Documented originTraceability
TRACEABILITYIdentify the source and accountable role
Record the origin, version, quality, limitations, and accountable roles for each record.
Governance objectives
Documenting origin, purpose, and accountable roles makes data use verifiable.
Controlled accessRisks
RISK REDUCTIONDefine access, protection, and continuity
Set permissions, backups, retention periods, and incident-response procedures.
Declared useApplications
APPLICATIONSupport research, traceability, and analysis
Maintain the documentation required for research, batch control, analysis, and technology assessment.
Assigned responsibilityAccountability
ACCOUNTABILITYRecord purpose, decisions, and safeguards
Identify the purpose, accountable role, affected people or ecosystems, and planned safeguards.
Governance domains and controls
A common foundation for research, AI, and patient organizations.
The common framework describes requirements for identity, quality, provenance, access, privacy, lifecycle, and reuse. Each domain needs additional controls tailored to its records, risks, and decisions.
FOUNDATION
Data governance
Quality, metadata, provenance, access, privacy, lifecycle, and accountable reuse.
SPECIALIZED DOMAINAI and model governance
Training data, model purpose, validation, bias, robustness, transparency, monitoring, and human accountability.
APPLICATIONSScientific and operational controls
Research, bioinformatics, production, public health, market intelligence, and information products.
SECTOR PATHWAYPatient organizations
Sensitive data, continuity of care, traceability, providers, incidents, and institutional memory.
01 · Governance requirements
Before using data, establish how it will be managed.
Research, cultivation, production, quality control, dispensing, patient support, and administration generate records with different purposes and risks. Each data flow needs an identified source, accountable role, access conditions, and quality criteria.
AromaCann organizes these requirements as a reference for Kannabium. Applying them requires documented procedures and verifiable controls at each stage of the data lifecycle.
Know which records exist and where they are held
Inventory record types, systems, sources, purposes, accountable roles, and access conditions before sharing or analysis.
Connect decisions to roles and controls
Define how records are described, validated, protected, accessed, shared, reviewed, retained, and disposed of.
Keep methods and uncertainty with the result
Protocols, variables, transformations, versions, and source links help distinguish observations from interpretations and hypotheses.
Connect health domains while preserving context
Consistent definitions, identifiers, safeguards, and spatial and temporal scales support comparison across human, animal, plant, and environmental data.
Conceptual references: NIH Data Management and Sharing Policy and WHO — One Health.
02 · Seven governance layers
Each layer records a requirement for data use and review.
Source and acquisition
Identify origin, authority, collection method, date, and terms of access.
Identity and metadata
Use stable identifiers, controlled names, schemas, and contextual descriptions.
Quality and validation
Record completeness, consistency, uncertainty, review, and corrective actions.
Access and privacy
Align permissions, purpose, minimum exposure, and accountability.
Provenance and versioning
Preserve transformations, responsible parties, timestamps, and integrity.
Interpretation and publication
Separate observation, support, interpretation, hypothesis, and recommendation.
Retention and disposal
Define what remains, for how long, under whose authority, and how it is removed.
03 · Data lifecycle
Each lifecycle stage assigns a record, decision, and responsible party.
Purpose and source.
Identity and metadata.
Quality and uncertainty.
Authorized purpose.
Recipients and terms.
Currency and correction.
Preservation or disposal.
Data, information, knowledge, and evidence
Records of origin, method, and purpose guide data interpretation and reuse.
Scientific data are records produced during research. They may be numerical, descriptive, textual, auditory, visual, or audiovisual, and may be held in physical or digital form. Their scientific value depends on preserving the method, context, and conditions under which they were produced.
Records of observations, measurements, objects, or events
Method, units, time, format, provenance, and limitations preserve the conditions under which each record was produced.
Data organized and placed in context
Classification, description, synthesis, or comparison relates data to a question without removing its scope, origin, or limitations.
A reasoned interpretation for a stated purpose
Reasoning connects information, methods, and experience to a question or decision without exceeding the support provided by the sources.
Data or information that supports a claim
Source, method, scope, and uncertainty determine the strength and limits of the support provided for the claim under review.
Strategic value: documented data are inputs for research, artificial intelligence, innovation, and public services. Institutions and countries depend on infrastructure, standards, and expertise to preserve and use data. Who controls these resources and sets access conditions affects who can benefit from them. Conceptual references: Silva et al. (2019) on research-data management and ISO 20691:2022 on life-sciences data.
FAIR principles and artificial intelligence
Reuse depends on identification, context, and access conditions.
Locate records with stable identifiers
Descriptions and metadata make each record discoverable and distinguishable.
Apply permissions and purpose limitations
Access follows privacy safeguards, authorized purposes, and declared terms of use.
Connect systems through shared standards
Schemas, vocabularies, and identifiers support communication across domains.
Carry provenance and licensing into reuse
Documentation, quality records, provenance, and licenses accompany each new use.
Record purpose, validation, monitoring, and accountability
Training data, bias, robustness, error, transparency, and human responsibility remain explicit throughout the model lifecycle.
Trace source data before interpreting the model
Digital representations of biological systems depend on documented quality, provenance, and transformations.
04 · Controls by application
Controls should reflect the application, its data, and its risks.
Research and bioinformatics
Datasets, identifiers, methods, evidence classes, reproducibility, and analytical limits.
Cultivation and production
Materials, batches, assays, transformations, quality records, and custody.
Public health
Definitions, reporting periods, institutional sources, aggregation, and privacy.
Patient organizations
Sensitive records, care continuity, dispensing, providers, and incident response.
Market intelligence
Source date, jurisdiction, descriptive scope, comparability, and update cycles.
Machine learning
Training data, labels, validation, error, reproducibility, and model reuse.
05 · Patient organizations
Sensitive data and care continuity require documented controls.
The sector pathway identifies controls for health records, prescriptions, cultivation, production, quality, inventory, dispensing, contracts, providers, incidents, and institutional continuity.
- Sensitive-data protection
- Systems and database inventory
- Institutional responsibilities
- Batch and dispensing traceability
- Provider management
- Incident response
- Operational continuity
- Evidence preservation
Legal and methodological reference points
Different instruments answer different governance questions.
AromaCann draws on data-protection law and research-data guidance to design controls for access, quality, interoperability, and reuse. These instruments belong to different jurisdictions. Their legal requirements apply only where the activity and data flows fall within the relevant law’s scope.
LGPD and ANPD guidance
Brazil’s LGPD sets rules for personal-data processing, including principles, legal bases, individual rights, security, and accountability. The ANPD, Brazil’s data-protection authority, publishes guidance on processing roles, requests from individuals, and incident notification.
GDPR and European Health Data Space
The EU’s GDPR regulates personal-data processing within its scope. The EHDS sets out additional EU rules for electronic health data, including exchange and secondary use. Its provisions apply in phases; neither instrument automatically governs operations in Brazil.
Data Governance Act and Data Act
The Data Governance Act sets conditions for trusted data-sharing arrangements. The Data Act addresses access to and use of certain data, contractual fairness, switching between data-processing services, and interoperability within its EU scope.
OECD, FAIR, WHO, and NIH
The OECD offers policy work on data governance; the FAIR Principles support discoverability and reuse of research data. WHO — One Health provides a cross-sector health perspective, while the NIH data-management and sharing policy sets expectations for research funded by that agency.
These are neither equivalent instruments nor a single compliance checklist. Record the source, version, jurisdiction, and processing context behind each proposed control.
06 · Roles in Kannabium
AromaCann, BioDev, and Sec: governance guidance, implementation, and curation.
Governance reference
Introduces principles, vocabulary, responsibilities, quality criteria, and lifecycle controls.
Technical implementation
Shows how governance requirements can inform data structures, interfaces, and reproducible workflows.
Curatorial work in development
Sec is under development. Its proposed remit includes reviewing evidence, provenance, semantic consistency, and limitations.
This portal presents information-governance methods, not legal or clinical advice. Applying a control requires assessment of the organization’s jurisdiction, activities, contracts, and responsibilities.
Infrastructure and protection
Systems must record access, changes, incidents, retention, and disposal
Collection, storage, and analysis systems should record accountable roles, permissions, transformations, copies, incidents, retention, and disposal.
Reviewers can use these records to verify whether quality, interoperability, ethical-use, and accountability criteria were applied at each stage of the data lifecycle.