postQC Genotypes

Data Access policy for data associated with the publication "Human leukocyte antigen alleles associate with COVID-19 vaccine immunogenicity and risk of breakthrough infection"

DATA SHARING AGREEMENT (PSEUDONYMISED DATASET) between THE CHANCELLOR, MASTERS AND SCHOLARS OF THE UNIVERSITY OF OXFORD, whose administrative office is at University Offices, Wellington Square, Oxford OX1 2JD (the “Provider Institution”) and [insert Recipient Institution’s legal name], whose administrative office is at [insert Recipient Institution’s legal address] (“Recipient Institution”) hereinafter referred to as “the Parties” and each of them being “a Party” BACKGROUND The Recipient Institution is conducting a research project entitled “​Insert title of research project​” as described in more detail at Schedule 1 (the “Approved Research”) under the direction of ​Insert name of Principal Investigator​ (“the Recipient Scientist”) and wishes to access and use the data specified in Schedule 2 (the “Data”) for the purpose of the Approved Research. The Provider Institution is willing to supply the Data to the Recipient Institution and the Recipient Institution is willing to receive the Data in accordance with the terms and conditions contained within this agreement (the “Agreement”). TERMS AND CONDITIONS It is hereby agreed as follows: In this Agreement: the term “Approved Research” includes the publication (if any) of the results of the Approved Research by the Recipient Institution in accordance with clause 10; the terms “personal data”, “controller”, “processes”, “processing” and “processed” shall have the meanings given in the Data Protection Laws; “Data Protection Laws” means the Data Protection Act 2018 as amended from time to time and any successor legislation in the UK, and (for so long as and to the extent that the law of the European Union has legal effect in the UK) the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and any other directly applicable European Union regulation relating to data protection and privacy. In consideration of the obligations accepted by the Recipient Institution under this Agreement, the Provider Institution grants to the Recipient Institution for the duration of this Agreement a non-exclusive, personal and non-transferable licence to use the Data for the Approved Research. The Recipient Institution undertakes to the Provider Institution: to use the Data solely for the Approved Research; to restrict access to the Data to the Recipient Scientist and those staff and students comprising the Recipient Scientist’s research team, and to ensure that those staff and students are aware of and comply with the terms of this Agreement; to keep the Data confidential and not sub-license, transfer, disclose or otherwise make available the Data in whole or part to any third party except as permitted by this Agreement, without specific prior written consent from the Provider Institution; to keep the Data secure by implementing organisational and technological measures appropriate to the nature and sensitivity of the data to prevent the unauthorised or accidental access, use or disclosure of the Data, including (without limitation) the measures set out in clause 4; to notify the Provider Institution as soon as reasonably practicable after becoming aware of any unauthorised or accidental access, use or disclosure of the Data, and to co-operate with any investigation made by the Provider Institution in connection with the unauthorised or accidental access, use or disclosure of the Data; not attempt to re-identify any individual from the Data or communicate with any individual re-identified from the Data, nor to link or attempt to link the Data to other data or information except as described in the Approved Research or with specific prior written consent from the Provider Institution; to process the Data in accordance with all applicable laws and regulations and with all applicable approvals in place; to delete all copies of the Data from its hard drives and movable media and destroy all physical copies of the Data as soon as reasonably practicable on completion of the Approved Research or on termination of this Agreement (if earlier) except to the extent the Recipient Institution is required by law to store the Data. This obligation does not extend to automatically generated computer back-up or archival copies generated in the ordinary course of the Recipient Institution’s information systems procedures, provided that the Recipient Institution makes no further use of those copies. In particular (and without limiting the generality of the preceding wording) the Recipient Institution shall not make physical or electronic copies of the Data except to the extent reasonably necessary for the Approved Research and shall ensure that any copy of the Data stored on movable media (including laptops) is password-protected and fully encrypted and that any copy of the Data stored on networked or non-networked hard drives is properly protected with firewall and controlled access permissions. The Recipient Institution shall keep a record of where each copy of the Data is stored and shall provide the Provider Institution with a copy of this record on request. The Data is supplied by the Provider Institution in pseudonymised form without the pseudonymisation key or other means for the Recipient Institution to re-identify individuals from the Data. The Parties anticipate that the Data is likely to be personal data in respect of the Provider Institution’s processing but not likely to be personal data in respect of the Recipient Institution’s processing, but that this is a question of fact determined by the nature of the Data, the arrangements between the Parties, and any other means available to the Recipient Institution (whether publicly available or otherwise) to re-identify individuals from the Data. In the event that the Data is or becomes personal data when held or processed by the Recipient Institution, the Parties agree that: each of them shall be a controller in respect of its own processing of the Data, and shall be solely responsible and liable for its own processing of the Data including (without limitation) the lawful basis for that processing and ensuring that the Data is processed in compliance with the Data Protection Laws; however if the Parties are deemed to be joint controllers in relation to the Data, the Parties shall be jointly responsible and liable for the processing of the Data in connection with this Agreement and shall co-operate to determine their respective responsibilities for compliance with their obligations and duties under the Data Protection Laws, including documenting details of this arrangement to demonstrate compliance with Article 26 of the GDPR. Except to the extent prohibited by law, the Recipient Institution assumes all direct liability for damages which may arise from its receipt, use, storage or disposal of the Data. The Provider Institution will not be liable to the Recipient Institution for any use made of the Data, including any loss, claim or demand [made by the Recipient Institution or] made against the Recipient Institution by a third party, due to or arising from the use, storage or disposal of the Data by the Recipient Institution, except to the extent permitted by law when caused by the gross negligence or wilful misconduct of the Provider Institution. The Provider Institution makes no representation and gives no warranty of any kind, either express or implied, including but not limited to warranties of accuracy or fitness for a particular purpose, or that the use of the Data will not infringe any patent, copyright, trademark or other proprietary rights. Trial data is often contributed by third parties and cannot be guaranteed to be free from errors, omissions or inaccuracies, accordingly the Provider Institution will not be liable to the Recipient Institution for any loss arising from any reliance placed on the Data by the Recipient Institution. Nothing in this Agreement limits or excludes either party’s liability for (a) death or personal injury resulting from negligence; or (b) any fraud or for any sort of other liability which, by law, cannot be limited or excluded. The liability of either Party for any breach of this Agreement, or arising in any other way out of the subject matter of this Agreement, will not extend to loss of business, or profit, or to any indirect or consequential damages or losses. The Data is provided and the Approved Research is undertaken in pursuit of the primary charitable objectives of the Parties; that is the advancement of education through research and teaching. The Provider Institution acknowledges that the results of the Approved Research shall belong to the Recipient Institution (except that the Provider Institution retains ownership of the Data to the extent incorporated or included within the results), and that the Recipient Institution may seek to publish the results of the Approved Research. The Recipient Institution shall procure that in relation to any publication reporting on the use of the Data, the Recipient Scientist acknowledges the Provider Institution as the source of the Data in the publication and acknowledges the funder that funded the collection and compilation of the Data, in the form specified in Schedule 3. The Recipient Institution shall provide a copy of such publication to the Provider Institution thirty (30) days in advance of submission for publication, to allow the Provider Institution (as sponsor of the original study under which the Data were collected) an opportunity to comment on the publication. The Provider Institution agrees not to disclose any results contained in such advance copy to any third party until published by the Recipient Institution. The Recipient Institution shall not publish any confidential or proprietary information belonging to the Provider Institution without its prior written consent, including the Data in whole or in part. Confidential and proprietary information shall be deemed to include information which was described as such at the point of disclosure and/or was marked as either “confidential” or “proprietary”. The confidentiality obligations in this clause shall not apply where the confidential or proprietary information: has become public knowledge, other than through an unauthorised disclosure by the Recipient Institution; was already known to the Recipient Institution, prior to disclosure by the Provider Institution; was disclosed to the Recipient Institution or the Recipient Scientist by a third party, whom to the Recipient Institution’s knowledge, was not under any obligation of confidence to the Provider Institution; was released from confidential status by written authorisation of the Provider Institution; or is required to be disclosed by law or by requirement of a regulatory body or court order. Nothing in this Agreement grants the Recipient Institution any rights over the Data or under any patents, nor any right to use, or permit the use of, any products or processes containing the Data for any profit-making or commercial purposes (“Commercial Use”). Should the Recipient Institution wish to make Commercial Use of the Data and should the Provider Institution be willing and able to grant a licence for such purposes, the Parties shall negotiate in good faith to agree an appropriate licence or revenue sharing agreement on fair and reasonable terms. Nothing in this Agreement shall prevent or impede the Provider Institution from being able to use the Data for any purpose, including but not limited to sharing and licensing of the Data to third parties, whether public, private or third sector, for any purpose. The rights and obligations of the Parties are personal and may not be assigned at any time without the prior written consent of the other Party which consent shall not be unreasonably withheld; provided that it shall be a requirement in all cases of assignation that the assignee undertakes to perform all outstanding obligations of the assignor as though the assignee had been an original party hereto. This Agreement shall be effective from ​the date of last signature of this Agreement​ and shall continue in force until ​completion of the Approved Research or the date on which this Agreement is terminated​. The Provider Institution may terminate this Agreement if the Recipient Institution is in breach of any of the terms of this Agreement and, where the breach is capable of remedy, the Recipient Institution has failed to remedy the same within twenty-eight (28) calendar days of service of a written notice from the Provider Institution specifying the breach and requiring it to be remedied. Any provision of this agreement that expressly or by implication is intended to come into or continue in force on or after termination of this Agreement, including the Recipient Institution’s obligations under sub-clause 3(f) and 3(h), shall remain in full force and effect. The Parties shall procure that in carrying out their obligations under this Agreement, they will comply with all applicable laws, regulations and statutes, including those relating to modern slavery and anti-bribery and the Data Protection Laws. Non-compliance with this clause by a Party shall not be sufficient justification for another Party not to comply with its obligations under this Agreement. A person who is not a party to this Agreement shall not have any rights under or in connection with it. Notices The Provider Institution’s representative for the purpose of receiving notices shall until further notice be: ​​Director of Research Services, University Offices, Wellington Square, Oxford, OX1 2JD​ with a copy to ​​Julian Knight, julian@well.ox.ac.uk ​ The Recipient Institution’s representative for the purpose of receiving notices shall until further notice be: ​​Insert details ​ with a copy to: ​​Insert details ​ This Agreement constitutes the entire agreement between the parties in respect of its subject matter and no statements or representations made by any Party have been relied upon by the other in entering into this Agreement. This Agreement shall be governed and construed in accordance with the laws of ​England and Wales ​ and the Parties agree to the exclusive jurisdiction of the ​English Courts​. This Agreement may be executed in one (1) or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument. A signed copy of this Agreement delivered by e-mailed portable document format file or other means of electronic transmission shall be deemed to have the same legal effect as delivery of an original signed copy of this Agreement. IN WITNESS WHEREOF this Agreement is executed as follows: for and on behalf of ​THE CHANCELLOR, MASTERS AND SCHOLARS OF THE UNIVERSITY OF OXFORD​ Signed: Name: Title: Dated: for and on behalf of ​Insert full name of the Recipient Institution​ Signed: Name: Title: Dated: