Key legal aspects of implementing digital therapeutics (DTx) in Spain

The qualification of the product as pure software or medical device is important to (i) determine the legal requirements to comply with, including user safety and (ii) access regulated markets in the field of DTx.  

Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices (hereinafter "Regulation (EU) 2017/745") defines a medical device as "any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings”. 

Therefore, in most cases, DTx shall be considered medical devices as these make therapeutic decisions for a person at an individual level, which implies complex processing of the data collected. In any case it is particularly important for the manufacturer to determine, prior to its commercialization whether the DTx may indeed qualify as medical device in order to know the requirements to be met (e.g., obtaining a marketing authorization from the Spanish health authorities) and the restrictions its commercialization might have.  

In order to determine whether a service component is a mere service or provision of healthcare it is necessary to analyse in depth the type of service. 

This is particularly important from the Spanish perspective as the provision of medical and healthcare services in Spain is restricted to authorised healthcare professionals. Thus, if the service component consists of medical or healthcare services linked to the DTx, specific authorisation or even collaboration with medical professionals may be required. 

DTx will certainly process large amounts of personal data, so data protection is one of the most relevant issues to be considering when manufacturing and commercializing DTx in line with the data protection ‘by design’ and ‘by default’ principles of the General Data Protection Regulation of the European Union.  

Indeed, any software processing personal data must comply with data protection regulation. Nevertheless, DTx must go one step further in such compliance insofar as the processing of health data requires enhanced measures. 

In this regard, some of the key legal requirements for the adequate processing of health data (sensitive data) through DTx are: 

• Consent. The individual's informed and explicit consent is required for the collection and processing of personal data. 
• Purpose and limitation of processing. Sensitive data may only be collected and processed for specified and legitimate purposes. 
• Data minimisation. Sensitive data must be adequate, relevant and limited to what is necessary for the purposes for which they are collected. 
• Security. Appropriate technical and organisational measures must be implemented to protect sensitive data against unauthorised access, loss, destruction or damage. 
• Appointment of a data protection officer (DPO). 

Besides complying with data protection regulations Spanish Royal Decree 192/2023 on medical devices foresees several legal requirements to be met in order to commercialize DTx (when considered medical devices) in Spain. Among others: 

• Medical devices shall meet the general safety and performance requirements set out in Annex I of Regulation (EU) 2017/745. 
• Medical devices shall demonstrate conformity with the general safety and performance requirements. 
• Manufacturers shall establish, document, implement and maintain a system for risk management. 
• Any manufacturer placing custom-made devices on the market shall notify it to the Spanish Agency for Medicines and Medical Devices (AEMPS). 
• Natural and legal persons engaged in the manufacture, importation, packaging or sterilisation of medical devices and the premises where such activities are carried out shall require a prior operating licence. 
• In order to commercialize medical devices on Spanish territory, other than custom-made products, registration in the Marketing Register of the AEMPS is required.  
• Any economic operator placing products on the market shall keep a documented record of the products made available on Spanish territory and shall inform the Marketing Register of the AEMPS of the products they intend to market. 

The advertising and promotion of DTx must follow the general principles of Law 34/1988, of 11 November 1988, General Law on Advertising: legality, truthfulness and veracity.  

Additionally, when considered medical devices, communication of DTx shall comply with certain restrictions arising from Spanish Royal Decree 192/2023 on medical devices, among others: 

• Direct or indirect advertising to the public is excluded where a medical device is financed by the National Health System. 
• Furthermore, medical devices which are intended for use or application by health professionals only cannot be advertised to the public. 
• Advertisements in any general media, including the Internet, as well as any other promotional material aimed at the public, shall be subject to prior authorisation by the health authorities of the Autonomous Communities. 
• Media used for information and promotion, whether written, audiovisual or of any other nature, shall be of a primarily scientific nature and shall be aimed at and generally distributed to health professionals. 
• The information shall be provided by appropriately trained persons with sufficient knowledge to provide accurate and comprehensive guidance on the products they promote. 
• Any reference to a health authority or to recommendations made by scientists, health professionals or other persons who, because of their notoriety, may encourage their use, is prohibited. 

DTx considered medical devices also face restrictions in terms of marketing in Spain: 

• Direct or indirect offering of any kind of incentives, bonuses, discounts, premiums or gifts by anyone with direct or indirect interests in the production, manufacture and marketing of medicinal products to healthcare professionals prescribing medical devices or to their relatives and cohabitants is prohibited.  
• In addition, premiums, free gifts, discounts, prizes, contests, bonuses or similar methods in connection with the promotion or sale of such products to the public are prohibited. 

While in certain European countries digital therapies are already a reality, Spain is still developing much of the legal and commercial infrastructure in this regard.  

This prompted the creation in December 2022 of the Spanish DTx Consortiumin December 2022 to promote the adoption of digital therapies whose main objective is the definition of a sustainable financing model that guarantees market access to this type of technological solutions. 

The consortium is working to speed up the implementation of digital therapies in Spain by generating a specific regulatory framework through the analysis of relevant experiences in pioneering countries and cross-sector co-creation with the main players in the ecosystem, such as the Administration, healthcare professionals, patients, startups, hospitals. 

When considering medical devices, DTx distribution shall be carried out in such a way as to ensure its proper storage and preservation.  

In this regard, distributors shall be subject to monitoring and inspection by the Spanish health authorities. 

• Distributors must notify the AEMPS of the place where their warehouses prior to the commencement of the activity. 
• As previously mentioned, any economic agent marketing products in Spanish territory must be included in the AEMPS Marketing Register and they shall keep a documented record of the products made available on Spanish territory, informing the Marketing Register of the AEMPS of the products they intend to market. 
• Import licences shall be required by importers established in Spain who introduce a product from a third country onto the European Union market. 

The financing capital of the DTx industry has multiplied in recent years. Some EU countries have developed efficient reimbursement models for their implementation. However, as the recent EFPIA (European Federation of Pharmaceutical Industries and Associations) report points out, only a limited number of EU countries actually have access to digital therapies. Specifically, in Spain there is no regulation on the funding model that guarantees access and effectiveness of these digital applications. For this reason, the question of who and how digital therapies are financed remains unresolved.   

In any case, traditional routes for monetization of DTx are also available. 

Direct payment by patients, agreements with employers that may offer DTx solutions as part of a wellness or fringe benefits programme or agreements with insurance companies. In contrast with the public route, this route is more flexible in terms of pricing or conditions although the potential market is smaller. 

Requesting financing the DTx via the pharmaceutical allowance of the National Health System (public reimbursement). Please note that currently this is on hold pending the publication of a new regulation governing such medical devices. 

The procedure for requesting a medical device to be included in this reimbursement system is quite similar to the procedure for medicines. Medical devices must comply with the specifications and proven technical performance previously determined by the Ministry of Health, and a series of general, objective, and published criteria are taken into account, specifically the following: 

• Severity, duration and side-effects of the different pathologies for which the medical device is indicated. 
• Specific needs of certain groups. 
• Diagnostic, control, treatment, prevention, relief or compensation of a disability. 
• Social value of the medical device and its incremental clinical benefit, taking into account its cost-effectiveness. 
• Existence of medical devices or other therapeutic alternatives for the same conditions at a lower price or lower treatment cost. 

As stated above, while in certain European countries digital therapies are already a reality, Spain is still developing much of the legal and commercial infrastructure in this regard.  

This prompted the creation in December 2022 of the Spanish DTx Consortiumin December 2022 to promote the adoption of digital therapies whose main objective is the definition of a sustainable financing model that guarantees market access to this type of technological solutions. 

The consortium is working to speed up the implementation of digital therapies in Spain by generating a specific regulatory framework through the analysis of relevant experiences in pioneering countries and cross-sector co-creation with the main players in the ecosystem, such as the Administration, healthcare professionals, patients, startups, hospitals.