Through legally enforceable agreements the provider is responsible for managing all information obtained or created in its PT activities, telling the client beforehand what it intends to make public; apart from what the client publishes or agrees to release, information is proprietary and confidential, although anonymised publication for academic insight is allowed. Where law or contract requires release of confidential information the client is notified unless the law forbids it. Information about a participant or customer from another source, such as a complainant or regulator, and the identity of that source are kept confidential from the participant or customer unless the source agrees. Everyone acting for the provider, including committee members, contractors and external bodies, keeps the information confidential, and the identity of participants is known only to those operating the scheme unless the participant or customer waives confidentiality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.