How HCC works
A researcher pays. The data stays. The wallet earns.
Six steps from contract to settlement, with one cohort, one query, and one rule the chain enforces every time: data does not move. Receipts do. The mechanism described below is implemented end-to-end and tested. Phase 2 begins when the first researcher contract is signed.
- 01
Researcher applies for cohort access.
A credentialed researcher submits a query class to Datavault — for example, "outcomes 12 months post-cardiac-rehab, ages 50–75, U.S." Application includes institution, IRB approval ID, and the question being answered. Datavault scopes the eligible cohort: opted-in wallets whose consent classes match.
- 02
Contract is priced and pinned to chain.
Pricing is a function of cohort size, data density, recency, and exclusivity. The researcher signs; Datavault counter-signs; the contract hash lands on chain with the price denominated in HCR. The full text is public; researcher identity is public; patient identities are not.
- 03
Query runs in a sealed enclave.
The query executes inside a Datavault enclave with no outbound network. The researcher submits SQL or a notebook; the enclave returns aggregated results. Raw records do not leave. Cohorts with effective n < 200 are rejected. Differential-privacy noise is applied to small-cell statistics. The enclave logs every column touched.
- 04
Researcher pays in HCR.
Payment settles on the same chain. The researcher's wallet debits HCR; a settlement record posts. If they hold USD instead, hc.exchange handles the on-ramp first.
- 05
HCC mints to participating wallets.
The chain mints HCC equal to the HCR paid (1:1 by face value at contract time, not by market price), distributed across the participating wallets weighted by per-patient data density and recency. Median patient receives a small fraction; the highest-density wallet may receive several units. The mint event is a single chain transaction with the cohort hash, the contract hash, and the per-wallet split.
- 06
Patient sees it in their Orb.
Within one block (5 seconds), the patient's Guardian Orb wallet shows the new HCC, the contract that triggered it, the cohort it was part of, and the IRB approval. They can hold, convert on hc.exchange, or — at any time — narrow consent for future contracts.
What never happens.
- Data never leaves the enclave. Researchers do not download records.
- Identities are never disclosed on chain. Wallets are pseudonymous addresses.
- HCC is never minted to Corp, Council, or any party other than contributing patients.
- Consent class changes are never overridden by historical contracts. Past mints stay; future routing updates.
- HCC is never pegged. We do not subsidize price; we do not buy back; we do not promise stability.