Is this a data broker with a consent checkbox?

No. A broker's product is an extract assembled without the patient in the loop. Here, data moves only while a patient holds a consent naming the study or purpose, and stops when they withdraw it. Prometheno does not sell patient data, and the record of who accessed what belongs to the patient rather than being a report we produce on request.

Why not just use synthetic data?

For writing a pipeline, teaching, or sharing code publicly, synthetic data is often the right answer, and it is used that way here too. It cannot support a claim about real patients: a generator replays the structure it was given, so a finding in synthetic data is a finding about the generator.

Does patient consent replace ethics review?

No. Patient consent and IRB approval answer different questions and a study needs both. Prometheno records the consent and the ethics reference; it does not grant approval.

Pre-pilot, so nothing is being quoted. What is settled is the licensing of the open parts: the HAVEN protocol is CC BY 4.0, free to read, implement and fork with attribution, and PSDL is open as well. If you want to talk about a pilot, write us.

Can I bring my own cohort definition?

That is the intent. Cohort definitions are written in PSDL and travel as a Certified Bundle carrying its own hash and signature, so the definition you send and the one that ran are demonstrably the same. Submitting a bundle to run inside the environment is designed and not yet built; today cohorts are built in the researcher workspace.

What do the patients get out of it?

First an answer: a plain-language summary of what the study found, tied to the records they contributed. Then priority — the people who made a study possible come first for what follows from it. Then a share of the value their records carried. In that order; the money is the smallest part of it.

Prometheno · How the options compare

← HomeContact ↗[email protected] →

EN中文

01 — The comparison

Four ways to get real records. They differ in who is still in the loop.

A researcher who needs record-level health data has four realistic options: license a de-identified extract from a data broker, generate synthetic records, negotiate a data use agreement with each institution, or work with data the patients themselves consented to share. They differ less in what the rows look like than in what you can still do once the data is in front of you — ask the patients a follow-up question, honour a withdrawal, show a reviewer where a number came from.

Options compared: 4
Consent (Prometheno): Per patient, scope-bound, revocable
Access path: Consent-scoped query and export
Stage: Pre-pilot — dev corpus, not live patients

02 — The four options

What each one is, at its best and at its cost.

Prometheno — consented access

Patients connect their own records from their hospital portals and grant consent that names a study or a purpose. A query or an export covers the people whose consent matches that scope, and writes one audit entry per patient.

Good at: Keeping the patient reachable: consent can be scoped, checked and withdrawn, and every access leaves a trace you can verify.
Costs you: The cohort is only as large as the patients who joined. Pre-pilot, so today that means a public research corpus rather than a live population.

Data brokers and de-identified aggregators

A vendor licenses you a de-identified extract assembled from claims, pharmacy, lab or EHR feeds. You sign, receive a file or a warehouse seat, and analyse it in your own systems.

Good at: Scale and speed. Millions of patients across many years, available as soon as the contract is signed.
Costs you: The patients are not reachable: de-identification removes the route back to the person, so nothing can be re-consented, corrected, withdrawn or followed up. Linkage across feeds is the vendor's method to explain.

Synthetic data

Records generated to imitate the statistics of a real dataset. No real person is in the file, so there is no consent question and usually no agreement to negotiate.

Good at: Method development, code that has to be written before real data arrives, teaching, and sharing a pipeline publicly.
Costs you: It contains no fact that was not already in the source distribution, so it cannot support a claim about what happened to real patients.

A data use agreement, per institution

The established route: ethics approval, then a data use agreement with each institution's legal office, then an extract from that institution's warehouse — usually under a waiver of consent.

Good at: Real records with real outcomes, under governance every party already understands.
Costs you: One negotiation per site, each on its own timeline, and patients are represented by the institution rather than reachable directly.

None of these is a fraud. They answer different questions, and two of them can be true at once — synthetic data to write the pipeline, consented access to run it.

03 — Six situations

The differences show up in situations, not in feature lists.

Each row is a moment that decides how a study goes, and what follows is what actually happens on each route — including the one where Prometheno has nothing built.

01
You need to know who is in the data before you commit.
Feasibility counts, before a protocol is written.
Prometheno
A consent-scoped count covers the people whose consent matches the study or purpose you name. Everyone else never enters the result.
Data broker
The vendor's counts come with the licence conversation. Checking them against the underlying records generally happens after you have signed.
Synthetic
The counts are whatever the generator produced. They describe the generator, not a population.
DUA per site
Feasibility usually needs an honest-broker query at each site, which is itself a request with a queue.
02
A patient changes their mind halfway through.
Withdrawal, after the analysis has started.
Prometheno
Revocation takes effect at the next access: the consent check fails, the person drops out of scoped queries, and the denial itself is audited.
Data broker
There is no route back to the person, so there is nothing to withdraw from the file you already hold.
Synthetic
Not applicable — no real person is in the file.
DUA per site
Most extracts run under a waiver, so withdrawal is handled at the institution if at all, and does not reach the copy you hold.
03
A reviewer asks where a number came from.
Six months later, at revision.
Prometheno
Every access writes a hash-chained audit entry, and any entry can be checked with an inclusion proof — without trusting us to have kept it honest.
Data broker
You can cite the licensed dataset and its version. What happened upstream of the extract is the vendor's documentation, not yours.
Synthetic
You can publish the generator and the seed, which reproduces the file exactly and says nothing about any patient.
DUA per site
The institution holds the query log. Getting at it is a request to the data warehouse team.
04
You need labs, medications and outcomes on the same person over time.
One person, several years, several systems.
Prometheno
A patient can connect more than one portal. Records land in one OMOP CDM 5.4 record per person, with the source code kept beside the standard one.
Data broker
Linkage across feeds is the vendor's method, and how well it held for your cohort is usually not something you can check.
Synthetic
Realistic in shape. Correlations the generator was never taught do not exist in the file.
DUA per site
Complete inside one institution's walls, and it stops there. Care received elsewhere is missing.
05
You need a second site.
The first cohort was too small.
Prometheno
Not built. Prometheno today is one environment; cross-institution federation is described in the protocol and not shipped. This situation belongs to the DUA route.
Data broker
Already national in scope — that is what you licensed.
Synthetic
Generate more. It adds volume, not evidence.
DUA per site
A second agreement, a second ethics submission, a second warehouse team: the standard cost, and the reason multi-site studies take years.
06
The patients want to know what came of it.
The study finishes. Now what?
Prometheno
Because a consent names a person, a finished study can return a plain-language summary to the patients whose records were in it, along with priority and a share.
Data broker
No route back. The people in the file will not learn that the study happened.
Synthetic
There is no one to tell.
DUA per site
Findings go back to the institution and the literature. Whether they reach individual patients is not part of the arrangement.

04 — What we cannot do yet

Where the honest answer is “not yet”.

A comparison page that only flatters its author is not worth reading. These are the places where another option is currently the better one.

The corpus is a development one.: The data behind Prometheno today is a public research dataset of 1,000 intensive-care patients. It is pre-pilot: there is no live patient population to draw a cohort from yet.
A file that has left cannot be recalled.: Revoking consent reaches the next query. It does not reach a record-level export already downloaded — nothing downstream can. That is why running the analysis inside the environment, and letting only results leave, is the direction of the work.
Consent scoping is opt-in per request today.: The gate exists and is tested, but a caller has to ask for it, so that the public research corpus keeps working without consent records behind it. A deployment holding real patients' records turns it on for every request.
There is no cross-institution federation.: One environment, one governed store. Running the same cohort definition across several institutions is specified in the protocol and not implemented.

For researchers →OMOP + FHIR →What is HAVEN →HAVEN spec ↗PSDL ↗

05 — Questions

The questions this page usually raises.

Is this a data broker with a consent checkbox?: No. A broker's product is an extract assembled without the patient in the loop. Here, data moves only while a patient holds a consent naming the study or purpose, and stops when they withdraw it. Prometheno does not sell patient data, and the record of who accessed what belongs to the patient rather than being a report we produce on request.
Why not just use synthetic data?: For writing a pipeline, teaching, or sharing code publicly, synthetic data is often the right answer, and it is used that way here too. It cannot support a claim about real patients: a generator replays the structure it was given, so a finding in synthetic data is a finding about the generator.
Does patient consent replace ethics review?: No. Patient consent and IRB approval answer different questions and a study needs both. Prometheno records the consent and the ethics reference; it does not grant approval.
What does it cost?: Pre-pilot, so nothing is being quoted. What is settled is the licensing of the open parts: the HAVEN protocol is CC BY 4.0, free to read, implement and fork with attribution, and PSDL is open as well. If you want to talk about a pilot, write us.
Can I bring my own cohort definition?: That is the intent. Cohort definitions are written in PSDL and travel as a Certified Bundle carrying its own hash and signature, so the definition you send and the one that ran are demonstrably the same. Submitting a bundle to run inside the environment is designed and not yet built; today cohorts are built in the researcher workspace.
What do the patients get out of it?: First an answer: a plain-language summary of what the study found, tied to the records they contributed. Then priority — the people who made a study possible come first for what follows from it. Then a share of the value their records carried. In that order; the money is the smallest part of it.

Four ways to get real records. They differ in who is still in the loop.

What each one is, at its best and at its cost.

The differences show up in situations, not in feature lists.

You need to know who is in the data before you commit.

A patient changes their mind halfway through.

A reviewer asks where a number came from.

You need labs, medications and outcomes on the same person over time.

You need a second site.

The patients want to know what came of it.

Where the honest answer is “not yet”.

The questions this page usually raises.