What I do, what I don’t, and who owns what.

1 · Read-only first, and nothing changes without your approval

I start from exports you provide or read-only credentials you create and can revoke at any time. I do not deploy to your production systems, do not alter records, and do not hold any credential you cannot withdraw in a minute.

Where a change has to be made in your environment, I prepare it, document what it does, and you or your team apply it. If you would rather grant write access for a defined window, that is your decision to make in writing — never an assumption I make for you.

2 · What you own, and what I keep

You receive a perpetual, irrevocable, worldwide licence to everything I deliver — code, models, configuration, documentation — to use, modify and pass on for any purpose, including handing it to another contractor or your own staff. No expiry, no restrictions, no further fee. If I disappeared tomorrow you could carry on without me; the documentation is written on exactly that assumption.

I keep ownership of my own general-purpose libraries, test harnesses and templates — the same way any contractor keeps their own tools. They contain none of your data, schemas, business logic or identifying details, and your licence above covers your use of anything built with them.

If your organisation requires outright assignment of a specific deliverable, say so before we agree a price. It is a real cost rather than a formality, so it changes the number — but it is never a reason to walk away.

3 · What you get, and when

1. A written scope before any paid build, naming what will exist at the end and what will not.
2. The thing itself — tested, documented, with its failure modes written down rather than discovered later.
3. Monitoring where it was agreed — so a silent failure becomes an alert instead of a discovery weeks afterwards.
4. A list of open questions. Things that cannot be resolved without information only you hold come back as questions, never as quiet assumptions.

Turnaround is agreed per engagement. The $750 review is three to five business days.

4 · How I work: async, with a response time in writing

Work runs by email or your Slack. I reply within one business day, and that commitment is part of the agreement rather than a courtesy. Updates are written, so there is a record instead of a recollection.

There are no standing meetings. Calls are available when something genuinely needs one and are billed separately at $300–500 per hour — priced rather than refused. If a piece of work needs somebody present during business hours, I will say so before we start instead of letting it fail quietly.

5 · Escalation, not quiet correction

If I find that data you are relying on is wrong in a way that matters — a feed that has been failing silently, a report built on a column that changed meaning, numbers that do not reconcile after a migration — I tell you in writing the same day, plainly, before doing anything else.

I will not paper over a finding to keep a scope tidy, and I will not continue an engagement where I am asked to.

6 · Confidentiality, and clinical data in particular

I treat everything you send as confidential and disclose it to nobody without your written instruction, except where required by law. I hold your data only as long as the engagement needs it, and I will delete it and confirm in writing on request. I do not use your data to train anything and I do not share it with any third party for any purpose.

Clinical work defaults to the least data that does the job — de-identified extracts, test or staging environments, or structure without contents, wherever that is sufficient. Where access to protected health information is genuinely necessary, that is agreed in writing first, on your paper, before any access is granted.

If you require a confidentiality agreement on your own terms, send it and I will sign it. I would rather sign your paper than argue about mine.

7 · Limitation of liability

You are responsible for the accuracy and completeness of the systems and records you give me access to. My work necessarily reflects what those contain; I cannot find a transaction that was never recorded anywhere and leaves no trace in the data I receive.

My total liability arising from any engagement is limited to the fees you have paid me for that engagement. Neither of us is liable to the other for indirect or consequential loss.

8 · Practical matters