1. Regulatory References
Applicable Regulations:
IEC 62304, paras. 5.3.1 and 5.3.2 [classes B, C]
Related Documentation:
- SOP Software Development
- User and stakeholder requirements
- Design input and software specifications
- (…)
2. Software Systems
In line with DIN EN 62304, our software is organized into three tiers: software systems, software components, and software units.
Provide a description of your internal software systems. IEC 62304 defines these as an “integrated collection of software items organized to perform a specific function or set of functions.”
NOTE: It is advisable to include a diagram in the Annex and reference it here.
2.1. Frontend
Example description:
- Function: user interface presentation
- Software safety classification and justification
- Runtime environment
- Deployment method
- Target user groups
2.2. Backend
Example description:
- Function: processing patient data and medical imagery
- Software safety classification and justification
- Runtime environment (e.g., JVM)
- Deployment method (e.g., Docker container)
- User group
2.3. Algorithm
Example description:
- Function: receives medical images as input and provides a prediction as output
- Software safety classification and justification
- Runtime environment (e.g., JVM)
- Deployment method (e.g., Docker container)
- User group
3. Software Units
Describe your internal software units. IEC 62304 defines a software unit as a “software item [such as source code, object code, control code, control data, etc.] that is not further divisible.” Examples include:
- Wearable device poller (periodically checks for new data from the wearable device and downloads it)
- Notification service (sends push notifications to mobile apps via Apple/Google)
- (…)
4. Database
Describe the databases you use. Example:
- Relational database: Postgres v14
5. IT Security
5.1. Data Encryption
\
5.1.1. Data at Rest
\
5.1.2. Data in Transit
Example content:
- Data in transit is protected with advanced encryption protocols, such as SSL and TLS.
- Additionally, a Virtual Private Network (VPC) is established to prevent Compute Instances from being exposed to the public internet. The algorithm and database are secured and only accessible to the backend, not publicly reachable.