Reproducible, pseudonymized, audited datasets

A dataset definition sets which participants (by status or by a list of pseudonyms), which metrics (from the study’s permitted metrics), which time window and which resolution (raw, minute, hour, day) are included. Time can be absolute (UTC and the participant’s local time) or relative only; clinical records can be included as an option.

The window is defined by calendar dates or around an event. In an event-anchored window, day 0 is the day of the anchor event, for example 7 days before to 30 days after hospital admission. The anchor can be a hospital stay or a clinical event type within the study’s scope.

Every edit that changes content leaves an immutable new version of the definition; a change to the title or description alone does not. Every export is tied to a version. The Versions panel shows who changed which field and when, and you can export from an earlier version without changing the definition.

A measurement dataset is a single ZIP file: measurements in long format (participant × metric × time × source), a participant list and the manifest. If clinical records are selected, events.csv is added. Every export includes quality.csv with completeness and quality flag counts per participant and metric; raw rows carry their flags. When the same metric comes from several sources it is not merged; a source column separates them.

A variable dataset collects specific versions of the variables defined in the study (for example the mean heart rate over the 3 days before an event, or length of stay) in one row per participant. The output consists of variables.csv, missing.csv with the reason for every value that could not be computed, and the codebook.csv data dictionary. Optionally, an Excel file, a labeled SPSS (.sav) file and an R script that reads the data are added.

When a value cannot be computed, no zero or estimate is written; the cell stays empty and the reason appears in missing.csv. How variables are defined and how statistical analysis works is described on the variables and statistics page.

Every export comes with a manifest: scope, filter parameters, definition version and definition hash, transformation version, the data cut-off showing up to when data was included, the SHA-256 content hash, whether the data is pseudonymized and a quality summary.

The same definition version and the same cut-off produce the same content hash. Measurement corrections and clinical record corrections that arrive after the cut-off do not change a file regenerated with the old cut-off; the export reads every record as it was at the cut-off. This makes it easier to show later which data an analysis used and to answer questions from reviewers or ethics committees.

In the output, a participant appears under the study pseudonym (P001); the only participant attributes are sex and age at the start of participation. Names, person identifiers and dates of birth never enter an export. Pseudonymization does not make personal data anonymous; sharing and using a dataset remain subject to the organization’s and the protocol’s rules.

Generating and downloading datasets requires the export permission and membership of the study team. Generation and every download are written to the audit trail. Files are kept in the organization’s own environment and deleted after 30 days; the definition and manifest remain, and the file can be regenerated with the same definition and cut-off.