Governance
Governance is the product
Real-world evidence is only as useful as the trust behind it. This page describes, in plain terms, what happens to a patient’s data before anyone outside the group can ask a question of it.
De-identification
How records are de-identified
Pseudonymisation happens inside the country of origin, today Argentina, before data reach the platform. Each measure below is applied to every record.
- 01
Hashed and salted tokens
Direct identifiers are replaced by a one-way hash with a secret salt. The salt is held separately from the data and is never shared with clients.
- 02
Shifted dates
All dates for a person are moved by a consistent random offset. Intervals between events are exact; calendar dates are not.
- 03
Grouped age
Age is held in bands. Ages above a threshold are collapsed into a single group.
- 04
Reduced geography
Location is kept at province or region level. No addresses, postal codes or facility-level identifiers beyond what the analysis requires.
- 05
Free text removed
Narrative fields are excluded or replaced by coded concepts. Clinical notes do not enter the platform.
- 06
Small-cell suppression
Any output cell below the minimum count is suppressed or rounded before release.
Residency
Data stay in their country of origin
Hosting
Identified and pseudonymised data are hosted in the country where they were generated. The first source is hosted in Argentina and processed under Law 25.326 on the Protection of Personal Data. Each new market follows its own data-protection law.
No identified transfer
Identified data are never transferred outside their country of origin, to clients or to any third party.
Query, not download
Clients work through the Clean Room, the federated node or the Feasibility API. There is no row-level export in any mode.
Oversight
Who reviews each project
Every protocol is reviewed before access is granted, and access is scoped to the protocol.
- Scientific and ethics committee
- Reviews each protocol for scientific merit, proportionality of the data requested and compliance.
- Data access agreement
- Defines the purpose, the permitted analyses, the output rules and the prohibition of re-identification attempts.
- Data protection officer
- Designated by the company. Point of contact for data subjects and regulators.
Audit
Every query is logged
- 01
Query log
All queries and analysis packages are recorded with user, time and protocol reference, and retained for audit.
- 02
Output review
Results pass an automated disclosure check and a human review before they leave the environment.
- 03
Access revocation
Access ends with the protocol. Breaches of the agreement terminate access immediately.
- 04
Documentation
Each release ships with a description of the cohort logic, the vocabularies used and the transformations applied.
Limits
What we do not do
- We do not sell or transfer individual rows.
- We do not re-identify, and we contractually prohibit any attempt to.
- We do not move identified data outside their country of origin.
- We do not provide data for marketing to individual patients or physicians.
- We do not provide free-text clinical notes or imaging pixel data.
- We do not grant access without a reviewed protocol and a signed agreement.
Legal basis
Legal basis and consent
The processing described here is conducted, for the Argentine source, under Law 25.326 and its regulations; each additional country is governed by its own data-protection law. The specific legal basis for each project, including the treatment of de-identified data and any consent or notification obligations, is documented in the protocol.