Consent
Granular, per study, can be withdrawn. Never retrofitted broad consent.
Ethics & governance
Independent research. The citizen owns the data.
Three principles stand above all else: the citizen owns the data, consent is protocol, the research is independent of who pays.
Three principles
Three principles above all else
Ownership
The citizen owns the data. Value can flow back via Wallet.
Independence
Study protocols are registered. Findings cannot be suppressed.
Consent-first architecture
Every data point in People's Research is opt-in at the source via People's Doctor or People's Wallet. We do not retrofit consent on data already collected. Citizens can at any time see what they have consented to, which studies their data is part of, and withdraw consent with audit trail.
What happens if a participant withdraws?
The participant opens their People's Wallet and withdraws consent. The study's dataset updates the same day - the data in question is removed from future analysis, and the researcher sees status in the study overview. Already published aggregates are not affected, but no new analyses can access the withdrawn data. The citizen receives confirmation in Wallet.
- 01The participant opens People's Wallet
- 02Withdraws consent with one tap
- 03The dataset updates the same day - the researcher sees status
Citizen ownership + value back
The citizen owns the data - not People's Group, not pharma, not the university. When data contributes to a study, value can flow back to the citizen via People's Wallet (launches 2026). The mechanism is in development and documented openly - no overstatements.
Regulatory timeline
GDPR, EHDS and EU AI Act
We operate under GDPR Article 9(2)(j) lawful basis (scientific research) with explicit consent as baseline. Aligned with the European Health Data Space secondary-use framework and HDAB-mediated data permissions. Designed for EU AI Act high-risk AI obligations - audit trail, transparency, human oversight from the start. We say "aligned" and not "compliant" where the regimes are not yet fully in force (EHDS secondary-use phases in to 2029, AI Act high-risk obligations 2027).
- 2018 GDPR in force
- 2025 EU AI Act first phases
- 2026 New EU rules for health data - we are ready
- 2027 EU AI Act high-risk obligations
- 2029 EHDS secondary-use full
Can pharma block unwanted results?
No. Study protocols are registered before data access. Results are reported regardless of sponsor outcome. University collaborations retain full publication freedom. If a sponsor tries to pull out late or block publication, the study proceeds - we have built it that way on purpose. The policy document is sent at the first meeting.
Research independence policy
Pharma-sponsored studies on the platform cannot suppress unfavourable findings. Study protocols are registered before data access. Results are reported regardless of sponsor outcome. University collaborations retain full publication freedom. Policy document available on request.
Access control + audit trail
Access is gated behind a data-access committee. We can always show who has seen what - and when. The citizen can see which questions have been asked of their data and by whom. No raw data leaves the platform - the analysis comes to the data, not the other way around.
Where data sits
Data does not leave the EU
US hyperscaler · blocked
EU-hosted
Frankfurt region · GEFION-aligned
CN cloud · blocked
Study datasets remain in EU legal territory via People's Lab in the Frankfurt region. That means no CLOUD Act exposure, no transfer outside the EU/EEA, and that the citizen's consent follows the same jurisdiction as the data. Who has seen what is documented and visible to the citizen.
DataFrankfurt region
Accessdata-access committee
Methodanalysis comes to the data
Ethics and responsibility
Questions for our governance?
Send us your legal or ethical questions - we have policy documents ready.
Contact the research team