China combines a fast-moving NMPA review system with human genetic resources rules and strict data export law. Capture hosts in the EU and the US, not in mainland China, so this page is about where it fits, where it does not, and what to ask counsel first.
Free sandbox · No credit card · 21 CFR Part 11 aligned
Study region
China (mainland)
Key points for studies in China
Regulation
A clinical trial of a medicine in China needs an application to the NMPA, assessed by the Center for Drug Evaluation. Practitioner sources describe two timelines. In the standard route, a trial may proceed if the CDE raises no objection within 60 working days, which is often called implied approval. In 2024 the NMPA piloted a 30-working-day review for innovative drugs, starting in Beijing and Shanghai, and in 2025 published a route that sits on top of the 60-day mechanism for eligible applications. Eligibility depends on factors such as national priority designation, paediatric or rare disease programmes, or globally synchronised development. The same sources say applicants commit to start the trial within a set period after approval. Treat all of this as a planning sketch, since the rules are being revised and you should read the current NMPA announcements.
Ethics review is separate. Each participating institution has an ethics committee, and for multicentre trials the lead site committee usually carries the main review, with other sites accepting or confirming it. Trials follow the Chinese Good Clinical Practice standard, which is based on ICH GCP and was revised in 2020. For the ICH principles behind it, see good clinical practice.
Whatever the route, the data system has to give inspectors a clean record. NMPA can inspect trial sites and records, so the audit trail matters: in Capture every field change carries a timestamp, the user, the old value, the new value and the reason for change, and the trail is append-only. See audit trail software for clinical trials and 21 CFR Part 11 compliant EDC for what these controls look like in practice.
Sources note that sponsors without a Chinese legal presence usually appoint a local representative or CRO for submissions and site management. Capture has no office, partner or CRO in China and does not act as one. It is a self-serve platform your team, or the CRO you appoint, configures and runs.
Human genetic resources
China regulates human genetic resources, meaning biological samples and the genetic information derived from them. Responsibility moved from the Ministry of Science and Technology and its HGRAC office to the National Health Commission, and revised administrative rules took effect on 1 May 2024. Foreign entities that want to use Chinese HGR generally have to cooperate with a Chinese entity and either obtain approval for an international cooperation project or complete a record-filing.
Two points from legal commentary matter for a clinical data system. First, international clinical trials run to obtain drug or device marketing approval benefit from exemptions or a lighter record-filing route, particularly where no human genetic material leaves China. Second, the rules treat "HGR information" such as genome-derived data differently from physical samples, and commentators say clinical data and image data sit outside that definition. These readings are secondary. Whether your study, especially one with genomic, biobank or exploratory biomarker components, needs HGR approval or filing is a question for Chinese counsel and your Chinese partner.
For Capture the practical point is scope. Do not use the eCRF to collect genome-level data from Chinese participants unless counsel has cleared it. Keep sample handling and any export of material in the Chinese partner and laboratory workflow, and record only the clinical results and coded sample identifiers you are permitted to move.
Data export
China regulates personal information through the PIPL, the Data Security Law and implementing measures from the Cyberspace Administration of China (CAC). Health data is sensitive personal information, so it needs a specific purpose, separate consent in many cases, and protective measures. Transferring personal information outside mainland China can require a CAC security assessment, filing of a standard contract, or personal information protection certification. In March 2024 the CAC issued provisions that exempt certain categories and change the volume thresholds, and they also set out how "important data" is identified. Commentary does not settle how these provisions apply to clinical trial data, and some sector or local rules may add requirements.
Here is where Capture stands, stated plainly. Capture is hosted in Frankfurt and in N. Virginia. If you enrol participants at Chinese sites and enter their data in Capture, data is processed outside mainland China. Whether that is permitted, and what you must file, assess or contract for, depends on your data types, your volumes and whether your sponsor and sites are classified in a way that triggers localisation. If the answer is that the data must stay in mainland China, Capture is not the right fit for that part of the study, and you should use a system that can be hosted there.
Where counsel does clear a transfer, reduce what moves. Site coordinators in Capture see participant names while researchers see coded IDs, enforced by row-level security, so a design with names kept at the site and only coded data in the sponsor workspace is possible. Encryption is AES-256 at rest and TLS in transit. For the general concepts, compare HIPAA vs GDPR clinical trial data and GDPR compliant clinical trial software.
Classify the data
Identifiable, coded, genetic, imaging. Ask counsel what each category counts as.
Check localisation triggers
Important data, volume thresholds, sector rules.
Choose a transfer mechanism
Security assessment, standard contract, certification or an exemption.
Confirm hosting fits
Capture hosts in the EU or US. If data must stay in mainland China, choose another system for it.
Document in agreements and consent
Transfer basis, recipients, retention.
Set up roles, coded IDs and site-level access in the free sandbox, then take the design to your counsel.
Due diligence
A sponsor with Chinese sites should settle these before choosing where the database lives.
| Question | Why it matters | What Capture can offer |
|---|---|---|
| Must any trial data stay in mainland China? | If yes, an EU or US hosted system is not suitable for that data. | Hosting in Frankfurt or N. Virginia only. State this in your vendor assessment. |
| Is the data personal information, or anonymised? | PIPL treats identifiable and coded data differently from truly anonymised data. | Coded IDs for researchers, names visible to site coordinators only. |
| Does the study collect HGR material or information? | HGR filing or approval, and rules on export of material. | Keep genomic data out of the eCRF unless cleared. Sample logistics sit outside Capture. |
| Which transfer mechanism applies? | Security assessment, standard contract, certification, or exemption. | A processor description for your contract, covering hosting and access controls. |
| Does the sponsor need a local entity or CRO? | Submissions and site oversight usually run through one. | Capture has no local entity. The CRO or sponsor team runs the study in the platform. |
| What will NMPA ask to see in an inspection? | Source records, audit trail, delegation, consent. | Field-level audit trail, e-signatures and a signed consent PDF export. |
Capture is not a legal adviser. Answers depend on your protocol and your counsel.
Consent
Capture eConsent records the participant on-screen signature, verified with a one-time email code, then the investigator countersigns with password re-authentication. Each signature is hashed to the exact document content signed, and the consent exports as a PDF with signature data, timestamps and audit trail. The consent text is whatever your approved materials say. Whether separate consent for sensitive personal information and for cross-border transfer is needed, and whether electronic consent is accepted at a given site, should be decided with your ethics committee and counsel.
Meaning of signature
I have reviewed this adverse event and confirm the assessment of seriousness, severity and causality.
Signer
Dr. A. Ozola, PI
Password
••••••••••
Planning
A sketch for your own plan, not a regulatory timeline.
Ask counsel whether coded clinical data can be transferred, and which mechanism applies, before you build anything.
Decide whether samples or genetic information are involved and what filing applies.
Build forms, edit checks and roles for free and have the Chinese site team and CRO test them.
The NMPA application, the lead ethics committee and site committees run through your appointed local representative.
Create site accounts, train coordinators, and enrol participants only after approvals and transfer arrangements are in place.
Research landscape
China is a major source of early-phase and oncology development, with large hospital networks and fast start-up in leading centres. Global sponsors often add Chinese sites to a multi-regional study, and local biotechs run domestic trials supported by shorter review routes. Both patterns raise the same question of where data sits and who can see it.
If Chinese sites join a study alongside others, one set of forms and checks helps. Approved forms are locked and identical at every site, site-level participant numbering keeps records apart, and exports can be filtered by site. See multi-site clinical trial management and EDC for Phase 3 clinical trials. For SDTM-ready outputs at database lock, read CDISC SDTM export software.
For Asia-Pacific neighbours with different regimes, see Hong Kong, Taiwan, Japan and South Korea.
Before you start
Written advice from counsel on whether data may leave mainland China and by which mechanism.
Standard 60-working-day route or an eligible faster route, per current announcements.
Whether filing or approval applies, and who holds it with the Chinese partner.
Lead site committee and each site committee confirmed, with consent text approved.
Sponsor entity, CRO or partner appointed for submissions and oversight.
Hosting regions (EU or US only), access controls and audit trail documented for your file.
No. Capture hosts in the EU (Frankfurt) and the USA (N. Virginia). If your study must keep data inside mainland China, get legal advice first. Capture should not be assumed to fit that requirement.
It can work for a global study where counsel has confirmed that coded clinical data from Chinese sites may be transferred to an EU or US hosted system. It is not a way around China data export rules.
The NMPA, with the Center for Drug Evaluation doing the technical review, plus site ethics committees. Human genetic resources are separately regulated, now administered by the National Health Commission. Confirm the current routes with the authority or your local representative.
Rules on collecting, using and exporting human genetic material and related information, with special handling for foreign parties. Commentators say trials for marketing approval can use a lighter filing route. Ask Chinese counsel whether your study is covered.
The Personal Information Protection Law and the Data Security Law, with transfer rules from the Cyberspace Administration of China, including provisions issued in March 2024. How they apply to trial data should be checked with counsel.
No. Capture is a self-serve platform with no office, partner or CRO in China. A sponsor needing a local entity should appoint one separately.
No regulator approves EDC software the way the NMPA approves a trial. Capture provides an audit trail, e-signatures and access controls, and your validated use and submissions are what regulators assess.
Yes. The free sandbox has every feature, with no credit card and no time limit. You pay only when you go live with real participants.
Keep exploring
Clinical trial software in Hong Kong
Department of Health and the PDPO.
Clinical trial software in Taiwan
TFDA and the PDPA.
Clinical trial software in Japan
PMDA, J-GCP and the APPI.
GDPR compliant clinical trial software
Transfer principles for EU hosting.
Multi-site trial management
One study across regions.
Audit trail software
Evidence for inspectors.
Build and test your study free, then take the hosting question to counsel. Pay only at go-live.