Consent & ethics
Participants are collaborators, not subjects.
The participant population that powers your study chose to be there. They can change their mind tomorrow. They can ask the IREB to investigate your work. Build studies that earn that trust — the framework here is how we hold you to it.
"No data without dignity. No research without recompense. No question without the right to refuse the answer."
— CH Research Ethics Doctrine, founding charter
The framework
Four pillars we won't move on.
These are not legal floors — these are the higher standard we hold ourselves to. Some of these are stricter than HIPAA, the Common Rule, or 42 CFR Part 2. That's intentional.
Granular, layered consent
Participants don't sign a single "research consent." They consent to specific data classes (vitals, labs, genetic, BH, SUD, repro), specific research scopes (any approved IREB study, named protocols only, never industry-funded, etc.), and specific purposes (population health, drug development, public-health surveillance, exploratory).
They can revise any of those choices at any time. The next ETL window honors the change. No phone calls, no forms.
Never · Bundled "all-research" consent.Real-time withdrawal
If a participant withdraws today, your enclave queries no longer return their rows starting tomorrow. Outputs already in your possession are yours to keep (publishing requirement); but no new analysis can include them. Active studies receive automatic notification.
Withdrawal is one tap from their patient app. We do not require justification. We do not surface a "are you sure" wall designed to wear them down.
Never · Coercive retention designs.Recompense, not gratitude
Participants earn HEALTHCARE-Coin (HCC) for contributing data to research. About 70% of every research access fee routes back to the queried cohort proportional to records contributed. They see it in their wallet within 24 hours of your study run.
This is the difference between participant and donor. The labor is real, the compensation is real, and we built rails to make it inseparable from the rest of the system.
Never · "Gift" framing for contributed data.The right to question your work
Every participant whose data appears in your study sees a plain-language study card in their app: who you are, what you're asking, what they earned. They can flag concerns directly to the Independent Research Ethics Board. The IREB can pause your study within 24 hours pending review.
If your work proceeds despite credible concerns from participants, the participants get notice and the right to withdraw without losing past earnings.
Never · Black-box research over consenting bodies.What participants choose
Four research consent tiers.
When a participant signs up, they pick one of these four tiers. They can change tier at any time. The tier they're in when an ETL window runs determines whether their data is in your cohort.
No research
- Excluded from all cohorts
- Excluded from public-health surveillance
- Excluded from internal analytics that involve their identifiable data
- Earns no HCC (clinical HCR only)
Public health only
- Outbreak surveillance
- CDC / WHO reporting
- Academic population-health studies
- No pharma, no payer, no commercial researchers
- Earns HCC at 1.0× rate
Approved research
- Academic + non-profit + commercial
- Subject to per-study IREB approval
- Sensitive classes excluded by default
- Earns HCC at 1.0× rate
Full participation
- All Tier-2 + opt-in sensitive classes
- Per-class consent (BH, SUD, genetic, repro)
- Higher contribution weight in study runs
- Earns HCC at 1.4× rate (sensitive multiplier)
Default tier on signup is Tier 2. Anyone under 18 enters at Tier 1 and cannot move higher until 18 + their own affirmative action.
Sensitive data classes
Six classes need their own opt-in.
Beyond the four-tier framework, certain data classes require their own affirmative consent because federal or state law requires it, or because we treat them as more sensitive than the law alone requires.
| Class | Default | Required to surface in research |
|---|---|---|
| Behavioral health (BH) HIPAA § 164.508(a)(2) · psychotherapy notes | Suppressed | Tier-3 participant + per-class opt-in + Tier-2+ IREB review with patient-advocate seat. Psychotherapy notes (separate from chart) require explicit second authorization and are never queryable; they remain isolated. |
| Substance-use disorder (SUD) 42 CFR Part 2 · re-disclosure prohibited | Suppressed | Tier-3 participant + 42 CFR Part 2-compliant redisclosure consent (specific, written, per-disclosure). Outputs carry the federal redisclosure-prohibited stamp. SUD-treatment Rx, encounters, and conditions remain suppressed even in Tier-3 unless this consent is current. |
| HIV / STI State-by-state · most require enhanced | Suppressed | Tier-3 + per-class opt-in. We follow the strictest applicable state law for the participant's residence. Outputs cannot be linked back to identifiable participants in the enclave. |
| Reproductive health CH ethics policy + applicable state law | Suppressed | Tier-3 + per-class opt-in. Includes pregnancy outcomes, contraception, fertility care, abortion-related care. We do not surface these to studies funded by entities that have used reproductive-health data for adverse legal action against participants. |
| Genetic / genomic GINA · state genetic-privacy statutes | Suppressed | Tier-3 + per-class opt-in + GINA-compliant DUA + family-impact disclosure (genetic data implicates relatives, who must be informed). |
| Pediatric (under 18) Common Rule Subpart D · 45 CFR § 46.401–409 | Tier-1 cap | Pediatric participants are auto-capped at Tier 1. Higher tiers for pediatric data require: parent/guardian consent + child assent (≥7 years old) + Tier-2+ IREB with patient-advocate seat + minimal-risk determination. |
Participant rights · always-on
Eight rights the participant has, by default.
A participant doesn't request these — they're built into the patient app. Researchers don't get to opt out of them, and they are visible to participants whether or not your study includes them.
The right to see who's looking
Every approved study that included their data appears in their Research feed: PI, institution, study title, plain-language summary, what they earned.
The right to withdraw, prospectively
One tap removes them from future cohort runs in 24 hours. Past participation is immutable for publishing integrity, but they can sever forward exposure instantly.
The right to reduce class
Participants can drop a sensitive class without dropping all of research. e.g. revoke BH but keep cardio.
The right to flag concerns
"Something about this study concerns me" goes directly to the IREB and pauses the study within 24 hours pending review.
The right to results
Plain-language results summary published within 12 months of study completion, surfaced in their Research feed. We require this in every DUA.
The right to refuse-by-class
Can refuse data going to specific funder types (pharma, payer, defense, etc.) without refusing all research.
The right to a paper trail
Every consent change, every study they're in, every HCC earnings record — chain-pinned, exportable, auditable.
The right to be paid
HCC owed for participation cannot be reversed, clawed back, or redirected. Earned-and-paid is final.
When a participant withdraws
What actually happens within 24 hours.
The mechanics matter. Here's what we run when a participant taps "withdraw" — explained for researchers planning their analytic windows.
Consent state flips immediately
The ch_consent table is updated. ch_consent_event log records the withdrawal with chain-pinned event hash. The participant gets confirmation in-app.
Next ETL excludes them
The next nightly ETL run omits their rows from research enclave datasets. Active studies receive automatic notification listing affected analytic plans (anonymized — no participant identity).
Daily ETL windowCohort pool is reconciled
The participant's contribution stays as a permanent ledger entry with HCC already paid. Their forward exposure ends. The study run continues with the reduced cohort; if statistical power is lost below thresholds the analytic plan declared, the IREB is alerted.
≤ 24 hr from tapWhat can be queried, by tier
Concrete examples of who sees what.
Footnote: SSRI prescriptions are visible at Tier 2+ because they are also frequently prescribed for non-BH indications (chronic pain, fibromyalgia, etc.). The IREB requires you to disclose in your protocol whether BH inference is the analytic intent.
Who watches the watchers
Two independent bodies, separately funded.
The IREB and the Patient Advocacy Council are the only two bodies that can pause your study. Both report to the CH Board, not to product, sales, or research operations. Their funding is on a separate budget line; they cannot be defunded mid-cycle without board action.
Independent Research Ethics Board (IREB)
Internal IRB equivalent. Reviews every study before access, monitors active studies, hears participant complaints, can pause or terminate with 24-hour notice. Charter sIRB-eligible — many institutions can rely on us under sIRB rules.
Patient Advocacy Council (PAC)
Council of CH participants who have opted into governance. Reviews patterns of complaints, audits the IREB's responsiveness, raises systemic concerns. Has standing to compel IREB review. Members are randomly drawn from a pool of consented participants.
A real audit trail
Every consent action is chain-pinned.
One participant · 30-day excerpt
This is what the participant's consent ledger looks like — the same view they have, audit-grade and exportable. Every event is signed, hashed, and pinned to the CH Chain.
What we expect from you
Researcher conduct rules.
These are commitments you make in the DUA. Violation is grounds for study termination, IREB disbarment for the institution, and — in egregious cases — referral to your home institution's research integrity office.
You will
- Submit a plain-language summary surfaced in participants' Research feed
- Respect output-review k-anonymity floors without contesting
- Honor cohort-pool size changes from withdrawals (re-power if needed)
- Publish results in the participant feed within 12 months of completion
- Cite the dataset DOI and ME computation version in all outputs
- Disclose funding sources in your DUA (we use this for funder-restriction routing)
- Report adverse events that emerge from your analysis to the IREB within 72 hours
- Allow IREB observation of analytic-plan execution if requested
You will not
- Attempt re-identification of participants by any means
- Cross-link CH data to external identifying datasets
- Share enclave outputs with collaborators not listed in the DUA
- Use results for individual-level decisions about participants (insurance, employment, lending)
- Pursue publishing strategies that obscure the participants' role or refuse to cite the dataset
- Frame findings to support legal action against participants based on health data
- Resist withdrawal-driven re-runs of analytic plans
- Approach participants directly for recruitment without IREB-approved protocol
If this framework feels right
Apply for access. Build with people, not on them.
If anything on this page feels too restrictive for the work you have in mind, we may not be a fit — and that's okay. The participants made these rules; we honor them.