Last updated 23 May 2024
Document Code: LDP-FRM-002 Version 4.0
Genuity Science (Ireland) Limited (“Genuity Science”, “we”, “us” or “our”) is a privately-funded life sciences company, headquartered in Ireland, that carries out important research on the human genome to examine the relationship between genetics, health and disease. Genuity Science (Ireland) Limited is owned by HiberCell Inc., a US based biotech company.
Genuity Science conducts research studies by working closely with clinics, universities and commercial partners. To enable this research, Genuity Science is building a database of genomic and health related data that will be used, on a strictly controlled basis, by Genuity Science and appropriately authorised commercial partners and academic research groups.
Genuity Science is the data controller, responsible for the management and control of all EU Research Data stored by Genuity Science.
Genuity Science is deeply committed to the ethical and responsible stewardship and use of all research data in a safe and secure manner in compliance with all applicable laws, including the General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, and the Irish Health Research Regulations 2018.
This information provided below is divided into the following 6 sections:
WHAT DATA DOES GENUITY SCIENCE COLLECT?
When you volunteer to participate in one of our research studies, with your consent, the research team will collect the following data:
Only the information required to address the research question will be taken from your medical records.
The data we collect will never include your name, address, date of birth, or other information which directly identifies you.
During our research studies we will also collect a biological sample from you such as blood or saliva. We use techniques such as whole genome sequencing, which reads every letter of your DNA (i.e. your “genomic instructions”), to enable us to read your genomic data from these biological samples.
FOR WHAT PURPOSE DOES GENUITY SCIENCE COLLECT YOUR DATA?
Genuity Science collects your data for the purpose of scientific research to improve our understanding of health and disease. This type of research could lead to drug discoveries and better use of existing drug treatments.
We combine your data with data from thousands of other participants (some with similar diseases and some without any particular diseases) in our database to study the similarities and differences in the data and how they relate to health and disease. Researchers then look for patterns that may help understand the causes of health conditions, the reasons why some people develop certain conditions but others do not, why some people have more severe symptoms than others or patterns that might help to find a new way to treat them.
WILL YOU GET FEEDBACK FROM GENUITY SCIENCE ON YOUR DATA?
With the exception of the Rare Disease Programme, all participants join Genuity Science’s studies on the explicit understanding (as described in the patient information leaflet and consent form) that there shall be no feedback of any individual information that may be discovered about you from using your data.
You are entitled to a copy of any part or all of your personal data processed by Genuity Science upon request, which shall be provided to you in accordance with Data Protection Laws.
In order to request access to your data you will need to contact the study site/clinic where you signed up to our study, as Genuity Science does not know your identity.
WHERE IS YOUR DATA STORED?
All genomic and clinical data that Genuity Science collects for our research studies is stored and managed using an ISO-certified cloud-based storage provider in the EU. Back-ups are stored on a similarly secure infrastructure within the EU. The data centre facilities in the EU on which this data is stored are Tier 3+ and are operated by a recognised world leader in the field and comply with international standards.
WHO IS THE CONTROLLER OF YOUR DATA?
Genuity Science is the data controller of all de-identified or coded (pseudonymised) medical health, lifestyle and genomic data (“Coded Data”) collected as part of our studies.
The institution, where you participated in the study, is the data controller of any personal information pertaining to study participants that remains at the study site and the institution continues to be the data controller of all medical files.
WHO CAN ACCESS YOUR DATA?
Genuity Science controls all access to the Genuity Science database where your coded data is stored. Genuity Science’s researchers, Genuity Science’s commercial partners (such as pharmaceutical or biotech companies) and authorised research partners can access your coded data for commercial and academic research projects. These partners analyse the data through an access-controlled environment.
Other than Genuity Science, only our commercial partners and authorized research groups can access the study data as follows:
HOW DOES GENUITY SCIENCE KEEP YOUR DATA SAFE?
Keeping your data safe is a priority for Genuity Science. All biological samples and study information are assigned random study ID numbers at the clinic/study site in a process called pseudonymisation. This process is used to mask your identity and code your data.
We have a robust level of technical and organisational measures in place to protect your data from unlawful or unauthorised destruction, loss, change, disclosure, acquisition or access. We ensure that all personal data controlled by us is stored securely in Europe using high levels of security measures.
Only your doctor and their research team at your study site has access to directly identifiable personal data such as your name and date of birth. They keep that information so they can facilitate a request to withdraw from the study.
At Genuity Science, we never receive any directly identifiable personal data such as your name, date of birth or address. All your data in Genuity Science’s database is de-identified and coded.
Our commercial partners and approved researchers only have restricted access to select de-identified datasets which contain only the information they need for their research study. Furthermore, your data can only be read or analysed by these researchers on the execution of a legal agreement. They run their analyses within our platform. When they log in to our system, all database activity is logged and tracked. These researchers are prohibited from attempting to identify an individual participant from the data in the database. They are also prohibited from downloading your personal data from the Genuity Science database. They are only permitted to download and export summary analysis results.
WILL YOUR DATA BE TRANSFERRED OUTSIDE OF THE EUROPEAN ECONOMIC AREA (EEA)?
Some of our commercial partners and authorised research groups may be located outside the EEA. These approved third parties can remotely access and analyse select de-identified datasets to address a specific research question but never download any data. This is called a data transfer, even though no data actually moves outside of our database.
We have technical and organisational measures in place to protect your personal de-identified data and ensure it is transferred in accordance with the requirements of the EU data protection law. This may involve the use of data transfer agreements in the form approved by the European Commission (known as standard contractual clauses) or the use of other mechanisms recognised by EU data protection laws as ensuring protection for personal data transferred outside the EEA.
We do not allow access to any data for marketing or insurance purposes.
HOW LONG DOES GENUITY SCIENCE KEEP YOUR DATA?
As science advances, we will continue to analyse the data in our database for many years to come. For this reason, your de-identified medical, lifestyle and biological data generated as part of the study will be retained for the duration of the scientific research, in accordance with relevant Data Protection Laws in Ireland and the European Union (“EU”), including the General Data Protection Regulation (“GDPR”), the Irish Data Protection Act 2018, and the Irish Health Research Regulations 2018, together referred to in this statement as “Irish Data Protection Laws”. This data will only be processed for the purposes outlined in the patient information leaflet you received at the study site.
WHAT “LEGAL BASIS” UNDER EU DATA PROTECTION LAWS DOES GENUITY SCIENCE RELY ON TO COLLECT AND USE YOUR DATA?
In accordance with Irish Data Protection Laws, we shall only process, store and use your data in a manner that is consistent with the basis on which you joined Genuity Science’s research study as described in the information materials and consent form you received at the research study site.
As the information or data that Genuity Science collects for this study relates to your health, it is known as “personal sensitive data” under Irish Data Protection Laws. In accordance with Irish Data Protection Laws, your explicit consent is the lawful basis on which Genuity Science will process your personal data in the first instance.
In the event that you exercise your right to withdraw your consent, Genuity Science may need to continue to process your data on the basis of the legitimate interests of Genuity Science (and its commercial and academic research partners) in the pursuit of scientific research, as deletion of your data would seriously impair the purpose of the research. Further information on your right to withdraw is set out in WHAT HAPPENS TO YOUR DATA IF YOU WITHDRAW FROM A STUDY?
WHAT HAPPENS TO YOUR DATA IF YOU WITHDRAW FROM A STUDY?
You can withdraw from a Genuity Science study at any time. You will need to contact the clinic where you signed up to the study to exercise your right to withdraw, as Genuity Science does not know your identity and cannot correlate your name with the Coded Data which Genuity Science holds. However, please be aware that the timing of withdrawal from a Genuity Science study, and whether or not your data has been included in a “data freeze”, will affect whether or not Genuity Science needs to continue to process your data. You should be aware that your data cannot be withdrawn from published results or findings.
A “data freeze” means that all the data collected up to a certain point in time is effectively “frozen” to create a fixed point of reference for our research. Each time Genuity Science carries out a new data freeze, the previous one is archived.
In the event of any request by you to withdraw your consent, your Informed Consent Form will be stored by the clinic for legal, regulatory and audit purposes.
Withdrawal before your data has been included in a data freeze:
Withdrawal after your data has been included in a data freeze:
WHERE ARE YOUR BIOLOGICAL SAMPLES STORED?
All biological samples collected by Genuity Science are securely stored on a coded basis at a certified genomics laboratory at Cherrywood, Co. Dublin, Ireland. Our biobanking partner has no way of identifying any samples that it is storing on behalf of Genuity Science.
WHO CAN ACCESS YOUR BIOLOGICAL SAMPLES?
Genuity Science does not provide access to, or share your samples with, any third party (other than its biobanking partner where the samples are stored). In certain circumstances specialised sequencing or other services may be required which require small amounts of coded samples to be sent to certified laboratories located within or outside the European Economic Area or Great Britain in accordance with the relevant consents. Any data generated by these laboratories from the coded samples will be protected as required by relevant data protection laws in Ireland and the EU, including the GDPR.
WHAT ARE YOUR RIGHTS UNDER IRISH DATA PROTECTION LAWS?
Right to Withdraw:
You can withdraw your consent from a Genuity Science study at any time. You will need to contact the clinic where you signed up to the study to exercise your right to withdraw, as Genuity Science does not know your identity and cannot correlate your name with the Coded Data which Genuity Science holds. Please see section “WHAT HAPPENS TO YOUR DATA IF YOU WITHDRAW FROM A STUDY?” above for more detail.
Other Data Subject Rights:
All of your rights to manage the processing of your personal data under Irish Data Protection Laws can be exercised at any time by contacting the study clinic where you signed up to the Genuity Science study. As Genuity Science does not know your identity and cannot correlate your name with your Coded Data, the clinic will liaise with Genuity Science’s Data Protection Officer (“DPO”) on your behalf to ensure the continued protection of your identity and right to privacy.
Your rights under Irish Data Protection Laws to restrict and manage the processing of your personal data by Genuity Science in the context of this research study are given effect primarily through your ability to withdraw from this study as outlined in WHAT HAPPENS TO YOUR DATA IF YOU WITHDRAW FROM A STUDY?
Once your Coded Data has been included in the Genuity Science database, the right to be forgotten no longer applies where deletion of the Coded Data would render impossible or seriously impair scientific research. However, similar to the withdrawal process, if you exercise your right to be forgotten before your data is entered into a data freeze all your personal data and samples will be deleted or destroyed. Your Informed Consent Form will be retained for legal, regulatory and audit purposes.
Where your personal data is processed on the basis of the legitimate interests of Genuity Science (and its commercial and academic research partners), you have a right to object to such processing at any time. Your right to object to the processing of your personal data will be assessed by Genuity Science’s DPO on a case-by-case basis in accordance with Irish Data Protection Laws, having regard to your personal circumstances and factors such as the integrity of the scientific research.
You are entitled to a copy of any part or all of your personal data processed by Genuity Science upon request, which will be provided to you in accordance with Irish Data Protection Laws.
For the reasons mentioned above, in order to request a copy of or to correct errors in your personal data, you will need to contact the clinic where you signed up to our study who will liaise with Genuity Science on your behalf.
Genuity Science’s processing includes profiling of the data it collects. Genuity Science uses profiling to analyse the impact of a person’s lifestyle on health and applies this analysis across all the data it collects. However, Genuity Science does not make any automated decisions based on this profiling exercise.
All participants agree to join Genuity Science’s studies on the explicit understanding that there will be no feedback of any information that was discovered about you from the use or analysis of your personal data.
WHAT DO YOU DO IF YOU HAVE A QUERY OR COMPLAINT ABOUT HOW WE COLLECT AND USE YOUR DATA?
Please contact our Data Protection Officer (“DPO”) with any questions or concerns relating to Genuity Science’s approach to data protection that you may have. Please write to the DPO using the email address: dataprivacy@genuitysci.com or via the post: FAO The Data Protection Officer, Genuity Science (Ireland) Limited, Building 4, Cherrywood Business Park Dublin D18 K7W4, Ireland.
Participants in our studies have the right to contact Ireland’s data protection authority, the Data Protection Commission (DPC), if you have any concerns about Genuity Science’s use of personal data and/or Genuity Science’s approach to data protection.
WHAT IF GENUITY SCIENCE MAKES CHANGES TO THIS PRIVACY STATEMENT?
This Privacy Statement may change from time to time. We keep prior versions of our Privacy Statements in an archive and these are available on request.
