Observational data infrastructure.

Mechanistic reasoning about chronic illness is currently done one case at a time. Written case work is rich but unstructured: it cannot be counted, compared, or contradicted at scale. Structured data — the same variables, defined the same way, recorded with their provenance — is what makes a framework falsifiable rather than merely persuasive.

The failure mode is equally clear. Poorly governed self-selected data produces confident numbers that mean nothing, and health data collected loosely becomes a privacy liability. The point of building the governance before the data is that the rules cannot then be bent to suit a result.

What exists is infrastructure: a data-zone architecture, a versioned codebook of 35 candidate variables across 21 domains, a provenance and missingness model, a dedicated consent object, inclusion criteria, quality control, aggregation privacy rules, and an audit model.

What does not exist: any collected structured dataset, any cohort, any participants, any enrollment route, any results, and any published aggregate. Nothing on this page should be read as a claim that data has been gathered or analysed.

Every piece of data BiomeLogic holds sits in exactly one zone. Movement between zones is gated in code, and every gate defaults to refusal.

Research consent is a standalone act. It is never inferred from anything else, and the following consent types can never be converted into it:

• service_terms
• gate1_submission
• long_intake_submission
• publication_consent_phase9
• pattern_mapper_atlas_consent
• correspondence_consent
• email_subscription
• payment
• account_creation

Scopes a dedicated consent could carry, each selected separately:

• Private structured analysis only — nothing derived from this record is published
• Aggregate publication — counts and distributions only, subject to the minimum-count privacy threshold
• De-identified narrative publication — additionally governed by the Phase 9 publication registry, which can veto but never authorise on its own
• May be contacted again about future structured data collection

Information given in order to receive a service stays with that service. It is not a research resource, and it will not be turned into one retroactively.

Each variable carries a stable id, allowed values, permitted provenance classes, a sensitivity class, whether it may ever appear in a public aggregate, and whether exact values must be binned. Free text is prohibited in every structured variable.

Variable names encode provenance: reported_* is a self-reported pattern, recorded_* is transcribed from a source report, clinician_* requires clinician documentation. A reported pattern is never a diagnosis, and no marker listed is presented as a validated biomarker.

Every datum declares where it came from:

• Self-reported (structured field)
• Clinician-documented
• Transcribed from a lab report
• Device / wearable export
• Public dataset
• Owner-coded from a consented source
• Derived variable

Self-report is never merged with clinician-documented fact. Results from different test platforms are never pooled without an explicit harmonisation rule. Derived variables record their rule version and source variables.

Absence always carries a reason code:

• not_asked — Not asked (instrument did not contain this variable)
• not_available — Asked, but the source could not supply it
• not_applicable — Structurally not applicable to this record
• declined — Explicitly declined by the person
• unknown — Unknown / uncertain
• below_detection — Below the assay's limit of detection
• not_measured — Measurement not performed
• lost_to_followup — Longitudinal timepoint not obtained

Unknown is never stored as zero or false. Missing is never read as normal. No imputation is applied by default. Any future imputation must be declared in an analysis plan, versioned, and reported alongside a complete-case sensitivity analysis.

A research record holds structured metadata and coded values only. Names, emails, phone numbers, dates of birth, exact dates, street or city level location, clinician names, institution names, uploaded files, and free text are excluded by design rather than removed later. Where an identity link ever exists, it is stored separately from the research metadata.

No aggregate cell renders publicly below 10 records, rising to 20 for high-sensitivity variables and higher still where the codebook demands it. If suppressing one cell would let it be recovered by subtraction, a second cell is suppressed too. Raw rows are never exported publicly, exact dates and narrow geography are never aggregated, and free text is never aggregated at all.

Any dataset collected this way would be a non-random, self-selected sample of people who found a website about chronic illness. Even a large one could describe associations and nothing more.

• No treatment effects, response rates, remission rates, or efficacy.
• No safety conclusions.
• No causal direction between any two variables.
• No prevalence estimate for any population.
• No claim that a pattern generalises beyond the people who supplied it.

These are questions and predictions, not findings. None has been answered with BiomeLogic data, because no such data exists.

Withdrawal removes a record from all future analysis eligibility and from every dataset manifest created after the withdrawal date. Aggregate outputs already published are not automatically recalculated; recalculation is a case-by-case owner decision, and this limitation is stated rather than glossed over.

Correction requests are handled the same way: the record is amended, the amendment is recorded in the metadata audit trail, and any dataset manifest built afterwards reflects the corrected state.