Whose Data Is It?

Start with the patient, because every other question is downstream of that one. When someone agrees to join a clinical trial, they hand us their consent, their reported outcomes, their time, and a measure of trust that the people who enrolled them will protect all of it. Every decision we make about technology in clinical research is, in the end, a decision about whether we keep that trust.

A word on where I am standing, because it shapes everything that follows. Thirty years as a nurse and nearly all of them in clinical research operations. I’ve been the RN infusing the investigational product, the CRC completing case report forms, the regulatory coordinator submitting AEs to the IRB, the study monitor, the program director, the CTMS designer, the strategist, and the participant. I do not come to artificial intelligence as a technologist. I come to it as someone who has done many of the jobs a trial requires, and who has built the systems meant to lighten them. That is the seat I am writing from.

Artificial intelligence is testing that trust in ways it never has, and the industry just made that official. The biggest stage in enterprise software spent this week telling life sciences that agents are not its future but its present, already here, pitched to close care gaps and speed therapies to patients. Agents already read, reason, draft, and act across the systems where research runs. Used well, they lift the administrative weight off the people who carry too much of it. Used carelessly, they put distance between patients and the humans accountable for them. So, we have two questions to answer at once, and they turn out to be one question wearing two faces. Who owns the decision? And who owns the platform the decision runs on? They look like two questions. They are one, joined by a fact the industry keeps stepping around: you cannot control what you do not own. Hold onto that, because it is where all of this lands.

Before either question, clear one thing off the table. These platforms are built to be secure, and that case was made well this week. But secure is not the same as controlled, and controlled is not the same as owned. Security keeps the wrong people out. Control and ownership decide whether the right people can still answer for what the agent did.

Take the first question.

Everyone in this industry says the right words: “keep a human in the loop”. I have never met a single person who argued the other side, so let me say what the phrase quietly hides. The risk is not that an agent makes a decision it should not. The risk is that a human “makes” a decision they no longer actually make.

Picture a study coordinator six months into an agent-assisted workflow. The agent drafts responses to queries, flags candidates against inclusion/exclusion criteria, and summarizes. Great! That is work no one should be doing by hand. But now hundreds of items sit in the queue, each with an approve button, each already looking reasonable, each arriving faster than the coordinator can interrogate it. They get approved. Of course they do! That is not oversight. It is automation bias,¹ and the audit trail will record every rubber-stamp as a human decision. Nor does it stop at the coordinator’s desk. Coordinators act under delegation, and the Principal Investigator remains responsible for the work done in their name. The higher up the chain a decision is made, the more patients a single unreviewed one touches, and the further its author sits from the person it reaches.

This is why a human in the loop is not, by itself, a governance strategy.² The question was never whether a human is in the loop. It is whether that human can still see and still defend what they signed. I call the answer ClinOps in the Loop™: not a human somewhere in the workflow, but the right human, credentialed clinical judgment, accountable, wherever an agent’s decision will reach a patient.

None of this is philosophy. ICH E6(R3) now brings the computerized systems used in trials squarely under GCP, with validation, audit trails, access controls, and sponsor oversight that does not transfer to a vendor because you licensed their platform.³ Regulators have told us to treat AI outputs as regulated evidence, held to the same standard as any other evidence in a submission.⁴ An approval a reviewer cannot defend is worse than no approval. It is a finding waiting to happen.⁵

Dr. Fei-Fei Li, who built ImageNet and co-founded Stanford’s Institute for Human-Centered AI, argues that “trust cannot be outsourced to machines.”⁶ In clinical research I would add the corollary: neither can accountability. And here is the part the industry keeps walking past. You cannot fully own accountability for a decision that runs on a platform you do not own.

Which brings me to the second question, the one I care about most.

I care about it most because it is where the work actually got done. You will hear that clinical trial execution belongs to purpose-built systems, that a general platform cannot be your CTMS or your EDC, that this is someone else’s territory. I used to hear it too. Then my team built the alternative.

We’ve been building on Salesforce Life Sciences Cloud, now Agentforce Life Sciences, since its 2024 launch, two years now, across more than one sponsor and network, long enough to know exactly where the platform holds up and where it doesn’t.

Here’s an example. I built it for a non-profit clinical research network, an organization that chose to invest in infrastructure of its own because its mission is to build toward a cure, not to manage a handful of registries. For their observational research, on Salesforce Life Sciences Cloud with AWS behind it and MuleSoft and Shield holding the architecture together, we stood up a working clinical research operations environment: online consent, electronic patient-reported outcomes, case report form completion, data query management, participant stipend payments, and a complete electronic regulatory binder, in a single sign-on portal. Not a slide. Not a pilot. A running platform doing the work a CTMS and an EDC are supposed to do. So when someone tells you the platform cannot, hear the sentence accurately. Their configuration cannot, or they would prefer that you keep renting.

This is the answer to the first question, not a second one. Control of an agent is four things: seeing what it did, limiting what it can touch, defending the decision, and changing it when it is wrong. Every one of them lives in the platform the agent runs on. Own the platform and you hold all four; rent it and you are asking permission for each. Ownership is not a separate topic. It is control, made real. Here is what that changes on the ground, and it is not a question of whose logo is on the software. When you build it, you own the asset. The data model is yours. The audit trail is yours. The consent records, the outcomes, the payment ledger, the regulatory binder, all of it lives in your tenancy, in a schema you define, exportable and inspectable on your terms, secured in your own cloud. The test of ownership is simple, and every sponsor should ask it out loud: if the vendor relationship changed tomorrow, could you retrieve your full data history, in a usable form, without the vendor’s permission?⁷

Ask a second question while you’re at it: if you turned on an agent tomorrow, do you know exactly whose permissions it would inherit, down to every field, every record, every workflow? Most orgs can’t answer that either, and that’s where “human in the loop” quietly stops meaning anything.

The common arrangement fails that test. You consume a closed application. Your data lives in the vendor’s proprietary model, priced per study, reachable mainly through the vendor’s own interface, and you migrate only when they allow it, at a cost they set. Data that exists only inside a vendor’s system is not data you truly control. That is not ownership. It is tenancy, and the rent comes due at the exact moment you most need to leave.

Be precise, though, because this is easy to overstate. Every platform is a commercial relationship, and no one escapes vendors entirely. The difference is what you are left holding. One is an asset you own. The other is a subscription you can never convert into something you keep.

The fair objection is effort. Build it and you carry validation, Part 11, and the lifecycle maintenance a vendor would otherwise handle. True. But ownership has never meant going it alone. It means the asset is yours, built to a validated standard and maintained with the right partner, rather than a lease you renew forever with nothing to show for it. No one would rent the system of record for their patients in perpetuity and call that a strategy.

This is exactly why I am excited about Claudeforce.⁸ And I will say so as someone who partners with these platforms and still names where the model breaks. Bringing Claude’s reasoning into a governed environment, with permissions, business rules, and audit history in one place, is real progress. It may be the first time this much intelligence and this much governance live together. It is also the clearest case that the two questions were always one: the same agent, the same power, landing in opposite places depending on who owns the ground beneath it. But excitement is not endorsement. Put that same power on a platform you rent, and you have not only rented the software, you have rented your accountability with it, on top of the data you already handed over. Put it on infrastructure you own, and the agent works where you can see, govern, and defend it, with the patient’s record held where it belongs. The technology is what makes agentic research possible. Ownership is what makes it defensible.

So, whose data is it? Not the vendor’s. It is the patient’s, held in trust by the people who enrolled them. Own the platform and that trust is something you can keep. You can protect the record, correct it, move it, and stand behind it, without asking permission from a company whose interests were never the patient’s. Rent the platform and you have made a person’s consent, outcomes, and dignity a line item in someone else’s contract.

The non-profit therapeutic network I built for understands this in its bones. You do not rent the foundation you intend to build a cure on. You own it, so that it is still standing, and still yours, long after any single vendor or contract is gone. That is not an IT decision. It is a promise to the patients waiting on the science.

I stay close to the patient in every build, because patient-first is the mission and because trust is earned by proximity, no differently with an agent than with a person. I stay just as close to the site, the engine that makes research happen and the face the patient actually sees, and the most overlooked seat in the industry. Empower the site and you protect the patient’s trust. It is why I built the CTMS and the EDC first, from the participant and the site up, and only now build the agents that run inside them. You earn the right to automate by owning what you automate on.

Ownership is the means, not the point. The point is three commitments: design for the patient first, integrate AI into clinical research operations ethically with human judgment on every decision that reaches a life, and choose your partners with intention, the right software to build on and the right implementation partner to build it right. Do that, and the technology finally serves the person who trusted us with all of it. Start with the patient. Everything worth building starts there.

If you’re not sure whether your org is ready for that, start by auditing who can already see, touch, and approve what. That’s where ownership holds or breaks, and it’s the first conversation worth having before you put an agent in the loop.