CMS lawyers can provide future-facing advice for your business across a variety of specialisms and industries, worldwide.
Apart from offering expert legal consultancy for local jurisdictions, CMS partners up with you to effectively navigate the complexities of global business and legal environments.
Our CMS Expert Guides provide you with in-depth legal research and insights.
Learn moreCMS Press Office
Learn moreCMS lawyers can provide future-facing advice for your business across a variety of specialisms and industries, worldwide.
Apart from offering expert legal consultancy for local jurisdictions, CMS partners up with you to effectively navigate the complexities of global business and legal environments.
Our CMS Expert Guides provide you with in-depth legal research and insights.
Learn moreCMS Press Office
Learn more
Software intended for medical purposes may be classified as a medical device in accordance with the Serbian Law on medical devices ("LMD”). As a rule, any medical device including software needs to fulfill certain requirements such as quality management processes, appropriate conformity assessment procedures and CE or Serbian conformity marking. Before a product is placed on the market, the manufacturer or a person who is considered responsible for the marketing of medical devices needs to ensure that all relevant criteria are met.
Software will be considered a medical device, if the intended purpose relates to one of the following:
By transposing the criteria from the EU law, the LMD makes categorization of medical devices – to differentiate medical devices from consumer products that do not fall under the scope of LMD – taking into consideration various elements including the the specific purpose designated by the manufacturer. For example, genuine consumer apps not intended for therapeutic or diagnostic uses are not considered medical devices.
The LMD does not specifically address the issue of the software within digital health apps, and the practice on the matter is yet to be established. The Agency for Medicines and Medical Devices (“ALIMS”), as a pharmaceutical regulator, has competence over determining whether a certain product is a medical device or not.
When making assessments, ALIMS may take into consideration information given in product manuals, as well as in any other document accompanying the software. The LMD does not define a definite list of criteria for this type of product assessment, but rather an assessment is made based on various elements. Certain product features may indicate medical purpose, such as: alarming, analyzing, calculating, detecting, diagnosing, interpreting, converting, measuring, controlling, monitoring, amplifying, or support to healthcare professionals in making decisions such as dosing of medicines; monitoring patients and collecting data, e.g., by measurements if the results thereof have an influence on diagnosis or therapy. Pure data storage, archiving, communication, or simple search functions do not in themselves result in classification as a medical device.
Medical devices are classified according to their risk and divided into classes. The LMD uses a set of criteria in order to determine classification, e.g., duration of contact with the body, degree of invasiveness, the part of the body affected by the use of the device and if the device depends on a source of energy. They are assigned to Classes I, IIa, IIb or III, whereby Class I comprises those products with the lowest risk potential.
As a rule, medical services are allowed to be provided by licensed physicians.
The Serbian Law on Healthcare Protection defines what is to be considered medical or healthcare protection. According to the provision, healthcare service includes implementation of measures for preservation and improvement of the health of citizens, prevention, control, and early detection of diseases, injuries, and other health disorders and timely and efficient treatment and rehabilitation. The provision of healthcare services requires a license either as a physician or as another licensed healthcare practitioner.
The LMD does not set a clear distinction between the healthcare/practice of medicine and other activities that do not require a license and such assessment requires case-by-case analysis.
Also, software devices may be used with the purpose of improving medical services. As a rule, new technologies in medicine may be used in Serbia if they have the approval of the Ministry of Health. This approval is obtained by filing a request to the Ministry of Health for the use of a new technology in medicine. The applicants need to provide:
Generally speaking, the use of new technologies in the field of medicine is not explicitly regulated and in principle there is a possibility for its certification. In any case and so far, the relevant stakeholders have not made any significant progress in recognizing and implementing new technologies in medicine.
Serbia has very strict rules in relation to data security. The umbrella regulation in the field of the personal data protection in the Republic of Serbia is the Serbian Law on personal data protection ("Serbian DPA”). The Serbian DPA represents a mixture of GDPR and the EU Directive 2016/680. The primary aim of the Serbian DPA is the protection of the fundamental rights and freedoms of individuals in respect of the collection and processing of their personal data.
If software processes personal data of the users/patients, it must comply with the applicable data protection regulations, in particular with the Serbian DPA. In this respect, the Serbia DPA provides that processing of health data is allowed only if it is necessary for the purpose of preventive medicine or occupational medicine, to assess the working capacity of employees, medical diagnostics, provision of health or social care services, or management of health or social systems, by law or by contract with a health worker, if processing is performed by or under the supervision of a healthcare professional or another person who has the obligation to maintain professional secrecy prescribed by law or professional rule.
In addition, location tracking is also subject to consent provided it is not an essential part of the service provided.
The Serbian DPA always applies in B2C scenarios, as well as in B2B scenarios if the business user is a natural person or if the user is processing personal data of other individuals via the app. If the business user is processing personal data of other individuals (e.g., patients), he or she must ensure that this complies with the Serbian DPA (the legal ground for which will usually be a contract with the individual or consent).
If data is stored on the device or if data is collected from the users' device and if this is not necessary for providing the service, users must provide additional consent.
The Serbian DPA applies to both direct and indirect data transfers. Under the Serbian DPA, controllers will be entitled to transfer personal data abroad provided that certain criteria are met (e.g., export to countries providing an adequate level of data protection, transfer is based on the standard contractual clauses prepared by the Serbian DPA, etc.).
Advertising of medicines devices is subject to restrictive rules, especially with respect to inducement. Also, DTx designers should be aware that Serbia is not an EU member state, thus it has a very specific set of data privacy rules in force. Finally, storing medical information outside of Serbia could be subject to restriction both in terms of cybersecurity requirements as well as bans if the DTx users are public healthcare institutions.
Advertising of medical devices is governed by the LMD and Rulebook on Advertising of Medical Devices. DTx as well as other medical devices may be promoted to healthcare professionals and to the general public. There is no prohibition to promote medical devices towards medical laypersons.
The LMD has transposed into Serbian law most of the labeling requirements envisaged under Article 7 of the EU MDR, including the ban on misleading advertising such as:
Under the Serbian Healthcare Law (“SHL”) and LMD, the provision of benefits in the context of promoting medical devices is prohibited. According to Article 112 of LMD it is not permitted to offer, announce or grant benefits, promotional gifts (goods or services) to healthcare professionals or to medical laypersons, unless these benefits or promotional gifts are of low value. Such low value is not defined under the LMD, however, the SHL states that any gift to healthcare professional cannot exceed approx. 40 euros.
In addition, illegal inducement is covered by professional code of doctors and even the criminal code depending on the circumstances. According to these rules, offering or acceptance of any kind of benefit, financial or otherwise, in the context of the supply, prescription, dispensing or administration of medicinal products or medical devices is considered inducement.
There are different options of partnering and cooperating in the distribution and promotion of medical software/DTx and the legal considerations to take.
One option is using a cooperation partner for the promotion of the DTx vis-à-vis physicians, hospitals or insurers. In Germany such cooperation models are on the rise, and it is important to have the right contracts in place for that.
For example, a legal manufacturer of a medical device may want to cooperate with a pharmaceutical company. The latter has experience in addressing healthcare professionals and the necessary staff. This can be an important service provided to the legal manufacturer of the software that does not have the resources to reach healthcare professionals. The typical basis for such cooperation is a contract which has certain elements of a co-promotion agreement known from the pharmaceutical industry.
Also, when it comes to development of new features or indications partnering with a strategic or financial investor may help. This then goes into the direction of onboarding investors.
Another aspect are white label solutions with insurers who may wish to offer the product as part of their portfolio or even under their own name.
In Serbia, there are several possible routes of distributing a DTx, both to healthcare professionals and to patients, including allowing patient to download DTx and through professional organizations. Also, DTx could be offered to employees by way of employee benefit programs, however, this mean of distribution is yet to be tested in Serbia.
Thus, the traditional way of marketing medical devices through a channel of specialized distributors seems to be the most viable route.
The DTx are not part of any reimbursement system and formally speaking it cannot be included in the list of medical devices eligible for the reimbursement.
DTx designers are therefore left with the option of negotiating reimbursement arrangements with private insurers, private insurance companies or patient groups.
The patients are generally more interested in paying themselves for digital applications. For the provider of the DTx this can result in a stable flow of income, but it is rather a modest access arrangement in terms of accessing larger patient groups.
Private payers are more interested in the application of new technologies in the field of healthcare protection compared to the public sector since public reimbursement is not formally available for DTx. Arrangements with private payers offer a high degree of flexibility in pricing but there is a number of budgeting constraints that DTx designers will be encountering.
Last update: October 2023
11. Key legal aspects of implementing digital therapeutics (DTx) in Romania
13. Key legal aspects of implementing digital therapeutics (DTx) in Slovenia