FDA DTx authorization requires data trust most developers lack
FDA has authorized over 30 prescription digital therapeutics, but each authorization rests on data quality requirements most DTx developers underestimate. Software that delivers therapy must prove its data pipeline meets clinical-grade provenance, consent, and validation standards before the agency will clear it.
The FDA has authorized more than 30 prescription digital therapeutics since reSET became the first cleared product in 2017. Each authorization required the sponsor to demonstrate not just clinical efficacy but data integrity across the entire software lifecycle. The distinction matters: a pill's active ingredient does not change after manufacturing, but a DTx generates, collects, and acts on patient data continuously. If that data pipeline is untrustworthy, the therapeutic itself is untrustworthy.
The current ranking results for this topic focus on clinical trial design and broad DTx definitions. None of them address the specific data trust infrastructure that FDA reviewers evaluate when a DTx submission lands on their desk. This post does.
What FDA actually reviews in a DTx submission
Digital therapeutics fall under the FDA's Software as a Medical Device (SaMD) framework. The agency's 2021 action plan for AI/ML-based SaMD laid out five categories of oversight, and three of them are data-centric: algorithm transparency, real-world performance monitoring, and data quality assurance.
For a DTx seeking De Novo classification or 510(k) clearance, the FDA expects a documented data management plan covering collection, storage, processing, and output. The FDA guidance on clinical decision support software specifies that the sponsor must demonstrate the quality, reliability, and representativeness of any data the software uses to generate therapeutic recommendations.
This is not a checkbox exercise. Reviewers evaluate whether the sponsor can trace every data element from patient input through algorithmic processing to therapeutic output. That is provenance, and it carries the highest weight in any serious data trust framework.
The seven data trust dimensions FDA cares about most
| | Value (%) | |---|---| | Provenance (data lineage) | 25 | | Consent (informed collection) | 20 | | Recency (current data) | 15 | | Quality (input acceptance) | 10 | | Concordance (source agreement) | 10 | | Validation (clinical evidence) | 10 | | Breadth (representativeness) | 5 | | Stability (consistency) | 5 |
FDA does not use the phrase "data trust" in its guidance documents. But the agency's requirements map directly onto the dimensions that define whether health data is fit for clinical use.
Provenance. Where did the data originate? The FDA's Software Precertification Pilot required participating organizations to document data lineage from source to output. For a DTx, this means every patient interaction, every sensor reading, and every algorithm version must be traceable.
Consent. DTx products collect sensitive behavioral and health data directly from patients. The FDA's human factors validation requirements for medical devices extend to informed consent for data collection. A DTx that collects mood scores, substance use patterns, or cognitive performance data needs granular consent architecture, not a blanket terms-of-service agreement.
Recency. The FDA's post-market surveillance requirements mandate ongoing performance monitoring. Stale data in a DTx pipeline means the therapeutic may be acting on outdated patient states. The agency flagged this explicitly in its 2023 discussion paper on predetermined change control plans, noting that algorithm updates require current, representative data.
Quality. Missing fields, duplicated entries, and inconsistent formats degrade therapeutic accuracy. The FDA's Design Controls guidance (21 CFR 820.30) requires that software inputs meet defined acceptance criteria. For DTx, this means patient-reported outcomes, engagement metrics, and biometric inputs must pass quality thresholds before the algorithm processes them.
Concordance. When a DTx integrates data from multiple sources (EHRs, wearables, patient self-reports), the records must agree. The FDA's interoperability guidance for medical devices requires sponsors to document how conflicting data from different sources is reconciled.
Validation. Clinical evidence must support the algorithm's outputs. The FDA expects randomized controlled trials or equivalent evidence for DTx authorization. Pear Therapeutics' reSET required a 399-patient RCT published in the Journal of Medical Internet Research (2017) demonstrating statistically significant improvement in abstinence from substances.
Stability. Algorithms must perform consistently over time. The FDA's total product lifecycle approach requires sponsors to monitor for performance drift. If a DTx's outcomes degrade as patient populations shift, the sponsor must detect and correct that drift.
The patient-generated data problem
Prescription digital therapeutics depend on patient-generated health data (PGHD) more than almost any other medical device class. A DTx for insomnia collects sleep diaries. A DTx for substance use disorder collects craving logs. A DTx for ADHD collects attention task performance.
This data is inherently noisy. The Office of the National Coordinator for Health IT estimated that fewer than 15% of clinicians routinely incorporate PGHD into clinical workflows, in part because of data quality concerns. For DTx developers, the problem is worse: PGHD is not supplementary to their product. It is the product's input.
FDA reviewers evaluate how the DTx handles missing data, implausible values, and inconsistent patient engagement. A patient who stops logging for three days creates a data gap that the algorithm must address without generating false therapeutic signals. The FDA's 2022 guidance on patient-focused drug development emphasized that patient-reported data quality depends on instrument validation, collection methodology, and data handling protocols.
Real-world evidence and post-market data requirements
FDA authorization is not the finish line. The agency's Real-World Evidence framework (2018) applies directly to DTx post-market obligations. Once a product reaches patients, the sponsor must collect and analyze real-world data to confirm that the DTx performs as intended outside controlled trial settings.
This creates a compounding data trust challenge. Trial data is collected under strict protocols with dedicated research staff. Post-market data comes from clinical practice, where documentation standards vary widely. The FDA's 2023 draft guidance on real-world data noted that electronic health records used for RWE submissions must meet specific completeness, accuracy, and provenance standards.
For DTx specifically, post-market data must demonstrate that therapeutic outcomes hold across diverse patient populations, clinical settings, and usage patterns. Akili Interactive's EndeavorRx, authorized in 2020 for pediatric ADHD, faced this challenge when real-world engagement patterns diverged from trial protocols.
Why 510(k) predicates fail for data trust
Most DTx products cannot rely on traditional 510(k) predicates because no substantially equivalent device exists. The FDA's De Novo classification pathway requires sponsors to define new special controls, and data management is consistently among them.
The FDA's De Novo authorization for Pear Therapeutics' reSET-O (2018) included special controls requiring the sponsor to document data handling procedures, specify how patient engagement data drives therapeutic delivery, and maintain audit trails for algorithm modifications. These controls became a template that subsequent DTx submissions have followed.
The special controls are not optional. They are conditions of authorization. If a sponsor cannot demonstrate compliance during an FDA inspection, the authorization is at risk.
The Pear Therapeutics bankruptcy signal
Pear Therapeutics, the first company to receive FDA authorization for a prescription DTx, filed for bankruptcy in April 2023. The reasons were primarily commercial, not regulatory. But the bankruptcy exposed a structural problem: building clinical-grade data infrastructure for a DTx is expensive, and most DTx startups underinvest in it.
Pear's products required continuous data collection, real-time algorithm processing, and post-market surveillance. Each of those functions demands infrastructure that meets FDA's quality system regulation (21 CFR Part 820). The cost of maintaining that infrastructure without adequate reimbursement forced the company into insolvency.
The lesson is not that DTx cannot work. It is that data trust infrastructure is a fixed cost that cannot be deferred. Sponsors who treat data quality as a post-authorization concern will face the same structural problem.
What prescription digital therapeutics data quality actually requires
| | Value ( requirements) | |---|---| | Pre-submission | 3 | | Clinical trial | 5 | | De Novo review | 7 | | Post-market surveillance | 6 |
Based on the FDA's guidance documents, De Novo special controls, and post-market requirements, prescription digital therapeutics data quality requires:
None of these requirements are optional for authorized DTx products. Sponsors who build data infrastructure as an afterthought will either fail to achieve authorization or face post-market enforcement.
The DTx data trust gap in practice
The Digital Therapeutics Alliance's DTx Product Best Practices guide (2021) defines data handling as a core product attribute. Yet most DTx startups build their data pipelines with consumer-grade tooling: cloud databases without provenance tracking, analytics platforms without audit trails, and consent systems that cannot handle revocation.
The gap between consumer-grade data handling and FDA-grade data trust is where DTx submissions fail. A reviewer who cannot trace a data element from input to output will not authorize the product. A post-market inspector who cannot verify consent documentation will issue a warning letter.
This problem is not unique to DTx. Every software-based medical device faces similar data trust requirements. But DTx products face them more acutely because their entire therapeutic mechanism depends on data quality. A DTx with bad data is not a device with a defect. It is a therapy that does not work.
How DTI scoring maps to FDA DTx requirements
The eight dimensions of data trust scoring map directly to what FDA reviewers evaluate in a DTx submission. Provenance, weighted at 25% in the DTI framework, corresponds to the FDA's data lineage requirements. Consent at 20% maps to the agency's informed consent and data collection requirements. Recency at 15% addresses the post-market surveillance obligation to use current data.
Quality, Concordance, and Validation, each weighted at 10%, cover the FDA's acceptance criteria for software inputs, interoperability requirements, and clinical evidence standards. Breadth (5%) and Stability (5%) correspond to the representativeness and consistency requirements in the total product lifecycle framework.
Scoring every record before it enters a DTx pipeline is not a luxury. It is the operational implementation of what FDA already requires but most sponsors implement manually and incompletely.
The DTI Engine scores every record 0 to 100 across eight dimensions before your AI model sees it. If your team is building a DTx product and needs to demonstrate FDA-grade data trust for authorization or post-market compliance, talk to the SuperTruth commercial team. Schedule a conversation or call (215) 918-4140.
Further reading:
Sources
Jason Alan Snyder
Co-founder of SuperTruth and Artists & Robots, and an inventor on the Data Trust Index patents. Twenty-plus years building technology inside Interpublic Group. He writes here nearly every day on data trust, provenance, and what AI should be allowed to act on, and publishes essays on his Substack.
About SuperTruth · LinkedIn · Substack · jasonalansnyder.com
See it in practice
DTI scores the record, not the patient.
8 dimensions. 0 to 100. Travels with every record permanently.