Data governance embedded privacy calculus: a multi-level framework for explaining data-sharing in digital healthcare platforms

Digital healthcare platforms (DHPs) rely on data-sharing across multiple actors and contexts to support patient-centred care. Advances in regulatory frameworks and technological infrastructures have been widely promoted as key enablers of data-sharing in DHPs. In principle, these developments should support secure, timely, and interoperable flows of health data intra-organisations and inter-organisations. In practice, however, data-sharing in DHPs often remains selective, delayed, or inconsistent. This gap suggests that formal regulation and technical capacity alone are not sufficient to explain how data-sharing occurs in real healthcare settings. Existing data governance (DG) research mainly focuses on structural design. It emphasises decision rights, accountability mechanisms, and technical arrangements. While this perspective is useful, data sharing arrangements in DHPs have become increasingly complex. Decision-making authority is often distributed across multiple organisations and involves numerous actors. In such contexts, data-sharing decisions depend not only on regulatory frameworks and technological infrastructures, but also on how actors interpret risks, benefits, and responsibilities in specific situations. To address this mismatch, this study integrates Privacy Calculus Theory (PCT) with data governance (DG). Adopting a human-centred patient perspective, it develops a multi-level framework spanning intra-organisational, inter-organisational, and patient-centred contexts that shows how governance-embedded risk–benefit evaluations shape accountable actors’ data-sharing decisions.