Community Outcomes Methodology

How PreMD turns voluntary application-cycle contributions into useful school and state insights while reducing privacy and re-identification risk.

1. Principles

• Private by default. Personal records remain in the private tracker unless an adult takes a separate, informed opt-in action.
• Minimize before transfer. Contribution code derives a narrow fact snapshot from the user's record; free text, direct identity fields, exact locations, and exact event dates are excluded from that snapshot. Authentication and the separately stored account mapping remain necessary for lifecycle controls.
• Aggregate before publishing. The public application reads versioned statistical releases, never applicant-level records.
• Prefer honest uncertainty. Every result displays its contributor-count band, cycle scope, suppression status, and important limitations.
• No individual admissions scoring. PreMD does not turn community data into an applicant “chance,” profile match, or recommendation that imitates an admissions decision.

2. Who and what can be contributed

Contribution is available only to users who affirm they are at least 18 and that the application cycle is their own. It is off by default and requires a current, versioned consent. A person receives a new random contribution code for each cycle, which helps prevent a longitudinal public identity.

Schools that cannot be matched to PreMD's canonical program catalog remain private and are excluded from contribution. The preview shown before opt-in is the minimized fact snapshot eligible for upload. The authenticated service separately processes the account ID and an account-to-random-key mapping so it can prevent duplicates and honor correction, withdrawal, and deletion. Hosting and authentication providers may also process IP addresses, device/browser characteristics, timestamps, and security events in ordinary service logs. Those separate processing layers are not fact-snapshot fields and are never public-release fields.

3. Release pipeline

1. Validate: reject malformed values, unknown program codes, impossible milestone orderings, duplicate cycle submissions, and incomplete records where a metric requires a completed cycle.
2. Separate: store the random cycle code and minimized facts apart from the account-to-code mapping used for correction and withdrawal.
3. Close: build public statistics on a fixed release schedule from administratively closed cycles only. Historical releases are versioned rather than recomputed on every page view.
4. Check: apply cohort thresholds, numerator and complement checks, complementary suppression, coarsening, and repeated-query review.
5. Freeze and publish: record draft source membership for no more than seven days, require registered opaque reviewer IDs from independent privacy and security domains, reject publication if a member's snapshot, consent, academic or experience-hour choice, retention eligibility, application count, or withdrawal state has changed, then expose only the approved aggregate document. Direct build-and-publish is disabled, and neither browsers nor the service role have direct release-table write access.
6. Quarantine if necessary: hide a suspect release from PreMD's public getters without rewriting its immutable rows or reusing its cycles.

4. Disclosure controls

This release uses conservative deterministic controls that are understandable to contributors and auditable by the operator. Passing the minimum sample is necessary but never sufficient: a reviewer may withhold a result when combinations of releases could expose a small group.

Displayed count, rate, and experience-hour bands are intentionally imprecise; they should not be converted back into point estimates. This release does not claim formal differential privacy. If added, its privacy budget, mechanism, composition rules, and accuracy impact will be documented before use.

5. Metrics and definitions

School funnel

Applied is a contributed application to a canonical school/program. Interviewed requires a recorded interview invitation. Accepted requires an acceptance outcome. Matriculated requires an explicit matriculation indicator. Rates use the displayed eligible cohort as their denominator; the released denominator band and missingness context are shown with the metric.

Because School Explorer intentionally has no application-track filter, its school cards use a separate all-track row computed by the publisher from the fixed eligible facts. The browser never chooses one of several track rows or combines released bands. Track-specific MD, DO, MD-PhD, and DO-PhD rows remain available for program-track research only when the all-track parent has at least 50 contributors and at least 5 contributors remain outside the displayed track.

Timing

Invitation and decision timelines use calendar months derived from half-month contribution periods. Durations (secondary to interview, interview to acceptance or rejection, and waitlist to acceptance) are released only as rounded cohort summaries after validation and disclosure review. In-progress cases are not treated as negative outcomes, and in-progress cycles are not included in real releases.

Academic profile view

Broad cGPA and MCAT bands may be shown as matching interview-rate and acceptance-rate matrices. State summaries use only a protected median band with a broad sample-size band, not an exact state average. PreMD does not publish raw applicant dots, tooltips containing a contributor record, or combinations that fall below release thresholds. These views describe contributor ranges, not causation or an admissions formula.

Experience profile view

When contributors separately choose to include experience-hour bands, PreMD derives five per-cycle totals from the private tracker and converts them in the browser to broad canonical bands before upload: clinical experience, physician shadowing, non-clinical service, research, and leadership. Titles, organizations, descriptions, dates, and exact hours remain private. Public school and state views show only privacy-reviewed median and middle-50% broad bands from completed-cycle contributors. They describe this self-selected tracked cohort; they are not school-reported requirements, evidence of what a school “looks for,” causal effects, or targets an applicant should pursue.

State flows and rankings

Applicant origin is the contributor's self-reported state of legal residence for the application cycle. Destination is the program's catalog state. “Applicants from a state” counts distinct eligible cycle contributors; “matriculants from a state” counts explicit matriculation records. Stage-specific rankings cover applications, interviews, acceptances, and matriculations in both directions: schools reached from an origin state and origin states represented at a school. Rankings order qualifying released count bands, not raw counts, with every program in the same band shown as a tie. They do not imply preference, yield, residency classification by the school, or class composition outside PreMD contributors.

Personal analytics

The signed-in “My Cycle” view computes exact funnels, timing, map coverage, and completion indicators locally from the user's private record. A private “outcomes reviewed through” checkpoint helps distinguish still-pending results from a tracker that has not been updated. Those personal values are not subject to public suppression because they are visible only to that user, and they do not become a contribution without opt-in.

Research analyses and deliberate separation

The product foundation is informed by published CycleTrack work on application coverage, program-type timing, tracked-versus-official volume, and contributor representation. PreMD's ordinary outcomes layer can support school/program coverage, cycle and program-track comparisons, invitation and decision cadence, academic-band outcomes, and state flows. It does not currently collect race, ethnicity, gender, age, or weekly event facts in this layer.

Any future representation study must use a separately unchecked consent and an isolated dataset that contains no school, state, outcome, or event timing. Any future weekly-timing study must contribute cycle-relative week indices to a separate temporal dataset with no demographics, state, or academic values. Existing outcomes consent cannot be reinterpreted to authorize either purpose.

6. Bias, missingness, and responsible interpretation

PreMD contributors are a self-selected convenience sample. People may join at different points, forget to update outcomes, enter values incorrectly, or differ materially from all medical-school applicants. Schools also differ in program type, residency policies, class size, and reporting practices. Accordingly:

• counts describe tracked contributions, not complete applicant pools or entering classes;
• an absent outcome means missing or not yet reported unless explicitly marked final;
• acceptance and interview rates should not be compared without examining cycle, sample size, and contributor mix;
• rankings are sortable descriptions of released counts, not quality scores; and
• small differences are not evidence of a meaningful admissions advantage.

7. Corrections, withdrawal, retention, and review

Contributors can replace their minimized snapshot after correcting the private tracker or can withdraw in Settings. A user-scoped one-way fingerprint binds a random snapshot ID to the reviewed payload so a retry is idempotent and changed content under the same ID is rejected; it is not a public applicant ID and contains no fact values. Withdrawal deletes current raw facts, mapping, and snapshot-review events. Minimal withdrawal/consent evidence follows the Privacy Policy unless the user chooses contribution-record or account deletion.

A fixed release is not silently recomputed after withdrawal. A release already downloaded, cached, quoted, or copied cannot be recalled; a terminal quarantine can hide it from PreMD but is not erasure. Quarantined rows remain immutable and their cycle set remains reserved against an overlapping replacement unless a future, separately reviewed policy changes that rule. A draft whose source membership changes or whose seven-day manifest expires must be discarded and rebuilt, and future nonoverlapping releases exclude the withdrawn contributor.

Before real statistics are enabled, PreMD must identify its legal operator and governing jurisdiction, obtain qualified legal review, complete production security/privacy review and an incident-response exercise, verify database policies in staging, document privileged access and retention, staff monitored privacy/security contacts, and record a two-person release approval. Collection remains off by default until those gates are evidenced. Each release records its methodology version, generated date, included cycles, closed-cycle rule, and suppression audit. Thresholds may become stricter as the dataset and attack surface grow.

8. Data integrity and abuse resistance

Community data are self-reported. PreMD validates structure, canonical school codes, chronology, lifecycle consistency, one subject per account and cycle, payload/row limits, and own-cycle attestation; it also rate-limits writes and reviews draft releases for coordinated or implausible patterns. These controls reduce accidental errors and some abuse, but they do not verify a person's identity or prove every reported outcome is true.

A suspicious release stays in draft or is quarantined while an independent reviewer investigates using minimized evidence. Exclusion rules must be reproducible, versioned, reviewed for bias, and disclosed before use; records are not removed merely because an outcome seems unusual.

9. Questions and corrections

To report a suspected error, unsafe breakdown, integrity issue, security incident, or privacy concern, email [email protected]. A named accountable privacy/security operator and incident escalation coverage must be published before real collection begins.