BCSA_Exome+SmartSeq3

Karolinska Institutet EGA Data Access Policy

DATA ACCESS AGREEMENT __________ This Data Access Agreement (the “Agreement”) has been entered into by (1) KAROLINSKA INSTITUTET, Department of …, org.nr 202100-2973, Nobels väg 5, 171 77, Stockholm, Sweden, (“KI”); and (2) XXZZYY, [address], (“XZY” or “Recipient”), hereinafter jointly referred to as “Parties” and separately as “Party”. WHEREAS A. KI, under the supervision of [insert name], the Principal Investigator, has collected research data, consisting of [specify sequence, array, phenotype, metagenomics data], including personal data, which has been deposited with the European Genome Phenome Archive (hereinafter the “EGA”), hereinafter the “Dataset”, as specified in Attachment 2. B. The Recipient is engaged in research regarding [specify field of research] and has requested to obtain access to the Dataset for the purpose of research in the project identified in Attachment 1 (hereinafter the “Project”). C. KI wishes to grant access to the Dataset to Recipient for use in the Project, as specified in Attachment 1, subject to the terms and conditions agreed below. IT IS AGREED as follows: 1 DEFINITIONS Capitalized terms used, but not otherwise defined, in this Agreement shall have the meaning given to them in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”. Furthermore, the following definitions shall apply: Commercial Purpose shall mean the use, sale, lease, license, or other transfer of the Results, the data or the Dataset to a for-profit organization. Commercial Purposes shall also include uses of the data or the Dataset by any organization, including Recipient, to perform contract research, for screening, to produce or manufacture products for general sale, or to conduct research activities that result in any sale, lease, license, or transfer of the data or the Dataset to a for-profit organization. Data Protection Laws means GDPR and all other applicable local data protection or similar laws, regulations, decrees, decisions and guidelines. Dataset means the set of data incorporating research data, including Personal Data, specified in Attachment 2, created by KI and made available to the Recipient through EGA managed access for the purpose of conducting the Project. EGA means the European Genome-phenome Archive for permanent archiving and sharing of personally identifiable genetic, phenotypic, and clinical data generated for the purposes of biomedical research projects or in the context of research-focused healthcare systems. Principal Investigator means the researcher responsible for the development of the Dataset at KI. Project means the research study for which the Recipient has requested access to the Dataset. A description of the Project is set out in Attachment 1. Results means any ideas, inventions, discoveries, know-how, data, documentation, reports, secondary data, writings, designs, computer software, processes, principles, methods, techniques and other information, recorded in any form, that are generated by the Recipient in connection with the use of the Dataset (whether solely or jointly with others), and any patent, trade secret, copyright or other intellectual property rights pertaining to any of the foregoing. Results shall not contain the Dataset. Recipient Investigator(s): Recipient’s scientific investigator (s) identified in Attachment 1. SCC means the European Commission Standard Contractual Clauses for the Transfer of Personal Data from the Community to Third Countries (Controller to Controller Transfers), pursuant to Regulation (EU) 2016/679, which will constitute an integral part of this Agreement where applicable. 2 ACCESS TO DATA KI is the independent Controller of the collected Personal Data included in the Dataset which has been collected in accordance with applicable Data Protection Laws, from human subjects under a protocol approved by the Swedish Ethical Review Authority, and when required, with the informed consent of the Data Subjects. Recipient will obtain access to the Dataset via EGA, subject to KI’s Data Access Committee prior written approval. Upon approval of the Recipient’s application, an EGA account will be generated for the EGA registered user account holder to allow the download of the Dataset from the EGA. Recipient has determined the purposes and the means of processing the Dataset with regards to the Project and is therefore, an independent Controller. Recipient shall be the independent Controller of all processing activities that Recipient performs on the Dataset and Recipient understands and agrees that Recipient is solely responsible for ensuring compliance with Data Protection Laws. The Parties acknowledge that KI has no responsibility regarding the processing of the Dataset performed by the Recipient. Recipient shall use the Dataset in compliance with all applicable legislation, rules, regulations, guidelines and ethical requirements, as well as any constraints set forth by the Ethical Review Boards, applicable to the Research and the handling and protection of the information in the Dataset. If the Recipient is located outside of the EU/EES, the SCC in Attachment 3 shall be executed by the Parties to ensure appropriate safeguards for the transfer, and they will constitute an integral part of this Agreement. 3 PERMITTED USE Recipient agrees to only use the Dataset for the purposes set out in this Agreement (Attachment 1) for which Recipient has obtained ethical approval as specified in Attachment 1, and to otherwise not use or disclose the Dataset, in whole or in part, or any material derived from the Dataset, unless required by applicable law. Recipient warrants and represents that the Dataset shall not be used for any for-profit or Commercial Purposes. Recipient shall ensure that Authorized Users comply with the terms of this Agreement. KI shall be free, in its sole discretion, to distribute the Dataset, in whole or in part, to others and to use it for its own purposes. PROCESSORS As independent Controller of the Personal Data included in the Dataset, it is Recipient’s responsibility to ensure that such Personal Data is only transferred to processors subject to the provisions in Data Protection Laws. 5 DATA PROTECTION The Recipient shall keep any information included in the Dataset securely safeguarded, encrypted and appropriately protected from unauthorized access, use and theft. Recipient shall observe the requirements and implement any necessary technical and organizational measures to ensure compliance with Data Protection Laws. Recipient shall notify KI of any errors detected in the Personal Data without undue delay. The EGA account generated for the Recipient account holder and login details must be securely safeguarded. Sharing login details will be treated as a breach of security and could result in the account being blocked. Recipient shall refrain from analyzing and/or using Personal Data in a way that has the potential to (i) lead to the re-identification of any data subject, (ii) compromise the anonymity of a Data Subject in any way, or where applicable (iii) result in use of Personal Data outside the strict scope of any Data Subject’s consent. For the avoidance of doubt, Recipient shall under no circumstance use the information included in the Dataset to identify or contact Data Subjects. Any Personal Data Breach that Recipient becomes aware of, such as unauthorized access to, use or disclosure of information in the Dataset, shall be reported to KI promptly and in any event within thirty (30) hours of discovery. Recipient shall document any Personal Data Breach, including related facts, its effects and the remedial actions taken. The Recipient agree to provide reasonable assistance as is necessary to KI to meet obligations placed upon them as controllers under Data Protection Laws in an expeditious and compliant manner, including but not limited to obligations relating to the handling of Personal Data Breaches and Data Subjects exercising their rights. If requested, the Recipient will allow data security and management documentation to be inspected to verify that it is complying with the terms of this Agreement. 6 INTELLECTUAL PROPERTY KI retains title to any information and data (such as Personal Data) included in the Dataset. Unless explicitly stated otherwise, nothing herein shall be deemed to constitute the grant of any license under any intellectual property rights. The Recipient agrees not to make intellectual property claims on the Dataset and not to use intellectual property protection in ways that would prevent or block access to, or use of, any element of the Dataset, or conclusion drawn directly from these Dataset. If KI and Recipient are collaborating for the performance of the Project, any rights and title to any Results and/or intellectual property rights generated under the Project shall be settled in a separate research collaboration agreement. Recipient shall grant KI a royalty-free, non-exclusive, non-commercial license to its Results generated from the use of the Dataset for further academic research and educational purposes. 7 PUBLICATIONS All publications using the Dataset, shall acknowledge KI including reference to the Dataset(s) used as further specified below. The Recipient agrees to follow the Toronto Statement regarding pre-publication data sharing. Recipient shall respect the moratorium period required for KI Principal Investigator to publish the first peer-reviewed report describing and analyzing the Dataset and shall accurately and completely cite the source. In accordance with scientific custom, the contribution of KI and its researchers shall be expressly noted in all written or oral public disclosures, by co-authorship or acknowledgement as appropriate, always in compliance with recognized standards concerning publication and authorship, including the most recent “Recommendations for the Conduct, Reporting, Editing and Publications of Scholarly Work in Medical Journals” developed by the International Committee of Medical Journal Editors (ICMJE). Recipient shall provide KI and the Principal Investigator with references to all forms of publications (including working papers, and thesis) based on the Dataset. This information will be published on KI’s bibliography database. [The following acknowledgement must be included in all publications using the Dataset: This Study uses data from …., supported by the Swedish Research Council (Dn xxxx)/other reference to be provided by KI on a case-by-case basis.] 8 TRANSFER OF PERSONAL DATA TO A THIRD PARTY Recipient shall not transfer the Dataset to another party unless with the prior written consent of KI. Should the Recipient wish to share the Dataset with an external collaborator, the external collaborator must complete a separate application for access to the Dataset through EGA. Recipient shall ensure that any such transfer of the Dataset, in whole or in part, including to any recipient located in a country outside the EU/EEA (“Third Country”), is performed in accordance with Data Protection Laws. 9 DATA TRANSFER COSTS KI shall provide the Dataset free of charge. 10 CONFIDENTIALITY Recipient shall ensure that confidentiality, to the full extent permitted by applicable law, applies to the Dataset and that access to the Dataset is strictly limited to the personnel (“Authorized Users”) listed in Attachment 2. Recipient shall ensure that all Authorized Users (i) are informed of the confidential nature of the Dataset, (ii) have received appropriate training of their responsibilities and (iii) have executed written confidentiality agreements or are under an appropriate statutory obligation of confidentiality. The Recipient shall ensure that such confidentiality obligations survive the termination of their personnel arrangement. The Recipient will notify KI within 30 days of any changes or departures of Authorized Users. 11 COMPLIANCE WITH RULES AND REGULATIONS Recipient shall use the Dataset in compliance with all applicable legislation, rules, regulations, guidelines and ethical requirements, as well as any constraints set forth by Institutional Review Boards, applicable to the research described in Attachment 1 and the handling and protection of the information in the Dataset. 12 LIMITATION OF LIABILITY The Dataset is provided without warranties, expressed or implied. KI makes no representations a) as to the accuracy, quality or comprehensiveness of the Dataset; b) that the Project will lead to any expected results or c) that the use thereof shall not infringe any proprietary rights of third parties. Notwithstanding anything else written in this Agreement KI’s contractual liability shall not include liability for indirect damages, special damages or consequential damages, provided that such damages did not arise from gross negligence or willful misconduct. 13 INDEMNITY In no event shall KI be liable for any use by Recipient of the Dataset or any loss, claim, damage or liability which may arise from or in connection with this Agreement or the use, handling further analysis, interpretation or storage of the Dataset. Recipient shall indemnify and hold harmless KI and any of its employees from and against any loss, claim, damage or liability incurred by KI as a result of any acts or omissions of Recipient in connection with the Project or the use of the Dataset under this Agreement. 14 TERM AND TERMINATION This Agreement shall enter into force on the date of the last signature by the Parties. The Recipient will notify KI as soon as it becomes aware of a breach of the terms or conditions of this Agreement. In the event that Recipient is in breach of its obligations under this Agreement, KI may terminate this Agreement with immediate effect by written notice to the Recipient and may suspend the transfer and require Recipient to immediately delete or destroy the Dataset. The Parties agree that the termination of this Agreement at any time, in any circumstances for whatever reason, does not exempt them from the obligations and conditions under this Agreement in regard to the processing of any personal data transferred. Notwithstanding anything to the contrary contained herein, Recipient shall, delete or destroy the Dataset, including copies and backup copies, when it is no longer necessary to for the Project, unless obliged to retain the Dataset in accordance with applicable laws. 15 NOTICES Formal notices to be given under this Agreement shall be in writing and be delivered to the person on the address stated below, unless the receiving Party has specifically notified the sending Party of another address for this purpose. The notice may be delivered personally, by mail or by e-mail but always with receipt acknowledgement. These persons shall be the Parties’ contacts for questions regarding this Agreement. KI Name and Position: insert Address: insert E-mail: insert RECIPIENT Name and Position: insert Address: insert E-mail: insert 16 ASSIGNMENT Recipient may not assign or sublicense its rights or obligations under this Agreement to any third party without the prior written consent of KI. 17 AMENDMENTS No provision of this Agreement may be amended, modified or otherwise changed, other than by an instrument in writing duly executed on behalf of the Parties. Recipient will notify KI in writing prior to any significant changes to the Project. The Recipient acknowledges and agrees that to the extent required, this Agreement shall be amended by KI to achieve compliance with future changes to Data Protection Laws. In the event that changes are required, KI will contact the Recipient to inform it of the changes and the Recipient may elect to accept the changes or terminate the Agreement. 18 APPLICABLE LAW AND DISPUTES This Agreement shall be governed by the laws of Sweden and any dispute arising out of or in connection with this Agreement, which cannot be solved amicably, shall be settled by the courts of Sweden with the District Court of Stockholm as the court of first instance. 19 SIGNATURES This Agreement has been drawn up in two (2) originals of which the parties have taken one (1) each. KAROLINSKA INSTITUTET Printed name: [insert] Title: Head of Department of [insert] Printed name: [insert] Title: [insert] Date: [insert] Printed name: [insert] Title: Principal Investigator Date: [insert] XXZZYY [RECIPIENT] Printed name: [insert] Title: [insert] Date: [insert] Printed name: [insert] Title: Recipient Investigator Date: [insert]