Pediatric Patient-Derived-Xenograft development in MAPPYACTS – international pediatric cancer precision medicine trial in relapsed and refractory tumors

Data Access Policy for “Pediatric Patient-Derived-Xenograft development in MAPPYACTS – international pediatric cancer precision medicine trial in relapsed and refractory tumors” data

Data Access Policy for “Pediatric Patient-Derived-Xenograft development in MAPPYACTS – international pediatric cancer precision medicine trial in relapsed and refractory tumors ” data Preamble Gustave Roussy set up a Data Access Committee (DAC) to process requests for access to the “Pediatric Patient-Derived-Xenograft development in MAPPYACTS – international pediatric cancer precision medicine trial in relapsed and refractory tumors” data. Article I. Data Access Committee Article I.1 Composition Gustave Roussy's DAC is composed of Birgit Geoerger, Gilles Vassal and Gudrun Schleiermacher. Article I.1 Missions Gustave Roussy's DAC is responsible for authorizing access to the data. Article II. Request for access to data Article II.1 Composition of the application file The data access request requires: - A summary of the study (synopsis template on github) : it can be very light: we just need to know the general question that is going to be addressed; - The CNIL declaration (on github) : we can take care of the submission part to the CNIL, once we receive it; - The standard contractual clauses signed (on github) if your country is located outside of the European Community (check if your country is concerned : https://www.cnil.fr/en/data-protection-around-the-world) - The opinion issued by an Institution Review Board / or ethical committee that evaluated the project and the composition of the committee(s), if any; - The confidentiality form (on github); - The documentation necessary to demonstrate compliance with all its data protection and security obligations (a security charter); - This data access policy signed Article II.2 Application procedures The request for access to the data is free. It is done by mail to the following addresses Birgit.geoerger@gustaveroussy.fr Gilles.vassal@gustaveroussy.fr Article II.3. Examination of applications Following the filing of the file with the DAC, the latter: - verify its good orientation and completeness. Otherwise, the DAC will contact the requester for further information; - instruct the request for access to the data within one month after receiving the complete file. This time is given as an indication. Article III. Conditions of use of the data The applicants undertake to respect all the following measures and to have them respected by their staff as well as any other person(s) assisting them with the use of the data: - To collect only data adequate, relevant, limited and strictly necessary to the specific treatment that it with these data; - Do not use the data to which they can access for purposes other than those indicated in the application file; - Disclose this data only to persons duly authorized by reason of their duties and who have been indicated in the data access request file; - Do not make any copy of this data except that it is necessary for the execution of their research; - Take all necessary measures to avoid misuse or fraudulent use of this data; - Ensure that only secure means of communication will be used to transfer this data; - At the end of the research project, to fully restore the data, computer files and any information related to these data. When this task falls within its remit, the applicants undertake to ensure that the persons from whom they collect and / or use the data have been previously informed of the specific treatment that they are carrying out with their data. Article IV. Notification of data breach As soon as it becomes aware of this and within a maximum of twenty-four (24) hours, the requester notifies the DAC of any data breach. The requester provides to the DAC at the time of notification of the incident, or if this is not reasonably possible as soon as possible after the notification of the data breach, the following information regarding their violation: 1) The nature of the data breach; 2) The estimated number of people involved; 3) Categories of the person(s) involved; 4) The categories of Data concerned; 5) The estimated number of Data violated; Measures taken to remedy the data breach, including, measures to limit adverse effects and potential risks. The applicants shall as far as possible assist the DAC in reporting the data breach to the relevant control authorization and / or to the person(s) involved in the data breach. Article V. Data destruction At the end of the search, the applicants undertake, after having made sure of the terms relating to reversibility: - Destroy all data - Return all data to the DAC - Return the data to the subcontractor designated by the DAC The return must be accompanied by the destruction of all data (including copies) in the information systems of the applicant and their collaborators. First and last Name : Facility attached to : Date and place : Signature preceded by the mention ‘I pledge to respect this Data Access Policy or will be subject to legal penalties’