There is one standard contribution path: a full study contribution (one or more data files plus documentation) that the Data Coordination Center harmonizes and includes in the Repository under governed release, assisting with de-identification if your team needs it. Secondary and replication datasets are welcome and follow this same path. The rest of this guide describes it.

The only variation is administrative. Realm of Caring internal contributions and external institutional contributions follow the same preparation and de-identification requirements; what differs is which agreement applies and who signs it (see Section 5).

If you are unsure whether or how your data fits, use the /contact/ page before you begin — we would rather answer a question than receive a submission that has to be reworked.

A quick router. There is one standard contribution path. Use this to check fit before you begin.

Step 1 — Is this a fit? Is your dataset about cannabis or cannabinoid use and a health outcome, from human subjects? If not, it may be a better fit elsewhere — genomic or sequence data is usually better served by dbGaP, imaging collections by an archive such as TCIA. Datasets with no cannabis or health content, and non-human-subjects data, are out of scope. Unsure? Ask us.

Step 2 — Can it be de-identified? If narrative free text or high-risk indirect identifiers cannot simply be removed, contact us — they can be routed to the restricted tier rather than stripped. Do not silently delete analytically important fields.

Step 3 — Does consent permit sharing? Confirm your participant consent permits sharing for secondary research and describes how confidentiality is maintained. If the language is ambiguous, contact us before submitting.

From there you are on the standard path: apply, Data Coordination Center review, execute the Data Contribution Agreement, prepare and transfer, de-identification and harmonization with your review, and governed release.

The process has two tracks in a deliberate order. The first is sequential — each step gates the next. The second can proceed in parallel once you are set up, so your team can prepare data while the paperwork is in motion.

Track 1 — Get set up (in order):

1. Apply. Submit a brief description of the candidate dataset and your institution.
2. Data Coordination Center review and approval. The Data Coordination Center reviews each contribution for suitability: that it is in scope (cannabis and health, human subjects), can be de-identified, has consent that permits sharing, and arrives with adequate documentation. This operational review is distinct from the Steering Committee’s scientific and ethical review, which governs the release of data to researchers, not the acceptance of a contribution.
3. Execute the Data Contribution Agreement (working name; final title pending legal). Identify the correct institutional signing official ahead of time: the person authorized to sign data agreements for your institution is often not the PI, and inviting the wrong signer is the most common cause of a stalled agreement.
4. Provide your data dictionary for IRB clearance. The agreement cannot clear IRB review without a data dictionary describing the dataset, so prepare your codebook / data dictionary (Section 6) early and submit it alongside the agreement rather than waiting for the data-preparation track.
5. Confirm your consent permits sharing (see Section 9).

Track 2 — Prepare your data (can overlap Track 1):

6. Organize your data files and documentation (Section 6).
7. Prepare your data and remove direct identifiers (Section 7).
8. Run the pre-submission checks (Section 8’s QC list).
9. Transfer securely and review the de-identified preview (Section 10).

Identifiable data are never received by the web application. Raw data are transferred through a secure, out-of-band channel directly into a protected enclave.

A complete submission is a small set of files. Required items must be present for us to begin; the rest materially improve the dataset’s long-term value.

Required (once per study unless noted):

• Your dataset(s) — one or more data files (see accepted formats below).
• A codebook / data dictionary — variable names, variable labels, value labels, and how missing values are coded. One codebook that documents every file is acceptable.
• A study description and documentation — enough for another investigator to understand the methodology and data-collection protocol (study summary, instruments, and any user guide or manual).

Nice to have (strongly encouraged):

• Programming code that reproduces derived or constructed variables and links files together;
• A blank copy of each data-collection instrument;
• Your IRB approval and a blank copy of the consent form(s) used;
• An inventory of the files you are submitting.

On cardinality: where a study has more than one data file (one per instrument or per timepoint), submit one or more data files and a single codebook that covers them, and describe how the files relate.

Accepted data formats:

• Preferred (labels embedded): SPSS · SAS (.sas7bdat or .xpt) · Stata · R
• Accepted, with a codebook: CSV · Excel (.xlsx) · CDISC ODM XML · JSON · Parquet
• Talk to us first: SQLite or other relational-database exports · non-ODM XML
• Please export to one of the above first: JMP · Minitab · MATLAB · Feather · HDF5 · raw SQL dumps

Most data-collection platforms already export a preferred or accepted format. REDCap, Castor EDC, OpenClinica, Viedoc, and Medidata Rave export SPSS, SAS, Stata, R, or CDISC ODM XML; Qualtrics, LimeSurvey, QuestionPro, KoboToolbox, and ODK export SPSS, CSV, Excel, or JSON. Any of these works — export in the format your platform supports best and include the codebook.

The Data Coordination Center harmonizes your data to the common data dictionary and manages secure storage and governed release. Your preparation has two goals: de-identify your data (removing direct identifiers and applying Safe Harbor de-identification as your IRB requires, with our assistance if needed) and hand off clean, well-documented files. The de-identification steps are described in Section 8.

Data best practices:

• Assign an opaque participant identifier and keep the crosswalk. Replace direct identifiers with an opaque study ID before transfer, and keep the table that maps your real participants to that ID at your institution. The Repository never receives that table (see Section 8).
• One record per case where possible. If participants have repeated events (visits, waves), make the case the row and the repeated measures columns or clearly-keyed related files, and explain the relationship in the documentation.
• Keep identifiers in character format and use the same identifier variable name across every file.
• Label everything. Give each variable and each coded value a clear label in the data file itself; secondary analysts rely on the file more than the codebook.
• Code missing data explicitly — distinguish not-applicable, non-response, and refusal with documented codes rather than blanks.
• Include the technical variables needed for valid inference (weights, design variables, disposition indicators) and describe how to use them.
• Deposit derived variables with the code that produced them.

Documentation best practices: provide the study-design documents, questionnaires or instruments, and any working papers, reports, or publications associated with the data.

You do not need to harmonize your data yourself; mapping your variables to the common data dictionary is our role. Focus on delivering a well-documented, de-identified dataset: remove direct identifiers, assign the opaque ID, apply Safe Harbor de-identification as your IRB requires (we can assist), and document thoroughly. If de-identification would harm the analytic value of specific fields, contact us before stripping them (see Section 8).

A mechanical “is it submittable?” pass to run before you transfer files. This is not full de-identification or harmonization — that is our job. It covers the one de-identification step that must happen at your institution, plus the data hygiene that lets us validate and harmonize without a round of back-and-forth.

Identity and de-identification (at your institution):

• Direct identifiers removed from the files you transfer.
• An opaque study ID assigned in their place.
• The crosswalk mapping that ID to real participants kept at your institution and never included in the transfer.

File structure:

• One record per case where possible; repeated events as columns or clearly-keyed related files.
• The participant-ID variable uses the same name across every file, in character format.
• Documentation explains how multiple files relate.

Variables and coding:

• Every variable and coded value is labeled in the data file itself.
• Missing data is coded explicitly, distinguishing not-applicable, non-response, and refusal.
• Technical variables (weights, design variables, disposition indicators) are present, with usage notes.
• Derived variables are accompanied by the code that produced them.

Documentation and format:

• The codebook covers every file and matches the variables present.
• Study documentation (design, instruments, reports) is included.
• Files open in a preferred or accepted format.
• Open-text fields reviewed; if they carry disclosure risk, flag them for the restricted tier rather than deleting them.

Do not over-process your data: remove direct identifiers, assign the opaque ID, document well, and let the Center do the Safe Harbor de-identification and harmonization.

1. Completeness review. We confirm the submission is complete and readable, and contact you if anything is missing or needs a different format.
2. Confidentiality review and harmonization. The Center validates the de-identification (assisting where needed and permitted), derives the subject identifier, handles any restricted-tier fields under the applicable controls, and maps your variables to the shared data dictionary so the dataset is comparable with the rest of the collection.
3. Your review. You review a preview of the prepared, de-identified dataset before it proceeds.
4. Governed release. Release into the served Repository is gated by a two-person governance control; nothing becomes available to researchers until that gate is cleared. Until then your data is not queryable.
5. Discovery and governed access. The de-identified dataset is accessioned and citable, and other investigators may request it only under review and an executed Data Use Agreement. Every release is recorded.

Timeline and cost. There is no fee to contribute. The preparation and review process typically takes a few months, depending on dataset complexity. We may contact you with questions along the way, so build a little time for that into your sharing plan.

• Submission template bundle: empty templates for the data dictionary / codebook and the file inventory.
• What to submit checklist and pre-submission QC checklist.
• De-identification one-pager: the two-step process for your IRB or privacy office.
• “Which path?” decision aid: a one-page router for where your data best fits.
• DMS-plan boilerplate: ready-to-use NIH Data Management and Sharing plan language naming the Cannabis and Health Data Repository.

For preliminary questions, use the Contact page.