# Phase 3 Privacy, Consent, and Withdrawal Audit

## Purpose

Provide an operator checklist for consent, withdrawal, privacy review, and evidence
collection before and during the 20-person education pilot. This is an operational
artifact, not legal advice.

Primary evidence files:

- `04-privacy/privacy_audit.md`
- `04-privacy/withdrawal_log.csv`

## Pre-Pilot Privacy Gate

Copy this checklist into `04-privacy/privacy_audit.md` and complete it with reviewer
names, dates, and evidence links.

```markdown
# Phase 3 Privacy Audit

Pilot ID:
Evidence root:
Review date:
Operator:
Data steward:
Legal/privacy reviewer:

## Scope
- [ ] Intended use is education/training, not diagnosis, treatment, or emergency care.
- [ ] Participant population and inclusion/exclusion criteria are approved.
- [ ] Self-harm primary scenarios remain excluded unless separately approved.
- [ ] Minor/source-case data use, if any, has documented lawful consent or approval.

## Consent
- [ ] Consent form version is recorded.
- [ ] Consent covers session storage, review, KPI reporting, and any dataset export use.
- [ ] Consent explains third-party model or inference transfer, if applicable.
- [ ] Consent explains withdrawal process and practical limits after anonymized export.
- [ ] Consent receipt is captured before first session.

## Privacy Controls
- [ ] Evidence files use pseudonymous participant IDs only.
- [ ] Identity map location is restricted and not in the repository or export.
- [ ] PII masking is active before external model calls.
- [ ] Raw audio, raw source cases, and direct identifiers are excluded from Phase 3
      artifacts unless separately approved.
- [ ] Retention and deletion schedule is documented.
- [ ] RBAC and audit logging are enabled for instructor/admin views.
- [ ] Export PII scan process is documented.

## Vendor and Transfer Review
- [ ] Model providers and regions are listed.
- [ ] Data sent to each provider is described at field level.
- [ ] Secrets are not stored in evidence files.
- [ ] Any overseas transfer, subprocessors, or institutional requirements have been
      reviewed by counsel or the designated privacy reviewer.

## Decision
- [ ] Approved to start pilot.
- [ ] Approved to generate KPI report.
- [ ] Approved to generate anonymized export.
- [ ] Blocked pending legal/privacy review.

Open issues:
```

## Withdrawal Log

Evidence file: `04-privacy/withdrawal_log.csv`

Required header:

```csv
participant_id,requested_at,effective_at,scope,status,attestation_path
```

Allowed `scope` values:

- `future_sessions_only`
- `exclude_from_analysis`
- `exclude_from_export`
- `delete_where_policy_allows`

Allowed `status` values:

- `received`
- `in_progress`
- `completed`
- `rejected_by_policy`
- `needs_legal_review`

## Withdrawal Runbook

1. Record the request in `withdrawal_log.csv` using only `participant_id`.
2. Stop new sessions for that participant.
3. Mark the roster `withdrawal_state`.
4. Identify sessions, turns, measures, review records, and export rows in scope.
5. Exclude the participant from future exports unless legal review states otherwise.
6. Remove or anonymize records where the approved retention/deletion policy allows.
7. Create an attestation note at the path listed in `attestation_path`.
8. Re-run the artifact checker and KPI report.
9. If an export was already produced, add a manifest limitation and create a replacement
   export if required by policy.

Attestation template:

```markdown
# Withdrawal Attestation

Participant ID:
Request received:
Effective date:
Scope:
Operator:
Reviewer:

Actions completed:
- [ ] Account/session access stopped.
- [ ] Roster updated.
- [ ] KPI denominator/exclusion notes updated.
- [ ] Export manifest updated or export blocked.
- [ ] Deletion/anonymization completed where policy allows.

Records not changed and reason:

Reviewer decision:
```

## Daily Operator Checklist During Pilot

- [ ] New sessions have consent receipts before start time.
- [ ] No direct identifiers were added to evidence CSVs.
- [ ] Instructor/admin access review entries are present for any manual review.
- [ ] Withdrawal requests are processed before KPI/export generation.
- [ ] Safety events are reviewed without copying sensitive free text into the roster.
- [ ] Evidence root checker is run after each pilot day:

```powershell
python scripts\check-phase3-artifacts.py --check --evidence-root $root
```

## Exit Gate

The privacy gate is complete only when:

- `privacy_audit.md` is signed and has no unresolved high severity issue.
- `withdrawal_log.csv` exists and all rows are terminal or explicitly marked
  `needs_legal_review`.
- KPI and export artifacts use the same withdrawal/exclusion decisions.
- Legal/privacy reviewer has approved real participant evidence handling.