Patient-mediated research data: the architecture of a covenant

§ 01The problem: research starves while the data exists

Start with one patient. She has a chronic condition, which in practice means a primary-care physician, three specialists, a pain clinic, and a portal login for each — six versions of her medical history that have never been in the same room. The only integration layer in modern chronic care is the patient herself, carrying printouts between waiting rooms. The data a researcher would need exists. It exists in pieces, everywhere, and is usable nowhere.

Now follow the copies that do move. A parallel economy packages "de-identified" health data — claims, prescriptions, lab feeds, app telemetry — and trades it at scale. De-identification is the legal device that makes the trade possible: strip the name and certain fields, and in most regimes the record stops being the patient's in any enforceable sense. Under HIPAA the operative text is 45 CFR §164.514(b): satisfy either of its routes — expert determination or Safe Harbor — and the data falls outside the rule entirely. Everyone in that chain is paid — the broker, the aggregator, the analytics buyer, often the original data holder — except the person the record describes, who typically does not know the transaction occurred. We have traced how this market works elsewhere; the point here is structural. The one party with both the moral claim and the longitudinal knowledge has no seat at the table.

The same de-identification that erases the patient's claim also erases much of the research value. A de-identified record cannot ask its subject a follow-up question. It cannot be linked forward as the disease progresses, cannot consent to a trial, cannot contribute the decades of symptom history that never made it into a billing code. The broker economy sells the husk and discards the relationship.

And still research starves. Chronic-disease studies routinely fail to find the participants they need: recruitment remains the most common reason trials run late, and by most published estimates a large share of trials miss their original enrollment timelines. The bitter irony is what recruiters are searching for — consented, well-characterized, longitudinal patients. That is a precise description of the people whose fragmented records and uncompensated data the first two paragraphs describe.

So the problem is not scarcity. The records exist; patients say yes in large numbers when asked respectfully; the analytic methods are mature. What is missing is a lawful, auditable channel between a patient who wants research to happen and a researcher who needs that patient's data — one that does not route through a broker and does not require the patient to vanish from the transaction. This paper describes one.

§ 02The model: patient-mediated access

Patient-mediated access means the patient is the channel through which research reaches the record. Precisely: the patient's records are gathered onto a platform the patient controls; each study presents a specific request; the patient grants or refuses that request; a grant is scope-limited to that study and revocable at any time; and the platform mediates the access without ever owning, buying, or selling the data. The unit of the model is not the dataset. It is the decision.

This differs from a data sale in the obvious way: in a sale, a copy changes hands and the patient is absent. It also differs from the quieter default, institution-mediated sharing, in which a hospital, biobank, or registry decides on the patient's behalf — under a broad consent signed years earlier, or under a waiver that means the patient was never asked at all. Institution-mediated sharing can be done responsibly, and much good research rests on it. But it asks patients to trust an open-ended future, and the consent beneath it is a single signature set against unlimited downstream uses. Patient mediation replaces one signature, unlimited futures with one decision per study.

The decision itself is built to be understood. Every request arrives as two documents: a plain-language summary a person can actually read — what the study is, what data it touches, for how long, who is behind it — and the formal authorization that satisfies the law. Same decision, two altitudes. One yes covers both; one no needs no justification; and a revocation is a first-class event that stops future provisioning as fast as a grant started it.

Then there is the money, which deserves plain words because it is the part most easily misread. Patients on the platform are paid fair-market participation fees, and a fee posts only when an IRB-approved research-use event occurs — a study with ethics approval actually uses the records the patient consented to provide. The distinction carries the whole model. A price on data invites accumulation, resale, and the broker economy of section 1. A fee for participation compensates a contribution to one specific, approved study — closer to the long tradition of paying research participants for their time than to any marketplace. Whether patients should be paid at all is a fair debate, with undue-inducement worries on one side and an industry that pays everyone but the patient on the other; the IRB-gated, fair-market structure is our answer to both. Fees are for participation, never payment for data — nothing on the platform is for sale, no matter who asks.

§ 02aThe consent lifecycle: revocation as a first-class event

A consent that cannot be cleanly withdrawn is not a decision; it is a deed of transfer with extra steps. So the platform treats consent as a state machine with explicit transitions, and treats the unhappy transitions — decline, lapse, revocation — with the same engineering care as the happy one.

A study's request begins as requested: visible to the patient, touching nothing. A decline ends the matter — no access, no record provisioned, no justification asked, and no penalty anywhere in the system for having said no. A yes moves the grant to granted: a live, scope-limited object naming the study, the data classes it may touch, and the time window it may touch them in. When the study's first query arrives, the grant is active, and from then on it is re-evaluated on every query, at execution time, in the query path. Consent here is not a checkbox consulted once at enrollment; it is a precondition checked every time.

Revoked is therefore not an exception path; it is a first-class state with defined semantics. The moment a patient withdraws a grant, the next query against that grant fails the runtime check — there is no grandfathering, no draining of in-flight pipelines, no grace period during which the study finishes what it started. Revocation stops all future use. What it cannot do is unpublish mathematics: aggregates already released from a cohort that included the patient remain released, and the plain-language consent document says exactly that, in those words, before the patient ever says yes (section 7 returns to this honestly).

Grants also end without drama: every grant carries an expiry inherited from the study's approved window; when it closes, the grant lapses on its own, and continued access requires a fresh request and a fresh yes. A patient's silence never extends a study's reach.

Every transition in this lifecycle — request, decline, grant, activation, lapse, revocation — writes an entry to the audit spine of section 3a. A patient looking at her own history sees the full state machine of every study that ever asked, including the ones she turned down. The system is designed so that the question "who could touch my record, and when?" always has an exact, replayable answer.

§ 02bThe economics of access: a fee that returns to the patient

The commercial design follows from one sentence: research licenses access on the patient's terms; it never buys the data. Access, not ownership. The distinction is not branding — it determines what is being paid for, by whom, and what the money can never do.

The flow is short. A sponsor or research organization pays for consented access to the platform's cohorts and tooling. When an IRB-approved study actually uses a patient's records — a consented, gated, logged research-use event — a fair-market participation fee posts to that patient. The patient is paid on every approved use, not once at signup, because the fee is compensation for an ongoing contribution, not the closing price of a transfer. No copy changes hands; the records stay on the platform, under the grant, behind the gate; what the sponsor obtains is a governed, revocable channel to ask questions.

Why fee-per-approved-use rather than the obvious alternatives? Pay-per-signup recruits email addresses, not longitudinal records, and the payment ends precisely where the contribution begins. Pay-per-record-copy is the broker economy with the patient's name on the invoice — once a copy is priced and transferred, accumulation and resale follow, and control does not. Tying the fee to the IRB-approved use event aligns every party with the same moment: the sponsor pays when research actually happens, the patient is paid when her contribution is actually used, and the audit spine logs the identical event that triggered the money. One event, one log entry, one fee.

The IRB gate in that sentence is load-bearing, and it is governance, not decoration. Research ethics has a settled framework for compensating participation — the Belmont Report's respect-for-persons principle, the Common Rule (45 CFR 46) machinery of review, and the Declaration of Helsinki's requirement that research on humans answer to an independent committee. The platform is architected so that the fee event is downstream of that review: no approval, no use; no use, no fee. An ethics board therefore sees the compensation structure of every study it approves, which is exactly where the undue-inducement question belongs — examined per study, by the body built to examine it, not settled once by a marketplace's terms of service.

Two consequences are worth stating plainly. First, the platform's commercial incentive points the same direction as the patient's: revenue follows approved research use, so the platform prospers only when consented research happens — not when data accumulates, never when it leaves. Second, the banned sentence stays banned. The platform does not sell data with consent, without consent, de-identified, aggregated, or under any other adverb. There is no bulk-export product, no price-per-record anywhere in the design, and section 5a describes what happens to buyers who ask.

§ 03The machinery: one auditable spine

A model is only as honest as its enforcement, so the architecture is a single spine that every request must traverse. There are no side doors and no export paths around it.

The system of record is FHIR R4, constrained to the US Core 6.1.0 profiles, with versions pinned deliberately: when a regulator or a researcher asks what a field meant on a given date, the answer must be exact and reproducible. For research, the platform projects OMOP CDM views from that same source — FHIR as the truth, OMOP as the research-shaped lens — so analyses written for the OHDSI ecosystem run against the platform without bespoke exports. One copy of the truth, two well-defined shapes.

Above the records sits the dynamic consent engine. Consent here is not a signed PDF in an archive; it is a runtime check in the query path. Every study's grant is a live, scope-limited object, and every access is evaluated against it at execution time. That is what makes revocation real rather than rhetorical: the moment a grant is withdrawn, the next query simply fails the check.

Cohorts are built by deterministic engines. A phenotype — "patients matching this condition's clinical pattern" — is versioned, testable logic over codes, medications, and observations; a cohort definition is the same discipline applied to inclusion criteria and time windows. Given identical inputs, identical outputs, every time. Determinism is not a stylistic preference. It is what makes the next layer enforceable, because a gate can only guard a process whose behavior is fixed.

That layer is the release gate. No cohort leaves the platform below k = 5: if fewer than five consented patients match, the answer is no answer — the gate refuses, and the refusal is logged. The floor descends from Latanya Sweeney's formalization of k-anonymity, which is worth quoting in the original:

A release provides k-anonymity protection if the information for each person contained in the release cannot be distinguished from at least k − 1 individuals whose information also appears in the release.

Five aligns with decades of small-cell suppression practice in health statistics, but the design decision is not the number — it is the number's nature. The floor is not configurable. There is no administrative override, no flag for a sufficiently important study, no senior-enough person. We walk through the reasoning in the k-anonymity explainer; the one-sentence version is that a floor you can lower is a floor in name only.

AI is present in this machinery and deliberately subordinate. Locally hosted models — patient data never leaves for third-party clouds — assist discovery: helping translate a researcher's plain-English question toward candidate phenotype logic, summarizing, drafting. No model decides eligibility, consent, or release. AI assists; deterministic engines decide. A suggestion can be wrong harmlessly. A release cannot.

Beneath everything runs the witness: an append-only, cryptographically anchored audit trail with six-year retention. Every grant, refusal, revocation, query, release, and fee event lands on the same spine, hash-linked so that history can be extended but never quietly edited. Most platforms can tell you their policy. The design goal here is to be able to prove the history.

§ 03aAnatomy of the audit spine

Because the audit trail is the load-bearing answer to "why should anyone believe this?", it deserves to be opened up rather than gestured at. Here is what one entry contains, and why each field is there.

An entry records when — a UTC timestamp, in append order, because an audit trail that can be reordered can be rewritten. It records what — an event type drawn from a closed vocabulary (grant, decline, revocation, query, release, refusal, fee, and their administrative kin), closed because free-text event types are where ambiguity goes to hide. It records who and under what authority — the acting principal and a reference to the specific grant that authorized the action, so every access points back at the consent that permitted it. For release events it records the cohort size at the moment of release, because "it passed the gate" should be checkable arithmetic, not an assertion. And it carries the chain fields: a hash of the previous entry and a hash of itself. The previous-hash makes the log a linked chain — remove or alter any entry and every subsequent link breaks visibly; the entry's own hash seals its contents and becomes the next entry's anchor.

Append-only has a precise operational meaning here: there is no update and no delete anywhere in the spine's interface. Mistakes happen in real systems, so corrections are themselves entries — a superseding event that points at what it corrects, leaving both the error and the fix permanently visible. A log that can be tidied is a log that can be laundered; this one is designed so the only way to change history is to add more of it.

Three audiences read the spine. The patient sees every event that ever touched her records — every request, every access, every fee, every refusal — in plain language, because the covenant of section 8 is unenforceable if the patient cannot inspect it. A regulator or auditor gets the provable version: the chain verifies end-to-end, retention runs six years at minimum, and the question "show me every access to this class of record in this window" is a query, not an archaeology project. Researchers get the discipline of knowing every query they run is itself an entry — observation cuts both ways here, by construction.

One more property matters: refusals are logged with exactly the same weight as releases. A platform that records only its successes has a diary, not an audit trail. The k-gate's refusals, declined consents, and failed authorization checks all land on the spine, because the system's no is as much a part of its history as its yes.

§ 03bOne request, end to end

Sections 2 through 3a each described a layer. Here is the same machinery seen sideways — one study request traversing the spine, with every checkpoint it cannot avoid. This is the trace our demonstrations walk on synthetic records, and the shape of the production path by design.

A researcher submits a cohort query: a versioned phenotype, inclusion criteria, a time window, and the aggregate statistics requested. The gateway authenticates the request and resolves it against the study's grants — not the study's paperwork, the live grant objects of section 2a — and any record without a live, in-scope, unexpired grant is simply not part of the queryable universe for this request: consent is not a filter applied to results; it defines what exists to be queried at all.

The deterministic engines then build the cohort — same inputs, same outputs, every run — and hand the count to the k-gate. At five or above, the release proceeds and only aggregates cross the boundary: counts, distributions, summaries, never patient-level rows. Below five, the request ends with a refusal, written to the spine with the same ceremony as a release. There is no third outcome.

On release, the fee event posts: each patient whose records were used by this IRB-approved study is credited her participation fee, triggered by the identical event the audit spine just recorded. And at every step along this path — authentication, consent resolution, cohort build, gate decision, release or refusal, fee — the spine has been writing. A single request leaves a connected trail from the researcher's question to the patient's compensation, and the trail is the proof that the path was the only one taken.

What should strike you about this sequence is what is absent from it: no step where a human waves something through, no bulk path that skips the gate because the requester is trusted, no asynchronous export that settles consent later. The layers are not policies that the request is asked to respect. They are the only road.

§ 04Worldwide by design

Where the patient lives decides which law governs the data, so residency — not convenience — drives the lawful basis for every research use on the platform. Rather than build to one regime and retrofit the rest, the consent machinery was designed against the strictest requirements of each at once.

The convergence in the right-hand column is not an accident. GDPR's Article 9 begins by prohibiting the processing of health data and then enumerates exceptions; explicit consent under 9(2)(a) is the exception that travels cleanly across borders, because a specific, informed, revocable yes is recognizable everywhere. HIPAA's research authorization is per-study and specific by statute. Washington's act demands consent beyond HIPAA for consumer health data. The two-document consent of section 2 was drafted to satisfy all of these simultaneously, so a patient's yes is valid wherever it was given — and a patient's no requires no jurisdiction at all.

Movement of data is the other half of worldwide design, and the answer is that data does not move. Federated queries execute in the region where the records reside and return aggregates only — counts, distributions, summaries — with each response passing the same consent checks and the same k ≥ 5 gate before anything leaves the region. Queries travel; records don't. Cross-border collaboration becomes a flow of questions and aggregate answers rather than a transfer of patient-level data — the one kind of flow that post-Schrems-II transfer law treats most gently, and the direction the EHDS era of secondary use is converging toward anyway.

The EHDS deserves one more paragraph, because it is the regime the others are drifting toward. Regulation (EU) 2025/327 establishes a framework for the secondary use of health data under governed access bodies — researchers receive answers and environments, not copies to keep. That is structurally the bet this platform already made: govern the access, never transfer the asset. Being EHDS-ready as those rules phase in is not a compliance retrofit for us; it is the architecture described in section 3, wearing a European name. GDPR Article 9(2)(j) and Article 89 sketch the same picture from the research side — scientific-research processing is permitted exactly to the degree it is wrapped in safeguards and minimization. The platform's wager, everywhere, is that the strictest reading of each regime describes the same machine.

§ 04aData lifecycle: from first connection to the six-year witness

A record's life on the platform has a defined shape, and the shape is worth walking because retention is where many privacy stories quietly fall apart.

It begins with connection. The platform is designed for 47 source connectors — EHR portals speaking FHIR R4 and SMART on FHIR, lab-result feeds, wearable APIs, registry exports, national nodes — each delivering its fragment of the scattered history of section 1, normalized into the pinned FHIR R4 / US Core profiles with provenance preserved: which connector, when, from what kind of source. Provenance is not metadata vanity; when a researcher asks whether a lab value came from a clinical feed or a consumer device, the answer changes what the value can support.

While the patient participates, the lifecycle is the consent machinery of section 2a: records are queryable exactly insofar as live grants make them so, and every use posts its fee and writes its entry. A record with no grants is connected, current, and untouchable.

Departure is where precision matters most, because two different acts are commonly blurred. Revocation — of one grant or all of them — stops future research use and is honored at the next query, but the records themselves remain on the platform, still the patient's, available the day she chooses to participate again. Deletion is the stronger act: the patient takes her records off the platform. The clinical content goes. What remains is the audit spine — the history of events, not the medical substance they touched — because the six-year minimum retention exists precisely so that the question "what happened while the records were here?" survives the records' departure. A platform that deleted its audit trail on request would be offering every future bad actor a self-service eraser. So the covenant is asymmetric in the patient's favor: the data is hers and can leave; the witness's testimony about who accessed it, under which grant, is permanent for the retention window, and it protects her.

Six years is a floor, not a flourish, and the spine is built to hold its chain integrity for the entire window. The honest summary of the lifecycle: records come in with provenance, exist behind consent, leave on demand; the history of access outlives everything, on purpose.

§ 05What we never do

Some commitments are short enough to be tested. Here are ours.

• We never buy or sell patient data. Not as principal, not as broker, not "de-identified."
• We never release a cohort below k = 5. The gate refuses — for everyone, for every study.
• We never assume consent. No grant, no access; there is no default yes anywhere in the system.
• We never edit the log. The audit trail is append-only; mistakes are corrected by new entries, never by erasure.
• We never let AI decide a release. Models suggest; deterministic engines decide.
• We never post a fee without an IRB-approved research-use event. Fees are for participation, never payment for data.

Each line is enforced by the architecture of section 3, not by a handbook. That is the difference between a value and an invariant.

§ 05aThe threat model: what the system refuses by construction

A list of values is tested by imagining the people who would like to violate them. So here is the platform's threat model, stated as adversaries — including the ones a privacy paper is supposed to be too polite to mention.

The buyer. Someone arrives with money and asks for the dataset — perhaps politely, perhaps "de-identified," perhaps wrapped in a partnership. The refusal is structural, not contractual: there is no bulk-export endpoint, no price-per-record field in any schema, no de-identified product to sell. The request fails not because a policy says no but because the system has no verb for it. A platform that merely promises not to sell still owns the machinery of sale; this one is designed not to have it.

The re-identifier. An adversary with auxiliary data tries to unmask individuals from released aggregates. The k ≥ 5 floor is the first defense, aggregate-only federated returns the second, conservative quasi-identifier handling the third — and the audit spine is the unusual fourth: because every release is logged with its scope and cohort arithmetic, cumulative disclosure across releases is inspectable after the fact, which most release pipelines cannot say. Section 7 is blunt about the limits of k-anonymity; the design response is layers plus a permanent record of every release ever made.

The insider. The classic failure of health-data systems is not the hacker but the curious employee. Here the gateway's consent check binds every access — administrative roles included — to an authorizing grant, there is no override flag for the k-gate to abuse, and every query any principal runs is an audit entry the patient can see. The honest claim is not that insiders cannot misbehave; it is that the system is built so misbehavior requires defeating cryptographic chaining rather than exploiting discretion, and leaves a trail either way.

The consent-free researcher. A study that wants to skip the asking — broad waiver, "implied" consent, enrollment by default — finds no surface to use. Records without live grants are outside the queryable universe (section 3b); there is no default yes to inherit. The platform cannot host waiver-based research, and that is a feature with a cost we accept: some legitimate study designs simply do not fit here, and their authors should use institutions built for them.

Our own future selves. The least comfortable adversary. Companies change management, take investment, get acquired; promises survive these events only if they are expensive to break. That is why the refusals above live in architecture rather than policy: an acquirer inherits a system with no sale verb, a log that cannot be quietly edited, six years of immutable history, and public documents like this one stating the terms. Re-engineering all of that is possible — we will not pretend otherwise — but it cannot be done silently, and loudness is the real deterrent.

Every refusal in this section shares one property: it is logged. The system's noes are part of its history, with the same permanence as its yeses, because a refusal that vanishes is a negotiation, and a refusal that is witnessed is a precedent.

§ 06Proving ground: interstitial cystitis / bladder pain syndrome

The flagship cohort is interstitial cystitis / bladder pain syndrome (IC/BPS), built with a patient community that has been organizing for roughly thirty years. It was chosen because it is hard.

IC/BPS is, in research terms, close to a worst case. The diagnosis is often reached by exclusion, without a definitive biomarker, so phenotype logic must be versioned and testable rather than a single code lookup. Presentations are heterogeneous, so cohort definitions earn their keep or fail visibly. Patients are scattered across urology, gynecology, pain management, and primary care — fragmentation at full strength. And the condition has spent decades underfunded relative to the suffering it causes, which has kept trial cohorts small and tested the community's patience longer than most.

A platform that works for IC/BPS has therefore exercised every component under load. The phenotype engine against diagnostic ambiguity. The consent engine with a community that has every reason to demand real terms before trusting another institution. The k ≥ 5 gate where cohorts are genuinely small and refusals genuinely occur. The participation-fee mechanics with people whose decades of symptom diaries are exactly the longitudinal record no laboratory can recreate. Communities like this one have moved research before when institutions could not; what they have lacked is infrastructure that treats their documentation as the contribution it is.

The deliberate choice of a hard first condition is also a claim about the architecture: nothing changes for condition two, or condition twenty-eight. The platform launches with 28 conditions across 12 categories, and every one runs on the same spine — same consent engine, same gate, same audit trail, same fee mechanics. Disease-specific knowledge lives in phenotype definitions and study designs, not in the guarantees. If the guarantees hold for the hardest first condition, extending them to the next twenty-seven is configuration, not construction.

§ 07Limitations and honest open questions

A whitepaper that lists no limits is marketing. These are ours.

The platform is pre-launch. What exists today is a working system demonstrated on synthetic records: the full pipeline runs, from consent through query through gated release through audit, but no real patient data has yet flowed through it. Synthetic data is the right way to build and demonstrate machinery like this — and it proves nothing about the claims that can only be earned in production: that revocation behaves at scale, that fee mechanics stay clean under volume, that the audit spine holds under adversarial scrutiny. Those proofs are ahead of us, not behind us.

k-anonymity has known failure modes, and we do not pretend otherwise. It defends against linkage through quasi-identifiers; it does not by itself defeat homogeneity (five people who share the same sensitive value), background knowledge an attacker brings from outside the model, or composition across multiple releases that are each safe alone. The platform's answer is layered: the k-gate sits alongside per-study consent, aggregate-only federated returns, conservative treatment of quasi-identifiers, and an audit trail that makes cumulative disclosure inspectable. Layers are the honest response. They are not a proof of impossibility, and we will not present them as one.

The k-gate also has a cost we feel more sharply than most, and it would be evasive not to name it: suppression bites hardest exactly where this platform aims to matter. Rare-disease cohorts, unusual phenotype combinations, finely stratified subgroups — the questions that matter most to small communities are the ones most likely to come back as refusals, because the cohorts are genuinely small. A configurable floor would dissolve the guarantee; a fixed floor taxes the rarest patients' questions. Our mitigations are honest but partial — broader time windows, coarser strata, federated aggregation across regions to lift counts — and the trade-off does not vanish. We chose the floor knowing whom it costs.

Consent fatigue is a real failure mode of per-study consent, and we run toward it with eyes open. The model's integrity depends on each yes being considered; a patient facing her fortieth two-document request may start saying yes — or no — reflexively, and either reflex corrodes the meaning the model depends on. The two-document format, scoped and expiring grants, and request pacing are design responses, not solutions. Whether per-study consent stays meaningful at volume is an open empirical question, and we will be among the first to generate the evidence, whichever way it cuts.

Participation fees can bend cohorts. If fees matter more to some patients than others, the consented population may skew along economic lines — a selection bias introduced by the very mechanism meant to correct an injustice. IRB review of fee structures, fair-market calibration, and transparent cohort demographics are the design answers, and none of them is a proof. A fee-shaped cohort is a scientific defect as well as an ethical one, and pretending otherwise would eventually cost both.

Re-identification research is an arms race in which the attacker's side compounds. The history of unmasked datasets is largely a history of defenders underestimating the auxiliary data that would exist a few years after release. Our defenses assume auxiliary data grows, and the architecture is built to tighten — coarser categories, stricter handling of sensitive releases — without weakening its guarantees. We will not claim that any release is unbreakable forever; we claim that every release passes a hard floor, leaves a permanent record, and can be reasoned about afterward.

The regulatory ground shifts under everyone's feet. The EHDS phases in secondary-use rules over the coming years; US states are legislating health privacy one statute at a time; the UK's post-Brexit regime continues to evolve on its own clock. Designing to the strictest regime at once is our hedge. It is a hedge, not a prophecy.

And some questions remain genuinely open. What fee levels compensate fairly without becoming undue inducement — a line we expect IRBs to keep us honest about, study by study. How revocation should interact with aggregates already published from a cohort that included you — our position is that revocation stops all future use but cannot unpublish mathematics, and the consent documents say so in plain language. Whether patient-mediated access can reach the scale that institution-mediated sharing achieves by not asking. We believe the answers favor this model. We have not yet proven it, and this section exists so that no reader mistakes conviction for evidence.

§ 08The covenant

The company is named for Mithra, the oldest recorded guardian of covenants — the witness invoked when two parties needed their promises to outlast their moods, who crested the mountains ahead of the dawn so that no oath would be broken in the dark. The name is a claim about the model, and this paper has tried to state the terms with the specificity a covenant requires: your records remain yours; every study asks, plainly, one decision at a time; your no needs no justification and your revocation works as fast as your yes; nothing leaves below k = 5; every event is written where it cannot be unwritten; you are paid when approved research uses what you contributed; and your data is never bought or sold.

The witness, in our case, is not a god. It is apparatus — the consent engine, the gate, the append-only trail — built before launch, because the witness must arrive before the dawn does. Communities that have waited thirty years for research attention are entitled to judge us by terms kept, not papers published. This document is the terms, written down so that we can be held to them.

§ 08aHow to cite this paper

This whitepaper is versioned like the software it describes: section anchors are stable across versions, corrections arrive as new versions rather than silent edits, and the change history below is part of the document. The canonical copy lives at mithrashealth.com/whitepaper/.

Questions, corrections, and disagreements are welcome at [email protected] — disagreements especially, for the reasons section 7 exists.