Patient data stays governed and the code goes beside the paper

Governance belongs only where there is patient data

Claim: recommendation

Repositories such as Vivli and the YODA Project were built to share data about individual patients from clinical trials, with access controls, review of who asks and why, and agreements that bind the people who get it. That's the right home for patient-level data, including de-identified data, because de-identified records can sometimes be linked back to a person.

Those repositories weren't built to version code, run it or release it again when new data arrives. Code platforms such as GitHub and GitLab were. So the pattern is a split. The governed repository keeps the patient data frozen and citable. The companion repository keeps the code alive, and holds a link to the governed record and a synthetic copy, made-up records with the same columns and types, so the code can run end to end without the real data.

Many studies have no patient data at all: simulations, device bench tests, method papers, analyses of published aggregates. For those there's nothing to split, and the code and the data go together in one companion repository with a DOI. Asking those studies to go through patient-data governance adds cost and protects nobody.

If the governed repositories add code versioning and reruns themselves, the split can collapse into one place. What matters is that stable data and updatable, runnable code are linked, not which platform carries them.

Three cases need more than the split

Claim: recommendation

Clinical trial data stays under the rules that already govern it, such as FDA regulations and Good Clinical Practice, and its companion repository shares the analysis with synthetic or aggregate data. Data under an industry contract may not be shareable at all, and a private companion repository with invited reviewers is the way through (A private repository lets a reviewer rerun code that can't be public). And whenever an institution's policy or a data use agreement says otherwise, it wins; check with the research compliance office first.