How we accept, store, share and delete research data, in plain words. Cedar is a small, founder-led firm: these are the practices we follow, not a certification.
We work with de-identified or coded data only: no names, health card numbers, addresses, full dates of birth or photographs of faces. For brain images we prefer de-faced scans. Please do not send patient information or identifiable data, by email or through this website.
Through a secure file-sharing link from your institution or ours, never by email. We confirm the transfer method in the written scope before any data move, and we check that what arrives matches what was agreed.
In encrypted storage, on accounts protected by multi-factor authentication. The storage service and the country where data are kept are named in the written scope for each project, so your organization can check them against its own rules.
Only the people named in the scope. We do not use subcontractors without your written permission.
We do not upload your data to public generative-AI services.
We delete project data within 30 days after the project closes, or as your agreement requires, and confirm deletion in writing on request. Code and reports delivered to you remain yours.
We sign your confidentiality agreement and, where needed, a data-sharing agreement before any data move. Datasets such as ADNI are used only under your approved data-use agreement and its terms. Your organization stays the custodian of personal health information under Manitoba's Personal Health Information Act (PHIA) or the law that applies to you.
If we suspect that your data have been exposed, we tell you without delay and work with you on the next steps.
We do not hold formal security certifications such as ISO 27001 or SOC 2, and we do not claim compliance with any such scheme. We follow the practices on this page and your institution's requirements.
Questions
Often, yes. We can work inside your institution's secure environment when your rules allow it. We agree this in the written scope.
No. Every analysis we offer works with de-identified or coded data. If an identifier seems necessary, we discuss an alternative first.
Yes. Your institution's data-use agreement, ethics approval and security requirements take precedence, and we follow them.
Start with a short, non-confidential description. We reply with a suggested next step.
