Editorial · Data handling
In short. We work with data under the governance of whoever holds it. Identifiable data stay with the data holder. We write the analysis plan before we run it, keep every step traceable, release only safe aggregate outputs, and credit people fairly. Where a piece of work needs expertise we don’t have, we say so and bring it in.
Purpose of this page. This page sets out how Eden Openly handles data, both published data and any partner’s data we are asked to work with. It is a commitment: if our practice ever differs from what is written here, the difference is an error and we want to hear about it.
1. Our commitments
Governance comes first
We work only within the approvals and agreements that apply to the data: ethics or institutional review board approval where it is needed, the data protection law of the place where the data are held (for example, the UK GDPR, Korea’s Personal Information Protection Act or Japan’s Act on the Protection of Personal Information), and a written data-use agreement. The organisation that holds the data remains its data controller. We do not begin work until the paperwork is in place.
The data stay with you
Our default is that identifiable records do not leave the data holder’s environment. Where possible we work inside the partner’s secure system, or receive only de-identified or aggregate extracts. We do not keep copies beyond the term of the agreement.
De-identification before analysis
Direct identifiers are removed by the data holder before we see anything. We minimise indirect identifiers (exact dates, rare combinations of characteristics, small areas) to what the question actually needs.
A plan before the analysis
We write down the question, the definitions, the outcomes and the planned analysis before running it, and register or deposit that plan where appropriate. Changes after the data are seen are recorded and explained, not hidden.
Every step traceable
Sources are registered with a fingerprint (SHA-256) of the copy used. Extraction and calculation are done by script where possible, so that each published figure can be traced back to its source and recomputed. Verification checks and their results are recorded.
Safe outputs
We publish aggregate results only, and apply disclosure control: small counts are suppressed or banded, and no individual is named or described. Outputs are checked by the data holder before release where the agreement requires it.
Fair credit
Authorship follows the ICMJE criteria. People who do the work are named; people who do not are not. We do not do ghost-written analysis.
Independence
Working with a partner’s data does not give the partner control over our findings. Partners may correct factual errors before publication; they may not change conclusions. Any affiliation or collaboration that could be seen as a conflict is declared on the work it affects and on our declared interests page. See also Independence.
2. In practice
Our published work shows these commitments applied. One worked example is Evidence Note EN-025, Five numbers, five ways of counting, and its data processing record.
| Commitment | What EN-025 shows |
|---|---|
| Every step traceable | 13 source documents registered with SHA-256 fingerprints in a public companion repository |
| Recomputable figures | Every calculation listed and recomputed by script |
| Recorded verification | 15 recorded verification checks; the final script ran 68 checks (59 claims, 9 calculations), all passed, with a self-test that caught deliberately corrupted inputs |
| Safe outputs | Only counts already published by their sources, at the level published; no person who died named or described |
| Open deposit | Note and record deposited with a DOI (10.5281/zenodo.23327488), with the output’s SHA-256 recorded |
Our appraisal of clinical guidelines follows the same approach, with its protocol registered in advance on OSF (10.17605/OSF.IO/SY4GP).
3. What we do and don’t do
To date, our work has used published and aggregate data. We have not yet held individual-level records from a partner; when we do, the commitments above apply in full, and this page will be updated to say so.
Our strengths are careful definition, source verification, transparent descriptive analysis and clear reporting. For complex statistical modelling we work with a qualified biostatistician, and say so on the work.
We use AI tools in parts of this work, including verification passes. AI-assisted checks are not presented as independent human verification. See how we use AI.
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 13 October 2026 | First version, with machine translations into Korean, Japanese, Traditional Chinese and Thai. |