The dataset that would fix this is not ours to own.

The rest of this site argues that a collection of Māori and Pacific skin is the missing asset in dermatology AI. Read plainly, that is a stranger explaining that your community is a commercial opportunity he has identified. You would be right to close the tab.

So this page says the other half, which should have come first. It is not a privacy policy. It is a statement of what we will not be permitted to do — and, more to the point, the code that makes those limits executable, because a limit you can only be trusted to honour is not a limit.

Data about Māori is a taonga, and authority over it rests with Māori. Not as a courtesy we extend, and not as a clause we agree to — as the precondition under which any of this is allowed to exist at all.

That is the Te Mana Raraunga position, and we are not in a position to negotiate it. If a governance group says no, the answer is no, and the venture does without. A company whose plan requires a community to say yes has no plan — it has a hope.

Three gates, and the code that raises

Every governance conversation eventually reduces to three questions. Until recently this codebase could answer only the first, which is why it had no business asking anyone for anything.

May we sell a model built on this data?

assert_commercial_only()

The licence firewall. It has existed from the start, and it raises rather than warns: a build that tries to train a sellable model on non-commercial data stops.

Were we permitted to use this at all?

assert_consented()

The consent gate. A licence decides what may be SOLD; it says nothing about what was PERMITTED. An image can be flawlessly CC BY and still be one your governance board never agreed to. Absence of a record is not permission — an image we cannot prove we were allowed to use raises.

Is that permission still current, today?

assert_shippable()

The withdrawal gate. If someone in an artifact has since withdrawn, that artifact will not ship, will not be served, and will not be demonstrated — until it is rebuilt without them.

“Which of your models contain my images?”

This is the second question a governance group asks, and it is the one that decides whether they trust you. Until we built the answer, the honest reply was we do not know — because a model is an opaque blob and you cannot look inside it and find a photograph. Nothing recorded which images entered which weights. A withdrawal request would have been met with a shrug and a promise, which is the answer every institution has already given, to every community it has ever taken data from.

Now every training run writes a manifest at the moment of truth: which image entered which split of which artifact, under which consent record. A withdrawal becomes a lookup rather than an investigation, and the answer is a specific model with a specific remediation:

$ python -m src.governance.cli --withdraw subject_0002

  Which artifacts contain this subject's images?
    artifacts/model.pt   3 image(s)   in_weights: True

  Compliance after withdrawal:  NON-COMPLIANT
    RETRAIN — withdrawn images entered the training split and are in the
    weights. This artifact must not ship, be served, or be demonstrated
    until it is rebuilt.

  $ ship artifacts/model.pt
    REFUSED: 3 image(s) belong to people who have since withdrawn consent.

What this does not do, and we will not pretend otherwise. It does not lift an image back out of a trained weight matrix — nothing can, short of retraining. What it does is convert an unanswerable question into an answerable one, with a named consequence and a deadline. An image that only ever sat in the test split never touched the weights, and we say that too, rather than staging a retraining we do not need.

What happens to a photograph the moment it arrives

A hospital custodian’s first technical question is not about our accuracy. It is: what does your intake do to my file?A lesion photo straight off a phone routinely carries GPS coordinates — often the patient’s home, because that is where it was taken — a device serial number that re-links “anonymous” images to one another, a timestamp precise enough to match a clinic appointment, and an embedded thumbnail that survives cropping.

We do not clean the metadata, which invites the question which fields? We decode the file to raw pixels and re-encode it. Nothing from the original container survives, because nothing from the original container is carried forward — a stronger guarantee than any blocklist, and the only one that still holds when a camera vendor invents a new metadata segment next year. The original filename is destroyed too: clinical exports are named SMITH_J_2026-03-14_left-sole.png, and carrying that forward would re-identify the patient in our own records, moments after we carefully stripped the EXIF that said the same thing.

And here is what that does not buy you

It removes nothing from the pixels. A face at the edge of frame, a tattoo, a wristband bearing an NHI number — those are in the image itself, and no metadata strip touches them. Skin is biometric.A photograph of it is not anonymous, it will never be anonymous, and any vendor who tells you their pipeline “anonymises” dermatology images is either confused or lying. Pixel-level de-identification is a separate and harder problem, and we have not solved it.

The consent ledger is append-only, and you can read it

A withdrawal is a new record. The original grant is never edited and never deleted — because deleting it destroys the evidence that the withdrawal was honoured, and because an auditor must be able to reconstruct what we were permitted to do on the day a model was trained. That is the first question asked after a complaint, and a mutable database cannot answer it.

Consent is scoped to a closed list of purposes — audit, training, publication, commercial product, teaching — not to a free-text box. A free-text purpose is a consent form that means nothing, because no machine can check it, so it is a promise rather than a control. A closed list means a governance group can point at exactly what they are agreeing to, and a later use outside that list raisesinstead of being rationalised. “You may audit, but you may not train on me” is a sentence this system can actually enforce.

What we are not asking for

We are not asking for a dataset we own. Ownership, and the authority to revoke, stay with the community and its governance body.
We are not asking for open publication of images. The audit product needs no images at all — it consumes a table of predictions, which is why a vendor can buy it without handing over a single photograph, and why a custodian can permit it without handing over a single patient.
We are not asking anyone to trust a promise. Every limit on this page is a function that raises, in a repository you can read, with a test that proves it raises.
We are not asking for a decision today. We are asking whether the machinery above is the right machinery — and if it is not, what would have to change.

Where this is still weak

The founder is not Māori, is not a clinician, and has no governance mandate. Nothing on this page has been reviewed by a Māori data-governance body, and until it has, it is a proposal rather than an agreement — software written in anticipation of a conversation that has not happened yet. It is offered in that spirit: as evidence that the conversation would be worth someone’s time, not as a claim to have pre-empted its outcome.

Tell us what is wrong with this →