EDIT: I originally tried to make the context as brief as possible, but I may have overdone it.

Context

I'm starting to put some data analysis I'm asked to do on Github, and licensing all my work (mostly R scripts and markdown files displaying statistics, graphs and brief result descriptions). These are mostly medical and health research projects by graduate students. Faculty there usually ask for help in statistics/design and suggest their students do the same. Since I'm new, most of them are coming to me. Although I don't think it's relevant in this question, I have recently been offered a part-time position there for this exact purpose.

Reasons

The main reason for this is to provide the user student an always up to date version of the current work in progress. If something is quick to fix, say in a graph, they have an instant updated version of the current report I'm writing (usually in markdown).

I also like the transparency I offer to the researchers that ask for my help when I show the development process, what issues I have identified and the overall organization of my work.

Since most of them are not that tech-savy, I prepare the repo with plenty of README.md and other markdown files so they visualize the results and get relevant files without the need to create a github account. They usually report issues to me by email, and I open and close GH issues myself based on their feedback.

Perceived problem

It just hit me that, while my own work is my own to license the way I want, the dataset is not. I didn't participate in the collection, or curation of it. The first step I take before pushing anything to the public repository is to anonymize the dataset.

I usually show the users students the repositories of previous projects, and indicate they'll have such access to their results in a similar fashion. So far, no one has complained about their data being online. One of those projects I show is from a student of an IRB member.

Questions

• Should I ask each user if they want me to remove the datasets from their repository?
• EDIT: would it suffice to put a warning on the repository that the dataset is not licensed the same way the code, graphs and other contents therein available?
• Should I remove all such datasets regardless? Why or Why not?
• Is there something else I might be missing about this scenario?