Written to be forwarded.

Identity

Names and contact details belong in a separate identity vault with its own keys. Participants appear in the research store only under a code — it has no participant name, email or date-of-birth column.

Data is encrypted in transit and at rest, with identifying data under its own keys.

Audit

Every state change writes an audit event to an append-only, hash-chained ledger, in the same transaction as the change itself.

Append-only by construction: the database role that writes the ledger cannot update or delete.

The protocol your committee approved is, provably, the protocol your participants got.

AI

AI drafts. A qualified person reviews, edits and signs — nothing written by AI becomes part of a study without a named human signature.

Every AI draft is stored with the model that produced it, and stays labelled as AI-suggested until a person accepts it.

No AI reads, scores or sorts what a participant reports about their health. That path has no AI in it at all.

An AI model never computes a number: where the platform calculates, versioned deterministic libraries do the arithmetic.

Where things run

Runs on UK-based infrastructure: the deployment region is AWS London.

AI inference runs through EU-resident endpoints — never a global route.

Locks and consent

Locked protocols, signed consents and locked datasets never silently reopen. Unlocking is scoped, dual-authorised and attributed.

Consent is a signing ceremony, not a checkbox: the participant signs, the study team countersigns, and every version is kept.

Before any participant

Starting a study starts the paperwork, not the research: recruitment stays closed until the study’s approvals and its named safety contact are signed into the record.