Synaptic Four

"We're based in Europe, so HIPAA doesn't apply to us." That's true — until it isn't. EU companies enter HIPAA-relevant territory more often than they realise: → You're processing data of US patients or participants → You're working with a US-based pharma or research partner who is a Covered Entity → Your tool or platform is sold into the US healthcare market → You're acting as a Business Associate — even if you didn't sign anything that says so explicitly HIPAA compliance then becomes a technical infrastructure question, not just a legal one. What data flows where? What's encrypted? Who has access? What's in your BAA? We wrote a context piece on when and how EU organisations cross into HIPAA-relevant territory — and what it means for infrastructure design. Not legal advice. Technical and factual context with official sources. Full read: https://lnkd.in/e6SEG6Z5 #HIPAA #HealthData #EU #Pharma #HealthIT #DataProtection #International

What if we could understand how people think — without labeling them? We’ve just launched an early prototype at SynapticFour: 👉 https://lnkd.in/e8yA_q_A Most cognitive and psychological tools are built on very narrow assumptions about how people think — often based on Western populations. We’re exploring a different approach. Instead of labeling people, we map cognitive patterns in a way that is culturally adaptable, behavior-based, and usable across very different contexts. The goal is to understand how people think, adapt, and experience their environment — without forcing them into diagnostic categories. This is especially important in places where traditional assessment is inaccessible or stigmatized. Still early, still learning — feedback very welcome. #Neurodiversity #CognitiveScience #EdTech #HumanCenteredDesign #CrossCultural #Research #MentalHealth

If you employ people in Germany, the inclusion quota under SGB IX applies to you. And most companies still don't fully understand how the levy logic works — or what they're leaving on the table. A quick orientation: → Companies with 20+ employees must fill at least 5% of positions with severely disabled people (schwerbehinderte Menschen) → If you don't, you pay the Ausgleichsabgabe — up to €720/month per unfilled position → Workplace adjustments (Nachteilsausgleich) are legally required and often straightforward → Funding pathways exist — through Integrationsämter and the Rehabilitation budget — that many HR teams never claim The BTHG reformed how a lot of this works. The obligations are real, but so are the support structures. We mapped it out — technically and factually, with pointers to the actual legal framework. Full context: https://lnkd.in/ebazDB65 #BTHG #SGBIX #Inclusion #HR #Germany #Disability #NeurodiversityAtWork

CSRD is changing what "social reporting" actually means — and neurodiversity is part of that conversation now. Under ESRS S1, companies need to report on their workforce in ways that go beyond headcount. DE&I evidence, inclusion programme design, measurable outcomes. What this means in practice: → Vague DE&I statements won't hold up under ESRS S1 scrutiny → You need evidence, not intentions → Neurodiversity programmes need to be designed to produce data, not just goodwill → The link between inclusion and business outcomes has to be traceable We wrote a context piece on how ESRS S1, DE&I evidence, and practical programme design fit together for credible social reporting. Not legal or audit advice — but useful reading if you're trying to make your CSRD disclosure actually mean something. Full context: https://lnkd.in/eCS6tUc6 #CSRD #ESG #Neurodiversity #DEI #Inclusion #Sustainability #ESRS

We've been building GA4GH-compliant bioinformatics infrastructure for institutions that can't send patient data to the cloud. Today we're sharing something we haven't had before: a place where you can see exactly what that means — without a sales call, without a demo request form, without waiting for us to reply. https://lnkd.in/evh5X7rP What's there: → Real artefacts from a real end-to-end run — benchmark results, HELIOS audit trails with SHA256 hashes, DRS object references → Honest answers to the questions we actually get asked: Is this certified compliant? (No. Here's what it does instead.) Can we deploy only part of it? (Yes. Here's how.) → Concrete scenarios: EHDS deadlines with heterogeneous infrastructure, DFG open science obligations vs. GDPR, on-premise RAG without data leaving the institution → A path for technical evaluators who want to go deep — and a path for decision-makers who just need the 10-minute version We are a small, specialised team. No VC funding, no cloud-dependency business model. When you have questions, you talk to the people who wrote the code — not an account manager. If you work in genomics infrastructure at a university hospital, research centre, or national network — and the tension between interoperability requirements and data sovereignty is something you navigate daily — take a look. We'd love to hear what resonates, what's missing, and where we got it wrong. #GA4GH #Bioinformatics #EHDS #Genomics #OnPremise #OpenScience #Compliance

NIS2 is now in force. And healthcare organisations are squarely in scope. But what does it actually require from your IT team? A practical breakdown: → Risk management: documented, tested, not just a policy PDF on a shared drive → 24-hour incident reporting: yes, 24 hours. Not "as soon as reasonably possible." → Supply-chain controls: your vendors and tools are part of your attack surface under NIS2 → Access controls: MFA, least-privilege, privileged account management — all expected → Backups: tested, isolated, and recoverable. Checkboxes don't count. Healthcare has always been a high-value target. NIS2 makes the baseline explicit. This is technical context, not legal advice — but it's the kind of context your IT and compliance teams need to be reading. Full breakdown: https://lnkd.in/ehCpN2hf #NIS2 #CyberSecurity #HealthcareIT #EURegulation #CriticalInfrastructure #Compliance #InfoSec

GDPR and health data: everyone knows Article 9 covers special categories. But what does that actually mean when you're running genomics pipelines? We mapped it out — practically, not theoretically. Things that trip up bioinformatics teams: → Pseudonymisation ≠ anonymisation. Genomic data rarely qualifies as truly anonymous. → Article 28 processor roles matter the moment you use an external tool, cloud service, or third-party library that touches patient data. → DPIA triggers: you probably need one. The question is when and how to scope it. → Consent under Article 9(2)(a) vs. research exemptions under 9(2)(j) — different documentation requirements, different risk profiles. No legal advice here. Just the technical and factual context, with pointers to the actual regulation. Full piece: https://lnkd.in/eb2HfcuT #GDPR #HealthData #Bioinformatics #DataProtection #EU #Genomics #Compliance

The European Health Data Space (EHDS) is coming. But what does it actually mean for hospitals and research organisations—technically? We wrote a plain-language breakdown. The short version: → Dataset catalogs: your data assets need to be discoverable and described in machine-readable form → Pseudonymisation: not optional, and it has to be reproducible and auditable → Secure processing environments: where and how data gets processed matters under EHDS, not just what you do with it → Opt-out propagation: consent state needs to flow through systems, not just be stored somewhere This isn't legal advice — it's a technical mapping of what the regulation requires in practice, with links to official sources. Read the full context piece: https://lnkd.in/ebCXs_H6 And if you're trying to figure out where your infrastructure actually stands: https://lnkd.in/eNFhJ2cq #EHDS #HealthData #Bioinformatics #EURegulation #HealthIT #OpenData #GA4GH

We've been thinking a lot about how cognitive traits get described — and how often the labels we use say more about the system doing the labelling than the person being assessed. That's part of what led us to open-source PCMS (Perceptual & Cognitive Mapping System): a free, MIT-licensed web tool that maps cognitive tendencies across continuous dimensions rather than forcing people into fixed categories. No diagnostic labels. No scores that put people in boxes. Just descriptive profiles and visualisations designed for research, education, and self-reflection. Why dimensions instead of labels? Cognitive traits are generally distributed along a spectrum. Dimensional models often capture nuance that rigid classifications miss — and in some cultural contexts, imported diagnostic labels can reinforce stigma rather than reduce it. PCMS was built with that tension in mind. A few things we're clear about: ✔ It is not a clinical instrument ✔ Informed consent is required before any data collection ✔ Results must not be used to make placement or access decisions about individuals PCMS isn't a Synaptic Four product or service — it lives alongside our mission as shared research. The code is on GitHub, fully open. If you work in neurodiversity research, clinical psychology, or education and are curious, we'd love to hear your thoughts. 🔗 Research note: https://lnkd.in/egVUTEkc 🔗 GitHub: https://lnkd.in/eMXwSHPR #Neurodiversity #OpenSource #CognitiveScience #Research #Inclusion #MentalHealth

Why we built PCMS — and what it isn't. Most tools that try to capture cognitive or neurodivergent traits do one of two things: they assign people to a category. Or they hedge so much that nothing useful remains. We wanted to try a different path. The Perceptual & Cognitive Mapping System (PCMS) is an adaptive questionnaire that maps cognitive tendencies across continuous dimensions — no label, no diagnostic instrument, no box to tick. The output is a descriptive profile, designed for reflection and research datasets. The reason for this approach isn't technical novelty. It's a genuine conviction: cognitive traits are continuously distributed. A binary "is autistic / is not" doesn't reflect most people's reality — and in some cultural contexts, imported classification labels can cause more harm than good. So PCMS works with dimensions rather than labels. Where it makes sense, profiles can be related to known neurodevelopmental patterns — but always in research language, never as clinical judgment. What PCMS is not: it's not a Synaptic Four product, not a paid service. We don't sell it. It's open source under the MIT license, built with Next.js and TypeScript, with consent flows and optional Supabase logging for studies. It runs alongside our mission — no diagnoses, no pigeonholes, but a genuine interest in understanding how people think and perceive. If you'd like to take a look: the research note and GitHub repository are linked on our website. 👉 https://lnkd.in/egVUTEkc #Neurodiversity #OpenSource #Research #Cognition #PCMS #SynapticFour