Patient questionnaires (ePRO)

The patient's personal link, what the patient sees, how to revoke access.

Forms marked as filled in by the patient (ePRO) are answered by patients themselves, on a phone, through a personal link. No account: the personal link (or its QR code) and a PIN of 4 digits that the patient chooses.

How it works

1. In the eCRF builder, the form is marked as filled in by the patient and added to the visits.
2. The investigator opens the patient card and clicks Create a link for the patient.
3. At the visit the site prints the Leaflet with the QR code and hands it to the patient; the link can also be sent by messenger (Copy puts it on the clipboard).
4. On the first visit to the link the patient chooses a PIN of 4 digits; from then on the page asks for it.
5. The patient opens it on a phone and sees only their own questionnaires whose visit window is open now, with the last day to answer, the ones already sent and the next one coming.
6. The answers are checked like the investigator’s (required answers, allowed ranges) and appear in the patient card at once, with the source Patient (ePRO). The audit trail names the author as “Patient REGDIA-01-0005”.

Sign-in with a QR code and a PIN

The patient points the phone camera at the QR code on the leaflet and taps the link: no app is needed. The first time, the patient chooses a PIN of 4 digits and types it twice; PINs that are easy to guess (1111, 1234 and the like) are refused. YouEDC keeps only a hash of the PIN. After 30 minutes without activity the page asks for the PIN again; on a shared phone the patient taps Sign out.

Five wrong PINs in a row lock the sign-in for 15 minutes; the audit trail records the lock. If the patient lost the phone or the link went to the wrong person, the site clicks New link and prints a new leaflet: the old link and the old PIN stop working at once, and the patient chooses a new PIN. If the patient only forgot the PIN, the link stays: the site resets the PIN (below).

The patient forgot the PIN

In the patient card, in Questionnaires for the patient, you see the state of the PIN: not chosen yet, chosen, locked until …, reset, waiting for the patient or reset, the code has expired. The investigator or coordinator of the patient's site (the right “Send patients their survey links”) and the project manager can reset the PIN; a monitor or a data manager cannot, and a patient of another site does not exist for an investigator.

1. Click Reset the PIN, choose the reason: The patient forgot the PIN, The PIN is locked after wrong tries or Other (then write it), and click Reset and get a code.
2. The card shows a one-time code of 6 digits. It is shown only once and is valid for 72 hours; YouEDC keeps only its hash. Tell the code to the patient in person or by phone, after you have made sure it is the patient.
3. The patient opens the same link (or the same QR code), enters the code and the new PIN twice. A wrong code counts as a wrong try: after five the sign-in locks for 15 minutes. If the code has expired, reset the PIN again.

The reset clears the old PIN and its lock and closes the patient's open sessions on every phone. The link, its QR code and leaflet, the notifications on the phone, the e-mail reminders and the answers waiting on a phone without the internet stay. The site's tablet needs no PIN, so the reset does not touch it. The audit trail records the reset (who, when, the reason and the PIN's previous state) and the patient choosing the new PIN. A new link cancels an unused code.

One question per screen

The questionnaire shows one question at a time with big answers, the number of the question and a progress bar. Next does not move on while a required question has no answer or the answer breaks a check. Conditions work as in the eCRF: a question that a condition hides is skipped. At the end the patient sees All correct? with every answer; tapping an answer goes back to its question. After Send to my doctor the answers are fixed.

A numeric scale stays on one line, as on paper. If the phone’s browser runs no JavaScript, the questionnaire opens as one page, as before.

When and how the answer came

Every questionnaire sent keeps its metadata: when it was opened and received (server time), the phone’s own clock and time zone, how long the patient took and the kind of device (for example “phone · Android · Chrome”). No address and no phone number are kept. The site and the data manager see it under the note The patient’s own answers (ePRO) on the form; a phone clock that differs from the server by 5 minutes or more is shown in bold.

E-mail reminders

On the questionnaire page the patient can switch on reminders: types an e-mail address and ticks the agreement. A letter comes when a questionnaire opens and on its last day if it is still not sent, between 09:00 and 21:00 local time. The letter names neither the study nor the questionnaire: only the date, the personal link (it still asks for the PIN) and a one-click unsubscribe link. In the patient card the site sees the address masked (pa***@mail.ru) and can switch the reminders off and delete the address. The audit trail records who switched them on or off, never the address.

Reminders by SMS

When the Portal Owner has set up the SMS gateway, the site can also send the personal link and the reminders by SMS. In the patient card, under SMS to the patient, the investigator records the patient’s consent with the mobile number, the date and the language, then presses Send the link by SMS; the reminders then come by SMS too, from the same hourly job, between the hours set for the portal. The number is kept encrypted and shown masked, the text names neither the study nor the patient and never carries the PIN; Stop SMS stops them and deletes the number, and the patient can switch them off on the questionnaire page. Each message is in the delivery log under the block and in the audit trail. Messengers (WhatsApp, Telegram, Viber) are deliberately not supported. Details: SMS to patients.

The adherence board

ePRO adherence in the study menu shows one site’s active patients, the ones who need the site first. Dots are the questionnaires so far: green sent, a red ring missed, amber open now. Next come the share sent, the last answer, whether reminders are on, and what to do: call the patient after two missed in a row, a missed questionnaire, has not signed in (the link is issued but no PIN yet), no link, a questionnaire is open or all good.

Screen pack for the ethics committee

In the eCRF builder, the ePRO screens for the ethics committee button (shown when the study has forms completed by the patient) gathers every screen the patient sees, in order, from the eCRF in force: choosing the PIN and signing in, the list of questionnaires, each questionnaire one question per screen with its answers and their codes (and when a question is shown only after a certain answer), the check before sending, the reminder card, both reminder letters, the unsubscribe page and, when SMS are on, the SMS texts. The texts are the very ones of the patient’s pages. Choose Russian or English at the top and download a PDF/A to file with the ethics committee or to send to the owner of a licensed scale for a screen review. Each download is recorded in the audit trail.

Time travel for test patients

While the study is being set up (and in demo projects), the patients are test patients: they are deleted when the study goes live. In such a patient’s card, the Time travel box moves the patient’s ePRO calendar ahead by 1, 7 or 28 days. The patient’s page then shows the questionnaires of that day with a yellow “Test patient” bar; questionnaires open and close, reminders go out and the adherence board changes as they would in real life. Back to today resets the shift. Only the date the windows are measured against moves: the time stamps of answers and of the audit trail stay real, and every move is in the audit trail. In a live study the box is not shown and the shift is ignored.

Diary hours

A visit in the builder has the fields Patient from, h and to, h: the hours of each day of the window when the patient may fill in the forms, for example 18 to 23 for an evening diary. Before the hours the patient sees “The next one opens” with the date and 18:00; after them the questionnaire moves to the next day of the window. Empty means any time. The site enters data at any time: the hours limit only the patient.

Event diary

An event (a visit of the kind “On event”) with a form the patient fills in appears to the patient under Something happened?. The patient taps it when the event happens, for example an episode of low blood sugar, and fills in the form without waiting for the next questionnaire. The system creates a new event dated that day; the audit trail says “reported by the patient” with the author “Patient”. An alarming answer opens a query for the site, as in any questionnaire. Up to 10 reports a day can be sent.

A questionnaire by rule

A questionnaire can be sent not only by the schedule but also by a rule: “if the adverse event is severe, send the symptom diary for 7 days”. Such a rule is set on the form’s page in the builder, in the block Actions on event. The questionnaire appears to the patient in its window, reminders come as usual, and when the data are corrected and the rule no longer holds, a questionnaire not yet sent leaves the patient’s page.

The patient’s progress

Below the questionnaires the patient sees a bar and the line “You sent 8 of your last 9 questionnaires” with a thank-you. The list Already sent shows the last 10 questionnaires and reports, the newest first, with the date sent.

The site’s tablet

When the patient has no phone, or prefers to answer at the visit, the site gives them its own tablet in kiosk mode. The function is switched on in the administration (“ePRO on the site's tablet”).

1. Pair the tablet, once. In the study menu open ePRO adherence → Site tablets, choose the site, name the tablet (for example “Room 204”) and press Add and show the code. On the tablet open /kiosk or point its camera at the QR code and enter the pairing code. The code works once, for 15 minutes. Pairing signs out of YouEDC in the tablet’s browser: the tablet never keeps a team member’s access.
2. Pin the browser. So that the patient does not leave for other apps, switch on screen pinning on Android or Guided Access on iPad.
3. Hand it to the patient. In the patient’s card, under “On the site’s tablet”, choose the tablet and press Hand over. In a few seconds the tablet shows “Prepared for patient …” with the patient’s code and the team member’s name; the team member checks the code and gives the tablet. The patient presses Start the questionnaires.
4. The patient answers. The tablet has only this patient’s questionnaires open now, one question per screen, with the same checks as on the phone. Reminders, My data and the event diary are not on the tablet: they live on the personal link.
5. The end of the session. The patient presses Finish, and the tablet goes back to its lock screen, which shows nothing about the patient. After 5 minutes without a touch it asks “Are you still here?” and locks by itself 30 seconds later. The session also ends when a team member presses Take back in the card, hands the tablet to another patient, or the patient does not start within 10 minutes.

No PIN on the tablet: the team member who hands it over knows the patient in person. The answers are saved as the patient’s own (source “Patient (ePRO)”, the audit actor “Patient …”). The form shows “site tablet “Room 204”, handed over by …” under the mark of the patient’s own answers. The audit trail keeps adding, pairing and revoking a tablet, every handover (who to whom) and the end of each session with its reason and the number of questionnaires sent.

The project administrator and the investigators of their own site add tablets, hand them over and take them back; a monitor sees the list. New code unpairs a tablet (for example when it is replaced), Revoke closes it at once.

Answers by a representative

Some questionnaires are answered not by the patient but by a parent, a legal guardian or a caregiver: a young child, a patient who cannot answer (an observer-reported outcome). The function is switched on in the administration (“ePRO: a representative's answers and the site's interview”).

1. In the builder, in the settings of a form completed by the patient, choose Who answers: the patient only (as before), the patient or a representative, or a representative only. The choice goes into the eCRF version like the other settings of the form.
2. In the patient’s card, in the Representatives section, press Add a representative: who they are to the patient (mother, father, legal guardian, spouse, adult child, caregiver, other) and how they get access (in person at the site with the identity checked, by phone, by text or messenger). A name is optional, only to tell two representatives apart; it never goes into the audit trail and is encrypted when the study encrypts personal data.
3. The representative gets their own link and the leaflet with its QR code, and chooses their own PIN, exactly as the patient does. Their page shows only the questionnaires open to a representative and says that they answer as the patient’s representative. E-mail reminders, notifications and “My data” stay the patient’s own. A representative who forgot the PIN gets a new link (New link): the reset with a one-time code is for the patient’s own link.

Every answer says who gave it. The audit actor is “Representative of patient … (mother)”, never the patient; the form shows “Answered by: the patient’s representative (mother)”, the card marks the form “ePRO · mother”, and the export and the casebook name the respondent. A wrong PIN locks only the representative’s link. New link replaces the link (the PIN is chosen again), Revoke stops it at once; the representative’s earlier answers stay attributed to them.

Interview by phone or at the visit

When the patient cannot fill in a questionnaire alone, a team member of the site reads it to the patient (or the representative) by phone or at the visit and enters the answers. In the builder tick The site may enter the answers in an interview in the form settings: only such questionnaires can be entered this way.

1. In the patient’s card, the Interview section lists the questionnaires open now that allow an interview. Open one.
2. Choose how the interview took place (by phone or at the visit), its date and time, and who gives the answers (the patient or a recorded representative, as the questionnaire allows).
3. Read each question as written, with its answer options, without explaining or suggesting; enter the answers, tick the confirmation and press Save the answers. The same checks as on the patient’s phone apply.

The answers are saved as the patient’s own with the source “Patient (interview)”: nobody in the team changes them later, a mistake goes through a correction request. The audit actor is “team member on behalf of patient …” with the team member’s account; the form shows the mode, the time of the interview, who entered the answers and who gave them. The export has the source interview on the form’s sheet and a Respondents sheet (respondents.csv): for every questionnaire of a patient its SOURCE, RESPONDENT (PATIENT or REPRESENTATIVE), RELATION, INTERVIEW (phone or visit), INTERVIEW_AT, ENTERED_BY and RECEIVED_AT. The sheet appears only in studies that use representatives or interviews.

Representatives are added, re-linked and revoked by the project administrator and the investigators of their site; an interview is entered by those who enter data (the project administrator and the investigators). A monitor sees the card but changes nothing.

Scale mode

For a questionnaire or scale the sponsor uses under the owner’s licence, open Form → Scale mode in the builder. The passport keeps the instrument, its version (for example, Russian v2.1), its owner, the sponsor’s licence and the licence end date; it shows under the form title and in the ethics committee screen pack. 30 days before the licence ends the form shows an amber warning, after the end a red one.

Lock the texts fixes the questions, hints, answers, their order, the answer type, the limits of a scale and the score formula: a field cannot be added, deleted, moved or reworded, while other properties (for example, required) can still change. The texts are unlocked only with a reason; locking, unlocking and the reason go to the audit trail.

YouEDC does not ship licensed scales (EQ-5D, SF-36, HADS and others): the sponsor enters them under its own licence. The library has free formats with no licence: a 0–10 numeric rating scale of symptoms (NRS) and a 0–4 verbal rating scale (VRS), each with a score; they are generic formats, not validated questionnaires.

The library also has two free validated questionnaires, the PHQ-9 (depression) and the GAD-7 (anxiety): their owner, Pfizer Inc., requires no permission to reproduce them. They come word for word from the official English version, with the owner’s credit line under the questions, and arrive in scale mode with the passport filled in and the texts locked. The library has no official Russian version of them yet: in a study in Russian the builder marks them English only, and the patient answers them in English even with the pages in Russian. See Form library.

Questionnaire scores

A calculated field can compute a Mean of fields and a Questionnaire score: the sum of the items. Items are number fields, scales or single choices whose option codes are numbers. For a score, set how many items may be missing: with no more missing, the sum of the answered items is scaled to all items (times the number of items, divided by the number answered); with more, the score stays empty. The server computes the score when the form is sent, the patient does not see it, and the formula is part of the eCRF version.

The PHQ-9 and the GAD-7 of the library count their total only when every item is answered (none may be missing), and a second calculated field gives the severity band: PHQ-9 0–4 minimal, 5–9 mild, 10–14 moderate, 15–19 moderately severe, 20–27 severe; GAD-7 0–4 minimal, 5–9 mild, 10–14 moderate, 15–21 severe.

Alarming answers

Add an edit check with the warning severity to the questionnaire, for example “well-being is less than or equal to 3”. The patient does not see the warning, but when the questionnaire is sent an automatic query opens for the site: contact the patient.

The PHQ-9 of the library brings such a check of its own: any answer above “Not at all” to item 9 (thoughts of being better off dead or of self-harm) opens the query “PHQ-9 item 9 positive: the investigator assesses suicide risk”. In the migraine demo study (DEMO-MIG) the patients answer the PHQ-9 and the GAD-7 at joining and at 3 and 6 months; one of them answered “Several days” to item 9, the query opened and the investigator answered it after a call.

Link security

The link is long and random: it cannot be guessed, and guessing is slowed down. Without the PIN the page shows nothing but the sign-in; it never shows the patient’s ID, is not cached and is not indexed. If the link has reached the wrong person, click New link (the old one stops working at once) or Revoke. For a patient who has completed or left the study, or when the database is locked, the link opens a read-only page.

The patient’s answers cannot be edited

A form the patient sent through ePRO belongs to the patient. Nobody in the team can change it: the form opens read-only with the note The patient’s own answers (ePRO), and an import skips it. This is what FDA and EMA require for patient-reported data: the investigator does not change what the patient answered.

A form for the patient that the site filled in itself (for example from a paper copy) stays editable as before, with a reason for each change.

Correcting a mistake by request

If the patient reports a mistake (pressed the wrong button, mistyped a number), the investigator opens the form and, under ePRO correction requests, chooses the answer, types the correct value as the patient said it (for a choice, its code or its text), how the patient told it and what they said, then clicks File the request. The answer does not change yet.

The data manager (or the project administrator) sees the requests on the Queries page and approves or rejects them; a rejection needs a comment. The person who filed a request cannot decide it. On approval the answer changes; the audit trail names the patient as the author with the request number, and the original value stays both in the request and in the history.

An assessment of a past period (“pain in the last 24 hours”) is not re-rated later: a request is for a technical mistake the patient reported. After the soft lock no request is filed or decided.

Example from the demo

In REG-DIAB-01, the 6-month window of REGDIA-01-0005 is open until 06.11.2026. Anna Petrova opens the patient card: under Questionnaires for the patient there are the link, its QR code and the Leaflet with the QR code button.

She prints the leaflet and hands it to the patient at the visit. The leaflet has the study’s name, the QR code, three steps and the patient’s code; no name and no diagnosis.

The patient scans the code and chooses a PIN. The PIN 2580 is refused as too easy to guess, so the patient chooses another one.

On the phone the patient sees one questionnaire to answer, “Well-being questionnaire · 6-month visit · until 06.11.2026”, and the next one coming from 09.03.2027.

The questionnaire goes one question per screen. If the patient answers 3 or less to the well-being question, the answer is saved and an automatic query opens for the site: contact the patient.

Before sending, the patient checks all answers and can tap any of them to change it.