Skip to content

Consent management

Data owner consent is a first-class capability of the dataLOFT platform, supported at the architecture level rather than bolted on as an afterthought. The platform is designed to enable scenarios where a data owner must explicitly approve access to their data before a transfer can proceed.

At the same time, consent is not enforced for every scenario. Use cases where data owners are not individually involved, such as institution-to-institution data sharing, are fully supported. The appropriate consent model depends on the use case and the data sharing agreement between participants.

Enforcement point

The contract hook in RUN-DSP is the enforcement point for consent. When a contract negotiation reaches the AGREED transition, the contract service hook can check whether the relevant data owner has granted consent. If consent has not been granted, the hook returns a rejection and the negotiation transitions to TERMINATED.

Current state

The current r-squared demo does not use consent. It demonstrates institution-to-institution data sharing without data owner involvement. The Consent Management App is not integrated in this scenario.

Future demo scenarios will integrate the CMA to demonstrate:

  • Data owner consent granting via the mobile app
  • Consent-gated contract negotiation
  • Consent revocation and its effect on active negotiations

Consent is intended to be scoped per study or per provider relationship. A data owner grants consent once for a study, and all transfers within that study can proceed without requiring approval for each individual transfer.