A Classification of License Identifiers Observed on Biomedical Datasets

1. Purpose

A license identifier on a dataset page is a short label whose meaning ranges from a precise legal instrument to a placeholder. Rules that decide whether a dataset may be reused need a fixed way of reading each label. This report publishes the reading used in the Mdexa card pipeline (schema/license-map.json, rule article 11 of schema/README.md), lists every identifier it knows, shows how often identifiers occur in the project's data, and describes how readings are maintained. It makes no claim about what a license text means in law.

2. Classes and the basis for assignment

Rules accept only identifiers (or their case-insensitive aliases) that appear in the table; any other identifier goes to manual review and, after a human decision, is added to the table.

Table 1. The five classes. The table has five classes because placeholder values need a class of their own.

The assignment follows three principles taken from the adjudication rules: a permissive verdict needs an explicit statement about the data; restrictions are read broadly; and a condition is recorded rather than hidden inside "permissive". Conditions are recorded as controlled values (attribution, share-alike, no-derivatives, notice-required, territory-dependent, registration-required). For example, CC-BY-SA and ODbL entries carry attribution and share-alike; a dataset under share-alike stays "permissive" but its summary sentence must say so (article 9). "No-derivatives" and "non-commercial" variants of Creative Commons licenses are restricted. Entries with a model license or another custom license are marked as custom licenses, provisionally restricted, and sent to human review (article 18).

3. Complete table

The following table is written by scripts/classify.mjs from schema/license-map.json (version 1.1). "Basis" is the English basis recorded for each entry; "Source" is the license's reference page. Entries marked "yes" under manual review are provisional.

Wide table: scroll sideways for every column

Table 2. The 84 entries of the license map.

4. Frequency in the project's data

The published-card rows count the 43 cards of the frozen first-release catalogue (the catalogue has since grown). An identifier is counted once per card if it appears as the card's license identifier, as the identifier of any evidence entry, or as the repository license.

Most frequent identifiers on published cards (cards): NOASSERTION (26), Apache-2.0 (16), MIT (5), CC-BY-4.0 (4), CC-BY-NC-4.0 (3), GPL-3.0 (2), CC-BY-NC-ND-4.0 (2), LicenseRef-THUDM-ChatGLM-6B-Model-License (1), LicenseRef-all-rights-reserved (1), LicenseRef-wangekxy-commercial (1).

Most frequent identifiers on draft cards: NOASSERTION (26), Apache-2.0 (12), CC-BY-4.0 (9), MIT (9), CC-BY-SA-3.0 (3), LicenseRef-PublicDomain (3), CC0-1.0 (3), CC-BY-3.0 (2), CC-BY-SA-4.0 (2), LicenseRef-llama3.1 (2).

Table 3. Identifiers on cards (figures/stats.json has the full lists). NOASSERTION is the placeholder used when a status is conflict, unstated or unverifiable; it is counted in the "no statement" column.

In the draft set (counted on 2026-11-13) 0 identifiers are outside the map. An earlier batch of drafts, produced before the platform-value rules and the identifier table were completed, contained three such identifiers (a bare cc, other, and a CDLA variant); under the current rules the platform values map to "no statement" and the CDLA identifier is in the table. The draft cards are working files and change as the pipeline runs; the counts describe the stated date only. The number of drafts changes as ingestion proceeds; the figures here are fixed at the statistics date, and the verification script does not compare them with the live directory.

5. Cases that are easy to misread

Only what the labels and texts say is reported; no legal conclusion is drawn.

other and unknown on a hosting platform. The Hugging Face documentation lists both values among its license identifiers, and states that for license: other the license text should be added in a LICENSE file in the repository and a name set in license_name [1]. Such a value therefore names no license by itself. The rules read other and unknown as "no statement" and look for the text.

Unversioned cc. The same documentation lists cc as "Creative Commons license family" [1]. A family name does not say which Creative Commons license applies (the versions differ in conditions such as non-commercial and no-derivatives), so the rules read it as "no statement" until a specific license is found. The table records regional ports of Creative Commons licenses as absent; they would go to manual review.

Model licenses on datasets. The platform's list includes identifiers such as llama2, llama3.1 and gemma [1]. These name licenses written for model weights. When they label a dataset the rules mark the dataset as having a custom license, provisionally restricted, and ask for human review; the license texts were not re-read for this report, and the table notes that platform identifiers were not individually checked against license texts.

Software and documentation licenses on data. GPL, LGPL, AGPL, MPL, EPL, EUPL and GFDL were written for software or documentation, and obligations such as providing source code do not map cleanly onto datasets. The table sends them to manual review rather than guessing.

Share-alike and training. CC BY-SA 4.0 conditions apply to "Adapted Material", defined as material "derived from or based upon" the licensed material, and require that the adapter's license be a Creative Commons license "with the same License Elements, this version or later" or a compatible one [2]. In the passages read for this report we did not find the text addressing whether a model trained on such data is Adapted Material. The map records share-alike as a condition and keeps the status "permissive with conditions"; how the condition applies to training is not decided here.

Data-use agreements. C-UDA-1.0 is classified restricted because its basis in the map records a computational-use limitation; O-UDA-1.0 is classified permissive. Hugging Face lists c-uda among its identifiers [1].

6. Maintenance and correction

The table is a versioned file. A new identifier encountered by the pipeline goes to a human, and the decision is added to the table with a basis and a source URL. Changes are made by editing schema/license-map.json, raising its version and date, and re-running the adjudication test cases (the case results are reported with each build). A correction can be proposed by pointing to the license text and the entry concerned. Three platform values (cc, llama3.1, c-uda) were noted in the table as not verified to be official platform values; the Hugging Face documentation read for this report lists all three [1], so the notes in the table on their verification status are out of date.

7. Limitations

1. The table records how the rules read identifiers. It is not a legal analysis, and the project's files record no external legal review.
2. The table covers 84 identifiers. It omits regional ports of Creative Commons licenses, and it does not attempt to cover the SPDX License List [3] as a whole.
3. The frequencies describe 43 published cards compiled with model assistance and 58 draft cards, not the use of identifiers across all datasets.
4. The model-license entries and the copyleft entries are provisional.
5. The numbers of entries and flags are read from the file at the stated version; the file may have changed since.

8. Machine-readable table

schema/license-map.json in the project repository (version 1.1, 84 entries). Each entry has id, aliases, class, license_conditions, manual_review, basis (Chinese and English), url, and optionally status_if_used, note and custom_license. The same file is published in the public Mdexa database repository under schema/license-map.json.

How to cite

Mdexa Research. A Classification of License Identifiers Observed on Biomedical Datasets. Technical report, not peer reviewed. 2026-11-13. Data version: license map 1.1 (sha256 prefix 9d43d1f41fd2); 43 first-release published cards (frozen; public fingerprint ea894e8472bc, releases/first-release/ in the public repository; identical to the internal archive 9ff1d63a933d except change-log wording); draft cards counted on the stated date.