LymeHQ · For researchers

Ask whether the cohort exists before you apply for it

Feasibility counts are open to research accounts on purpose. The figures behind them are not, and the floor under both is five people — applied inside the database, where no query can reach around it.

Where this stands today

Approval is reviewed inside the product. The path is built end to end and enforced in the database: you submit a request naming a dataset and an IRB number, an administrator records a verdict on an admin-only review queue, and the export gate reads the same row that verdict writes — approved, unexpired, for that dataset, with the floor re-applied on the way out. Nothing about an approval is self-service, an approval never lowers the floor, and feasibility counts work without one, for everyone with a research account.

The demo commons is also small and deliberately shaped for testing: a handful of engineered groups on synthetic data, including one below the floor that exists precisely to prove it never appears. Do not read it as a description of the eventual dataset.

01 · Feasibility

Counts, without an application

Because an application written blind is a worse application.

A research account can query how many people match any combination of the five dimensions below, and get an answer immediately. That is deliberate. Requiring an approved request before anyone can learn whether a cohort exists produces requests written on guesses, which is worse for everybody — including the review process.

Filtering does not lower the floor. A query aimed at a group of four returns nothing, rather than returning four, because the filter is applied inside the same function that applies the floor. You also cannot distinguish “no such cohort” from “a cohort too small to report” — that ambiguity is the point, not a limitation.

  • Location

    The first three digits of a postal code. Seventeen sparsely-populated ones collapse to a placeholder at the de-identification boundary.

  • Age band

    Decade bands, with ninety and over grouped.

    Nothing in signup or onboarding asks for a date of birth, so a record only carries an age band if it arrived with one.

  • Diagnoses

    Recorded diagnoses as a combination rather than one condition at a time — the combination is the unit, because coinfection is the normal case.

    Not usable for stratifying today: every group we can release currently holds the same value here, so a cohort split on this would compare a group with itself. Ask before you plan around it.

  • Coinfections

    The same construction, recorded separately from the primary diagnosis.

    Not usable for stratifying today: every group we can release currently holds the same value here, so a cohort split on this would compare a group with itself. Ask before you plan around it.

  • Treatment stage

    Where someone currently is: newly diagnosed, in acute or persistent treatment, in maintenance, in remission, or still investigating.

02 · The floor

Five, and there is no way to lower it

Not a setting, not a policy — an absence.

Combinations describing fewer than five people are never written into the aggregate table at all, so there is no suppressed value sitting behind a filter waiting to leak. The function that releases figures re-applies the same floor rather than trusting the table, and raises it if a dataset asks for more. There is no configuration that lowers it: the one column that looks like a switch is read by nothing, and the release function clamps to at least five regardless of what it says.

Individual records are not filtered out — they are unreachable. No permission anywhere in the database grants a research account a row of anyone’s health data, so the result of asking is nothing rather than a filtered something. That is proved with its control on every run: the same account that gets zero base-table rows does get real aggregate cells, so a green result cannot be a broken connection.

03 · Getting figures

What an approved request gets you

And what it does not.

An approved, unexpired request for a named dataset returns the cells for that dataset: the group counts, six symptom measures as averages of per-person averages over a ninety-day window, and the time the aggregates were last rebuilt. Requests carry an expiry, and every query and every export is recorded with the account and the role that ran it.

A saved cohort stores a definition — the predicate, never a count. A stored number would outlive the consent it was computed from, which is caching defeating revocation in a database row. So a definition can be saved even when it currently matches too few people to report; its count simply will not render.

Two things worth knowing before you plan

Industry is a distinct role at the database. Not a label on an account — a separate value evaluated in every access decision and in both research functions. Academic and commercial access are structurally distinguishable rather than administratively distinguished.

Aggregates are rebuilt on a schedule. Someone who withdraws research sharing leaves at the next rebuild rather than instantly, and counts describe the last rebuild rather than this second. Everywhere else on the platform revocation is immediate; this is the exception and it is mechanical.

Where the existing standards ran out and what we would propose instead is on our standards work. To talk about a study, or to tell us the commons cannot answer the question you actually have, research@lymehq.com.

Where to go next