Who Owns Your Medical Data? | Elacity
Tempus will license de-identified Alzheimer's records at $100 each. The market has priced your medical data. The open question is who holds it and sets its terms.
Who Owns Your Medical Data? Now It Has a Price per Record
Your diagnosis now has a list price, and you are not on the invoice. If you have ever asked who owns your medical data, a securities filing from last week gives a blunt answer: whoever holds the copy.
On October 23, Tempus AI disclosed that it will license up to 500,000 de-identified records of patients with Alzheimer's disease and other neurological conditions to Pathos AI at $100 per delivered record, inside a $55 million order. The same filing puts the full package with Pathos and Bristol Myers Squibb at up to $192.5 million over about five years.
What the Tempus filing actually says
The deal is legal, disclosed and aimed at real disease. Pathos says it will use the dataset to study how neurological conditions progress and to design more targeted clinical trials. On the same day, Reuters reported that Pathos raised a $237 million Series E led by Bristol Myers.
Separately, Bristol Myers will license oncology data from Tempus through 2031 and train AI models inside a dedicated Tempus environment. Read the filing for parties and you find three companies. The people behind the records appear only as units to be delivered, 100,000 a year.
That is not a scandal. It is the market telling you what this data is worth, in plain numbers anyone can read.
The failure of de-identified consent
Under United States health privacy law, records stripped of a set list of identifiers can be shared without asking the patient. A peer-reviewed study of HIPAA re-identification risk notes that data de-identified under the HIPAA Safe Harbor rule carries no further restrictions on its use.
Removing your name removes you from the deal. It does not always remove you from the data: researchers writing in Technology Science matched names from local news stories to hospital records in Maine, and estimated that some matches would survive even Safe Harbor redaction.
The deeper problem is that the terms belong to whoever holds the copy, and holders change. California alleged that 23andMe sold genetic data and samples without consent during its bankruptcy, in a case now headed for a settlement that awaits court approval. Montana's attorney general alleges that General Motors sold drivers' data to brokers who resold it to insurers. Different industries, same shape: a copy left your hands, and your say left with it.
The honest complication
Research on records like these is how medicine learns what a disease does over a decade. A system where every patient haggles over every file would starve it, and most people do not want to negotiate with a drug company at all.
So the question is not whether this data should be used. It is where the terms live: in a contract between two companies, or with the data itself, set by the person it describes and checked every time someone uses it.
The Elacity solution: records as property, terms at the key
Elacity is building the ownership layer for that second answer. The idea is simple to state: data you generate should be property you control, with your terms attached, rather than raw material someone else prices.
1. Package the data as a Wealth Capsule
Elacity dDRM is designed to turn a dataset into a Wealth Capsule: encrypted, programmable, with its terms written into an on-chain rights token instead of a side letter. Research use, commercial use and exclusivity become different rights, priced or granted free by the owner.
2. Check the terms at the key, every time
In Elacity's design, the key that opens a capsule is split into shares held on separate machines, so no single machine can open it alone. The aim is that a buyer holds a right that is checked each time the data is opened, rather than a file that is theirs to keep. That key-splitting is built but not switched on yet.
3. Bring the code to the data
Beneath it sits ElastOS, the open-source (MIT) runtime from the Elastos project, which Elacity helps build. It is designed so data stays in the owner's space and code comes to the data: apps and agents get only the access the owner grants, and the owner's runtime decides. It is designed around capabilities, not access control lists: the owner signs a narrow permission, and any lab holding it can use exactly that, without the owner keeping a list of every lab in advance. ElastOS is pre-release.
Notice that the industry already half agrees. Bristol Myers trains inside a dedicated Tempus environment rather than taking the oncology data away. The model came to the data. The open question is whose space the data lives in.
For why this market is real and not hypothetical, read AI training data licensing is a real market now. For what happens after a copy escapes, see why data broker deletion starts after the copy. More analysis lives under Market Intelligence.
Your record, your terms
A hundred dollars per record is not a judgment on any one company. It is a price signal, and price signals end arguments about whether data is an asset. The remaining argument is who gets to hold it and set its terms.
You were the product. Now you own the asset class. Follow Elacity on X for the next piece on owning the data AI is built on.