WGS of low-count and high-count MBL

Data access policy and application process to DAC-CG-KI

ACCESS TO DATA KI is the independent Controller of the collected Personal Data included in the Dataset which has been collected in accordance with applicable Data Protection Laws, from human subjects under a protocol approved by the Swedish Ethical Review Authority, and when required, with the informed consent of the Data Subjects. Recipient will obtain access to the Dataset via EGA, subject to KI’s Data Access Committee prior written approval. Upon approval of the Recipient’s application, an EGA account will be generated for the EGA registered user account holder to allow the download of the Dataset from the EGA. Recipient has determined the purposes and the means of processing the Dataset with regards to the Project and is therefore, an independent Controller. Recipient shall be the independent Controller of all processing activities that Recipient performs on the Dataset and Recipient understands and agrees that Recipient is solely responsible for ensuring compliance with Data Protection Laws. The Parties acknowledge that KI has no responsibility regarding the processing of the Dataset performed by the Recipient. Recipient shall use the Dataset in compliance with all applicable legislation, rules, regulations, guidelines and ethical requirements, as well as any constraints set forth by the Ethical Review Boards, applicable to the Research and the handling and protection of the information in the Dataset. If the Recipient is located outside of the EU/EES, the SCC in the submitted application shall be executed by the Parties to ensure appropriate safeguards for the transfer, and they will constitute an integral part of this Agreement. PERMITTED USE Recipient agrees to only use the Dataset for the purposes set out in this Agreement (Specified project plan in application) for which Recipient has obtained ethical approval as specified in the submitted application, and to otherwise not use or disclose the Dataset, in whole or in part, or any material derived from the Dataset, unless required by applicable law. Recipient warrants and represents that the Dataset shall not be used for any for-profit or Commercial Purposes. Recipient shall ensure that Authorized Users comply with the terms of this Agreement. KI shall be free, in its sole discretion, to distribute the Dataset, in whole or in part, to others and to use it for its own purposes. PROCESSORS As independent Controller of the Personal Data included in the Dataset, it is Recipient’s responsibility to ensure that such Personal Data is only transferred to processors subject to the provisions in Data Protection Laws. DATA PROTECTION The Recipient shall keep any information included in the Dataset securely safeguarded, encrypted and appropriately protected from unauthorized access, use and theft. Recipient shall observe the requirements and implement any necessary technical and organizational measures to ensure compliance with Data Protection Laws. Recipient shall notify KI of any errors detected in the Personal Data without undue delay. The EGA account generated for the Recipient account holder and login details must be securely safeguarded. Sharing login details will be treated as a breach of security and could result in the account being blocked. Recipient shall refrain from analyzing and/or using Personal Data in a way that has the potential to (i) lead to the re-identification of any data subject, (ii) compromise the anonymity of a Data Subject in any way, or where applicable (iii) result in use of Personal Data outside the strict scope of any Data Subject’s consent. For the avoidance of doubt, Recipient shall under no circumstance use the information included in the Dataset to identify or contact Data Subjects. Any Personal Data Breach that Recipient becomes aware of, such as unauthorized access to, use or disclosure of information in the Dataset, shall be reported to KI promptly and in any event within thirty (30) hours of discovery. Recipient shall document any Personal Data Breach, including related facts, its effects and the remedial actions taken. The Recipient agree to provide reasonable assistance as is necessary to KI to meet obligations placed upon them as controllers under Data Protection Laws in an expeditious and compliant manner, including but not limited to obligations relating to the handling of Personal Data Breaches and Data Subjects exercising their rights. If requested, the Recipient will allow data security and management documentation to be inspected to verify that it is complying with the terms of this Agreement. INTELLECTUAL PROPERTY KI retains title to any information and data (such as Personal Data) included in the Dataset. Unless explicitly stated otherwise, nothing herein shall be deemed to constitute the grant of any license under any intellectual property rights. The Recipient agrees not to make intellectual property claims on the Dataset and not to use intellectual property protection in ways that would prevent or block access to, or use of, any element of the Dataset, or conclusion drawn directly from these Dataset. If KI and Recipient are collaborating for the performance of the Project, any rights and title to any Results and/or intellectual property rights generated under the Project shall be settled in a separate research collaboration agreement. Recipient shall grant KI a royalty-free, non-exclusive, non-commercial license to its Results generated from the use of the Dataset for further academic research and educational purposes. PUBLICATIONS All publications using the Dataset, shall acknowledge KI including reference to the Dataset(s) used as agreed upon in contract. The Recipient agrees to follow the Toronto Statement regarding pre-publication data sharing. Recipient shall respect the moratorium period required for KI Principal Investigator to publish the first peer-reviewed report describing and analyzing the Dataset and shall accurately and completely cite the source. In accordance with scientific custom, the contribution of KI and its researchers shall be expressly noted in all written or oral public disclosures, by co-authorship or acknowledgement as appropriate, always in compliance with recognized standards concerning publication and authorship, including the most recent “Recommendations for the Conduct, Reporting, Editing and Publications of Scholarly Work in Medical Journals” developed by the International Committee of Medical Journal Editors (ICMJE). Recipient shall provide KI and the Principal Investigator with references to all forms of publications (including working papers, and thesis) based on the Dataset. This information will be published on KI’s bibliography database. TRANSFER OF PERSONAL DATA TO A THIRD PARTY Recipient shall not transfer the Dataset to another party unless with the prior written consent of KI. Should the Recipient wish to share the Dataset with an external collaborator, the external collaborator must complete a separate application for access to the Dataset through EGA. Recipient shall ensure that any such transfer of the Dataset, in whole or in part, including to any recipient located in a country outside the EU/EEA (“Third Country”), is performed in accordance with Data Protection Laws. DATA TRANSFER COSTS KI shall provide the Dataset free of charge. CONFIDENTIALITY Recipient shall ensure that confidentiality, to the full extent permitted by applicable law, applies to the Dataset and that access to the Dataset is strictly limited to the personnel (“Authorized Users”) listed in application. Recipient shall ensure that all Authorized Users (i) are informed of the confidential nature of the Dataset, (ii) have received appropriate training of their responsibilities and (iii) have executed written confidentiality agreements or are under an appropriate statutory obligation of confidentiality. The Recipient shall ensure that such confidentiality obligations survive the termination of their personnel arrangement. The Recipient will notify KI within 30 days of any changes or departures of Authorized Users. COMPLIANCE WITH RULES AND REGULATIONS Recipient shall use the Dataset in compliance with all applicable legislation, rules, regulations, guidelines and ethical requirements, as well as any constraints set forth by Institutional Review Boards, applicable to the research described in the submitted application and the handling and protection of the information in the Dataset. LIMITATION OF LIABILITY The Dataset is provided without warranties, expressed or implied. KI makes no representations a) as to the accuracy, quality or comprehensiveness of the Dataset; b) that the Project will lead to any expected results or c) that the use thereof shall not infringe any proprietary rights of third parties. Notwithstanding anything else written in this Agreement KI’s contractual liability shall not include liability for indirect damages, special damages or consequential damages, provided that such damages did not arise from gross negligence or willful misconduct. INDEMNITY In no event shall KI be liable for any use by Recipient of the Dataset or any loss, claim, damage or liability which may arise from or in connection with this Agreement or the use, handling further analysis, interpretation or storage of the Dataset. Recipient shall indemnify and hold harmless KI and any of its employees from and against any loss, claim, damage or liability incurred by KI as a result of any acts or omissions of Recipient in connection with the Project or the use of the Dataset under this Agreement. TERM AND TERMINATION This Agreement shall enter into force on the date of the last signature by the Parties. The Recipient will notify KI as soon as it becomes aware of a breach of the terms or conditions of this Agreement. In the event that Recipient is in breach of its obligations under this Agreement, KI may terminate this Agreement with immediate effect by written notice to the Recipient and may suspend the transfer and require Recipient to immediately delete or destroy the Dataset. The Parties agree that the termination of this Agreement at any time, in any circumstances for whatever reason, does not exempt them from the obligations and conditions under this Agreement in regard to the processing of any personal data transferred. Notwithstanding anything to the contrary contained herein, Recipient shall, delete or destroy the Dataset, including copies and backup copies, when it is no longer necessary to for the Project, unless obliged to retain the Dataset in accordance with applicable laws.