you're totally right on all these points: for the time being, i've only put out information that's okay being 'public', but i imagine when you do want to share a set with a small group (let's say your physicians), you'll want an additional layer of access control.