Security and access
Know the boundary.
A clear view of the current website and the controls required before a participant-data pilot.
What exists today.
Public example package
AVAILABLEThe downloadable specimen contains hand-authored fictional data and runnable integrity checks. It contains no patient records.
Request preview
IMPLEMENTEDThe cohort form builds a local preview. It has no submission endpoint and does not create a study or buyer account.
Website analytics
INHERITEDThe site inherits Eyepup analytics from the main website. Google Analytics is also configured to load when a site identifier is enabled. These are website tools, not a study-data processing system.
The controls a real pilot needs.
These are implementation requirements, not claims that a clinical data platform or certified control environment is already operating.
Separate collection and delivery
BEFORE COLLECTIONKeep participant identity and permissions separate from buyer-facing records. Limit access to the staff and systems required for the protocol.
Controlled processing
BEFORE COLLECTIONDefine storage regions, encryption, reviewer access, access logging and provider responsibilities for each data flow.
Release approval
BEFORE DELIVERYVerify sources, recipient scope, quality checks and use permissions against the agreed release. Record what was delivered and to whom.
Retention and incident response
BEFORE COLLECTIONImplement retention rules, rights-request handling, deletion verification and a documented response to unauthorized access or disclosure.
Claims should have evidence.
This site does not claim a SOC 2 report, ISO certification, completed penetration test or blanket HIPAA compliance. Any future assurance statement should identify the entity, system, assessment and scope it covers.
A buyer review should include the actual data flow, provider list, access model and required contractual protections. A privacy paragraph alone cannot substitute for that evidence.
Know who processes what.
The current website provider inventory is separate from any future participant-data infrastructure. A study-specific provider list must describe the service, data received, location and role before processing begins.
Provider review statusQuestions or a security concern?
Contact julian@lifefrom.ai with a description of the concern. Please do not include health records, credentials or sensitive participant information in an initial email.
Contact LifeFrom