Why CRC Toolbox Never Asks for a Login

Zero-PHI is an operating rule, not a magic shield. The tools are designed so you must not enter Protected Health Information: no subject names, MRNs, dates of birth, addresses, or free-text narratives that identify a person. Allowed operational fields look like kit and lot labels, protocol codes, visit labels, randomization / subject numbers (as numbers), asset tags, air waybill numbers, and administrative due dates.

That is an architecture and policy stance for site logistics utilities. It is not a blanket claim that every institution can skip counsel, skip a BAA for every future product surface, or treat any browser tab as a validated Part 11 system. CRC Toolbox is an administrative reference aid. Protocol SOPs and primary site records remain authoritative.

If a reviewer asks “what happens if someone pastes a name anyway?” the honest answer is: free-text surfaces (notably deviation notes and lab paste) run client-side identifier heuristics and warn before export or print. Heuristics are not perfect. The primary control remains “do not enter PHI,” reinforced in UI copy and in the stricter IP accountability guardrails.

Tool logic executes in the user’s browser. Protocol Ops workspaces — study lifecycle, kit and cohort inventory, lab workbench, deviation drafts, IP accountability, equipment calibration, regulatory deadlines, visit windows — persist in that browser’s localStorage on the workstation until the user clears them or imports/exports a session backup. Clinical calculators, renal/performance helpers, Safety & GCP, and CTCAE grading run in ephemeral memory and are not written into those workspaces.

During ordinary calculation, parsing, FIFO allocation, and CAPA drafting, the application does not POST kit closets, requisition text, deviation drafts, or IP logs to CRC Toolbox servers. Site IT can verify this during a workflow by opening DevTools → Network and confirming no tool-data fetch traffic for the action under review. That inspectability is intentional.

Persistence is local, not multi-user cloud. localStorage is per browser profile on a machine. Export Session Backup (.json) is how sites move Zero-PHI logistics state between clinic PCs. On shared kiosks, Clear all local site data is the end-of-shift control. Sample demos under /samples use tab sessionStorage by design and reset when the tab closes — useful for training without leaving durable state.

Production responses also set standard browser hardening headers (CSP, frame denial, nosniff, HSTS, and a limited Permissions-Policy). Camera access is only for same-origin barcode scan flows when the user opts in. Those details matter less than the data-flow claim, but they are part of the same “inspectable, not magical” posture.

Login creates a review path before value. Even a free tool that requires an account, uploads inventory, or syncs “de-identified” notes to a vendor cloud often stalls behind questionnaires that are longer than the pain the tool would relieve. Coordinators feel that as friction; directors feel it as liability — especially after blocking other vendors over data-sharing ambiguity.

CRC Toolbox keeps the first-use path account-free so a site can evaluate fitness on a workstation without provisioning users. That does not forbid future optional Pro/Team features behind authentication — it means the free logistics utilities are not gated on identity today, and their operational data path stays local.

If your institution still requires a written review before any new URL is used on clinic machines, the review packet can be short: allowed field types, localStorage scope, clear-all procedure, voluntary Formspree exception, and a DevTools Network check during a sample workflow.

There is one outbound user-message path: voluntary lead-capture forms (for example, “Email me this backup,” printable resource tips, newsletter opt-in, waitlist). Those submissions send email address and light product metadata (such as a feature_source tag and optional tool name) through Formspree. They must never include PHI, and they do not attach workspace JSON, kit lists, deviation drafts, or IP logs.

“Email me this backup” is lead-capture plus a local download trigger — the backup file still downloads in the browser and is not emailed or uploaded as an attachment. Email signups are processed by Formspree, which may set a technical cookie on formspree.io during submission; CRC Toolbox does not load Formspree’s hosted page or ad scripts for tracking.

If your review hinges on “does any third party ever see anything?”, the accurate answer is: only when a user voluntarily submits an email form, and only the form fields — never the site’s logistics workspace contents. Full detail lives on the Privacy Policy and Security pages.

Sites block useful software for rational reasons: unclear data flows, mandatory accounts, and “another cloud” with ambiguous retention. A client-side, no-login logistics utility does not erase institutional process — reviewers still decide — but it shrinks the questionnaire to a short architecture story: what fields are allowed, where state lives, how to clear it, and what the voluntary email exception sends.

That is the practical point of the design. Coordinators get tools they can try on clinic day one. Reviewers get claims they can inspect rather than trust on branding alone.