Bring Your Own Device (BYOD) for Research Data Collection

Bring your own device (BYOD) data collection means a study relies on hardware the participant or researcher already owns and controls — a personal smartphone, tablet, or consumer wearable — rather than a device the study purchases, configures, and later reclaims. It is now common in ecological momentary assessment (EMA/ESM), passive sensor and activity monitoring, and electronic patient-reported outcome (ePRO) collection, because it avoids the cost and logistics of provisioning a fleet of study devices and lets data collection happen inside the participant’s normal routine.

Why studies choose BYOD

• Recruitment and retention: participants install an app rather than learn an unfamiliar study-issued device, lowering the burden of enrolling and staying enrolled.
• Ecological validity: data captured on a device the participant carries habitually (their own phone, their own watch) can better reflect real-world behavior than data captured on a device used only because the study requires it.
• Cost and logistics: no device purchasing, shipping, provisioning, or end-of-study retrieval.

Governance and data-integrity challenges

These advantages come with distinct risks that a study-provisioned device largely avoids or centrally controls:

• Device and sensor heterogeneity: participants’ phones and wearables span different manufacturers, operating-system versions, and sensor hardware, so a step count, heart-rate reading, or GPS trace is not necessarily comparable across participants the way it would be from identical, centrally calibrated study hardware. Studies using BYOD sensor data typically need to document device make/model/OS as a covariate and validate sensor accuracy rather than assume it.
• Data security: a personal device is not under the study’s mobile-device-management control — it may be shared with family members, run outdated software, lack encryption, or already host other apps with broad permissions. Because the study cannot lock the device down the way it could a provisioned one, security controls have to live in the study app itself (encryption in transit and at rest, authentication, minimal local data retention) rather than in device configuration.
• Data provenance and chain of custody: without a controlled device, a study needs its own audit trail showing which participant, which device, and which app version produced a given data point, since it cannot rely on device-level attestation the way a fully managed device allows. See data provenance.
• Informed consent scope: participants need to understand what is being collected from their own device — which sensors or data streams the app accesses, whether collection is continuous/passive or only active during prompted tasks, how study data is kept separate from the participant’s personal data and other apps, and how to fully remove the app and any collected data if they withdraw. This is an extension of ordinary informed-consent practice (see informed consent and the fuller informed consent in research guide), not a separate consent framework.
• Equity and selection bias: requiring participants to already own a suitable smartphone or wearable can systematically exclude people who don’t — older adults, lower-income participants, and other groups with lower device ownership or older/incompatible hardware. FDA’s guidance on remote data acquisition explicitly cautions against excluding otherwise-eligible participants solely because they lack a compatible personal device, which is why many BYOD designs pair it with a fallback of study-provisioned “loaner” devices for participants without one.

Regulatory and standards context

FDA’s final guidance, Digital Health Technologies for Remote Data Acquisition in Clinical Investigations (issued December 2023), addresses BYOD directly for FDA-regulated clinical investigations: it lays out the tradeoffs of a BYOD approach relative to sponsor-provisioned devices and reiterates that participants without access to a qualifying personal device should not be excluded from the trial. For clinical investigations under FDA oversight, a BYOD data-collection design should be documented and justified as part of the protocol’s digital health technology selection and validation plan, alongside the usual data-management-plan considerations that apply to any remote or electronic data capture (see electronic data capture (EDC) and data management plan (DMP)).

Outside the clinical-trial context, NIST’s practice guide SP 1800-22, Mobile Device Security: Bring Your Own Device (BYOD) is the standard general-purpose reference for securing personally-owned mobile devices used to access an organization’s systems and data, and its architecture (containerization, mobile application management, minimal-permission app design) is a reasonable model for research IT teams building a study-specific BYOD app rather than relying on full device management.

Where the personal device is used to transmit protected health information, ordinary HIPAA obligations for the covered entity/business associate still apply regardless of who owns the hardware — see HIPAA in clinical research.

References

• FDA, Digital Health Technologies for Remote Data Acquisition in Clinical Investigations: Guidance for Industry, Investigators, and Other Stakeholders (final guidance, December 2023).
• NIST Special Publication 1800-22, Mobile Device Security: Bring Your Own Device (BYOD), National Cybersecurity Center of Excellence (final, 2023).