The data this work runs on is the most personal class there is: physiological and behavioural, longitudinal, and about a named individual rather than a category. Once disclosed it cannot be recalled.
So trust is not a formality to be settled at the contract stage. It is the first question worth asking, and it is worth asking before anything is measured rather than afterwards.
Why this data is different from other data
Health and behavioural data is not merely sensitive. It is interpretable against the individual - by an insurer, in a dispute, in a diligence process, by anyone who would rather read capability than intention.
And unlike a credential, it cannot be rotated. A password can be changed. A record of how a specific person's system has performed under load over two years cannot be unmade by any process available to him.
That asymmetry is the whole argument for setting the standard before the first reading rather than trusting a policy afterwards.
The questions worth asking
Five, and none of them is answered by the existence of a privacy policy.
Who holds the data, and in whose name is it held. Whether anyone other than the executive could be compelled to produce it. What happens to it if the relationship ends, which is when the risk becomes real rather than theoretical. Whether it is an input to anything commercial - a fund's diligence, an employer's assessment, an insurer's pricing. And whether the answer to each of those is a position the executive can state plainly, or a clause that requires interpretation.
What a credible answer looks like
A credible answer is short, specific, and about the executive rather than the entity behind him.
It names who can see the data. It survives the end of the relationship, because that is the moment when most assurances quietly expire. And it is given in a conversation by the person who will be holding it, because an answer assembled from documentation is an answer nobody has taken responsibility for.
An answer requiring interpretation is not an answer. That is the test, and it is a test the reader can apply to any provider in this category, including this one.
What a non-answer sounds like
There are four forms, and they are worth recognising because each arrives confidently.
The first is reassurance without specifics - security described as a priority by someone who has not said who can see the data. The second is a compliance standard offered as a signal, when a standard describes a process rather than an access list. The third is a policy that defers to third parties the reader will never see, which moves the question rather than answering it. The fourth is an assurance that quietly expires with the relationship, which is the point at which the reader's exposure is highest rather than lowest.
An answer in any of those forms is not necessarily evasive in intent. It is simply not an answer to the question that was asked, and in this category the difference between the two is the whole of the due diligence.
The part the buyer cannot inspect
There is one thing a buyer genuinely cannot verify, which is what happens to data once it is held. Access controls, internal policy and the conduct of a future employee are all outside his view.
Which means the only real protections are on the collection side. The less that is collected, the less that can ever be disclosed. The fewer parties in the chain, the fewer agreements have to hold. And the shorter the retention, the smaller the window in which any of it matters.
That is a design preference before it is a legal one, and it is a more durable protection than any undertaking, because it does not depend on anyone keeping a promise.
Where this leaves the question
It cannot be answered to a reader's satisfaction on a page, and a page claiming otherwise would be asking for precisely the trust it says should be earned.
So it is answered directly, in the presentation, before anything is measured - which is also the only point at which the answer is of any use to him.
Which leaves a question the reader can settle for himself before choosing anyone in this category, including this one: what would I need to hear, from the person who will hold the data, before I was willing to have it taken. The answer to that should be specific. If it is not, nothing that follows will be either.
Ask for the presentation, and ask it this question first.
Dan.