There is a tree, native to much of North America, called the serviceberry. Each summer it produces more fruit than it could ever need. Birds come. Small mammals come. People come. They eat the fruit and scatter the seeds. The tree gives away most of what it makes, and what it gets back is a future: more serviceberries, a forest that goes on. The botanist Robin Wall Kimmerer calls this a gift economy: an economy that runs on reciprocity. The serviceberry doesn't thrive in spite of its generosity. It thrives because of it.

Hanah began with a question: what if data could be more like the serviceberry?

01 — How we look at data

In the dominant model, data is a resource that flows toward whoever has the strongest legal or technical claim to it.

Call it extraction. It works, in a limited sense. It also produces some particular kinds of failure. The one we couldn't look away from is what's happened in women's health.

A note on the word women: when we say women, we include everyone pushed to the edges of male-centric research: women, trans and non-binary people, and intersex people, whose bodies have been overlooked for too long.

For decades, for centuries really, women have been underrepresented in the data that shapes medicine. Heart-attack symptoms, drug doses, AI diagnostic models: much of what we call medical knowledge is built on bodies that are mostly male. Caroline Criado Perez calls this the default male, the deep and often invisible habit of treating men as the standard and women as a deviation. Her 2019 book Invisible Women traces the pattern far beyond medicine, with consequences that range from inconvenience to early death.

That picture is starting to change, though more slowly than the attention suggests.

Europe is no exception. Endometriosis alone affects an estimated 14 million women across the continent, yet Germany spends about €5 million a year on research into it, against an economic cost of roughly €1.5 billion annually in that country alone. France only launched its national endometriosis strategy in 2022. The Netherlands adopted a national strategy for women's health in 2025, after years in which conditions like cycle disorders and endometriosis barely appeared on research agendas.

What has grown is everything around the gap. Period trackers, fertility apps, hormone-tracking platforms, many of them built with care, have given millions of women tools that until recently simply didn't exist. The infrastructure beneath all of it is the part that hasn't caught up. Data sits in silos. Some apps protect it well. Others get caught extracting and selling it.

After Roe v. Wade fell, the fear that period-tracker data could end up as evidence in abortion cases grew serious enough that privacy advocates publicly urged women to delete their apps. And the concern is not only American: in the Netherlands, the digital rights organisation Bits of Freedom launched a campaign this spring and filed a complaint with the Dutch Data Protection Authority against Flo, a cycle-tracking app used by more than 200,000 women in the country alone. Even where companies act in good faith, the rules about how data should move between an app, a hospital, and a research institution are unclear, slow and expensive to navigate.

So the data that millions of women generate, voluntarily and intimately, mostly doesn't make its way back into the medical research that needs it. The benefits flow elsewhere, if they flow at all.

In an economy built on extracting data, an idea built on giving it back sounds naive. We wanted to find out whether it actually is.

02 — Reciprocity

In 1968, the ecologist Garrett Hardin published an essay in Science called "The Tragedy of the Commons." He argued that any resource held in common, a shared pasture, a fishery, a water supply, would eventually be ruined by individual self-interest. The conclusion seemed obvious: shared resources need either privatisation or top-down control. The argument settled into the bedrock of how policymakers, economists, and software architects think about resources, including data.

Elinor Ostrom, a political economist and the first woman to win the Nobel Prize in Economic Sciences, disagreed. She didn't disagree in theory. She disagreed in fact. She kept finding, in patient fieldwork across dozens of countries, communities that had governed their commons sustainably for centuries: irrigation channels in Valencia, alpine pastures in Switzerland, fisheries in Nova Scotia, groundwater basins in California. The communities had clear rules about who could use the resource, and how. They monitored use, and applied proportional sanctions when rules were broken. The people most affected by the rules were the people who made them.

The tragedy wasn't a law of nature. It was the failure of a particular kind of imagination.

Out of her fieldwork came eight design principles for what makes a commons work. They aren't romantic; they are operational. Boundaries should be clear. Decisions should be made participatorily. Monitoring should exist and be trusted. Sanctions should escalate. Conflict resolution should be cheap and accessible.

Reading Ostrom changed what we thought we were trying to do. We were not trying to build a better app, or a more ethical version of what already existed. We were trying to build a commons.

Not for the data itself. The data, we'd come to believe, should belong to the women who generated it. The commons is the infrastructure around the data: the rules, the standards, the technology that lets data move responsibly between the people and institutions that need it. That infrastructure could be built once, maintained collectively, governed in the open, available to anyone willing to play by the rules.

Reciprocity, in this frame, stops being a value statement and becomes a design constraint. You can take from the commons, but you have to give back. You can use the data, but only on the terms set by the people whose data it is. You can build a business on the technology, but the data that flows through the technology is not yours to sell.

03 — How we are building Hanah

Hanah is set up, and is still being set up, as two organisations that share a single principle: Hanah does not hold the data. Women hold their own.

One side is a BV, a Dutch commercial company that builds and sells software. Layer, Navi, engine. Tools that help apps, hospitals and researchers work with women's health data more carefully. Alongside it, we are building a non-profit, still in formation, that will steward the system: set the rules, hold the standards, and answer to the women using it.

That governance is not being designed on paper alone. Earlier this year, together with Anna Ida Hudig, a governance researcher at Cambridge, we convened clinicians, researchers and advocates to work out what Ostrom's principles mean in practice for women's health data: who sets the rules, who monitors, who resolves conflict when interests collide. It was our own small experiment in starting a commons. We are writing up what it taught us, and some of those lessons are already reshaping what the non-profit will become.

In between sits the Vault. The Vault does not belong to us. Each woman creates her own: a personal, secure space where she can pull her health data into one place and decide, in detail, who gets to see what. Companies don't acquire access to a population; they make a request, and each woman decides whether to accept. Researchers see anonymised, federated patterns, never raw individual records, and what they learn flows back to the women whose data made it possible. Reciprocity, again. Hanah itself never holds the data.

Once you take selling data off the table, a lot of other things fall into place. Consent stops being a checkbox at signup and starts being part of the architecture. Governance is built in, not bolted on.

Women are not commodities. The system should be designed for them.

That, at least, is the intention. Most of it has been harder to build than we expected.

04 — What we're still figuring out

What have we learned so far? Mostly how much of this work depends on things we don't fully control.

How do you make this data useable for research? Self-reported data from a period-tracker is messy. People forget to log entries, log them inconsistently. Wearables vary in accuracy. Hospital records, the supposedly clean source, are themselves full of coding inconsistencies. None of this disqualifies the data, but it raises real methodological questions: how should different sources be weighted? How much standardisation does a dataset need before different sources can talk to each other, and how much standardisation kills the very signal you came for? We don't have full answers. We have partial ones: federated analysis, validation, careful study design, partnerships that anchor user-generated data alongside clinical data. And a lot of humility.

There are other open problems. The legal landscape is moving. Trust is the slowest currency we have, and has to be earned three times over: with women, with partners, and with researchers.

The hardest part is something called function creep. Build infrastructure that moves data easily, and sooner or later someone will want to use it for something slightly different than what was agreed. Each small step looks reasonable on its own.

Stack those steps up over the years, and good intentions slowly turn into extraction.

05 — A start

We are not building the answer. We are building one attempt at a different question.

The question is whether digital infrastructure can be commercially viable and held in common at the same time. Whether reciprocity, as a working principle, can hold up at scale. Whether women's health, of all places, can be where these things get worked out.

What we believe is that the current default cannot hold. Systems built on the default male and on extraction produce a slow, compounding harm: misdiagnoses, missing research, and a growing mistrust between women and the tools meant to serve them. That harm will not be fixed by the architecture that produced it.

But starting somewhere else does not mean tearing everything down. Hospitals, research institutions, even the apps themselves hold decades of knowledge and care. The point is not to replace them. The point is to build infrastructure they can plug into, so that older systems get better instead of being left behind. New and old, working on the same problem from different sides.

Sophie Louise Feith

Hanah builds privacy-first infrastructure for women's health data. If you want to follow this work, or disagree with it, support our manifesto and sign up for the waitlist below — or write to us at info@hanahecosystem.io. We will get back to you.