Data privacy & responsible data handling

Many CACoM projects work with sensitive or clinically derived data. All CACoM activities fall under the EU General Data Protection Regulation (GDPR) and TUM's internal data protection guidelines for teaching and research.

Treat every dataset as if it contained information about someone you know and care about: keep it confidential, limit who can see it and process only what you need.

Data categories

Category	Description	Examples	Share publicly?
Identifiable	Personal identifiers or metadata that could directly identify a person	Names, hospital IDs, GPS traces, raw medical records	Never
Pseudonymized	Identifiers replaced by codes; re-identification is still possible with additional information	Patient_001, timestamped CTG traces	No, internal use only
Anonymized	All identifiers removed so that re-identification should be impossible, which can rarely be guaranteed	Aggregated metrics, derived features, downsampled recordings	Only with our explicit approval
Synthetic	Generated by algorithms or simulations, not based on any real person or measurement	Simulated CTG signals, mock IMU datasets, random noise generators	Yes, freely

tip

A dataset generated entirely from code, for example by statistical sampling or procedural simulation, is synthetic, and you may share it publicly without restrictions. Treat a dataset derived from real data, even indirectly, as anonymized: ask us for approval via support@cacom.dev before you share it publicly. Approval is quick.

caution

Anonymization is much harder than it seems. Many "de-identified" datasets can be traced back to individuals when combined with outside information. When unsure, treat the data as pseudonymized and keep it private.

Handling rules

You must:

• Store sensitive or pseudonymized data only on approved TUM or course-managed systems, such as institutional cloud storage, encrypted drives or the CACoM Google Drive.
• Share sensitive data only internally, through the CACoM Google Drive.
• Document data sources and access permissions in your README or report.
• Delete all local copies after submission unless explicitly instructed otherwise.

You must not:

• Upload or share clinical, patient or proprietary data on public platforms, such as GitHub, Kaggle, public Google Drive links or personal websites.
• Email datasets to external parties without our written permission.
• Attach patient, pseudonymized or proprietary data to a support ticket.
• Try to re-identify individuals from pseudonymized data.
• Combine datasets in ways that could indirectly reveal identities.

Data in your reproducibility package

Label each data file in your reproducibility package with its category (synthetic, anonymized or pseudonymized) and describe the data with metadata instead of raw identifiers. For example:

data/
├── synthetic_ctg_sample.csv     # OK to publish
├── real_patient_signals.csv     # INTERNAL ONLY
└── README_data.md               # explains origins and permissions

External collaborations

If your project involves clinicians or industry partners, follow their institutional data policies and confidentiality agreements, and don't redistribute data you get through the collaboration. Report any data breach, accidental exposure or uncertainty to us immediately via support@cacom.dev.

Proprietary components

Some projects rely on proprietary hardware, software or datasets, such as our fetal heartbeat simulator or tools from collaborators and industry partners. If yours does:

• You may not publish or redistribute the full project.
• You may share the open parts of your work, such as analysis scripts, derived metrics or simulation examples, as long as they don't reveal or replicate proprietary details.
• Before you publish or upload anything, ask us which parts may be shared and which must stay private.
• In your reproducibility package, clearly mark restricted files or modules (for example hardware_interface_proprietary/) and document how they fit into your workflow.

note

Projects that use proprietary resources are fully valid academic work. For them, reproducibility means transparency about your methods; you don't have to publish all your materials.

Derived and aggregated data

You may share derived, aggregated or statistical summaries of your results publicly if no individual participant can be identified from them and they reveal no private or proprietary information. Examples include group-level averages (such as mean heart rate per minute), statistical model coefficients and performance metrics (accuracy, RMSE and so on).