Begin private, then share deliberately
Treat living people as private by default and avoid making unknown life status equivalent to deceased. A public or family-facing view should mask sensitive details unless the researcher has a lawful and documented reason to reveal them.
Separate workspace access from wider discovery
Membership in a private workspace is one decision; participation in cross-workspace matching is another. A project owner should be able to change that second choice later without deleting the private research or changing collaborator roles.
Minimise data used for matching
A cautious matching service can compare protected fingerprints derived only from eligible deceased people while excluding living people, unknown life status, raw names, sources, notes, media, DNA and imported files. Any broader future use requires a new, explicit choice.