionary

Mapping studio

Dataset releases

Data queries (GCP-grade)

Alert inbox

Alert detail & lifecycle

Safeguarding cases

Adverse events & incidents

On-call & escalation

Pathway health

HAIA operations home

Model gateway & pinning

Safety gate policies

Artefact registry

Evaluation & experiments

Coach console

Kill-switches & deprecations

Query & report builder

Code workspace

Analysis plans & intent

Egress review

Audit explorer

Residency map

Identity & access

Model-training approvals

Adherence & analytics

SLOs, error budgets & capacity

Releases, change & sites

Daily exceptions

Research operations,
with every decision visible.