Participant Data Privacy Statement

Last updated June 2020

Note: For all EU/EEA Personal Data collected by Genuity Science, reference to “Genuity Science” below means Genuity Science (Ireland) Limited. Genuity Science (Ireland) Limited is the Data Controller of all Personal Data collected by Genuity Science (Ireland) Limited and/or its Affiliates in the EU/EEA.

This information is divided into the following 5 sections

  • Section A: Collecting and Using your Data
  • Section B: Securing your Data
  • Section C: Storing your Data
  • Section D: Your Rights under Data Protection Laws
  • Section E: Queries/Complaints

Section A: Collecting and Using your Data

WHAT DATA DOES GENUITY SCIENCE COLLECT?
When you volunteer to participate in one of our research studies, with your consent, the research team will collect the following data:

  • health and lifestyle information from you directly;
  • for some studies, study specific assessments such as spirometry; physical measurement such as height, weight and blood pressure; and
  • if you have a health condition, your medical team, with your permission, will provide us with information from your medical records.

 

Only the information required to address the research question will be taken from your medical records.

The data we collect will never include your name, address, date of birth, social security number or other demographic information which identifies you.

During our research studies we will also collect a biological sample from you such as blood or saliva. In some studies, we may also request access to a small portion of a tissue sample which was previously obtained from you. We use techniques such as whole genome sequencing, which reads every letter of your DNA (i.e. your “genomic instructions”), to enable us to read your genomic data from these biological samples.

WHY DOES GENUITY SCIENCE COLLECT YOUR DATA?
Genuity Science collects your data in order to try to identify similarities across different diseases in order to maximise discoveries that could lead to drug discoveries and better use of existing drug treatments.

We combine your data with data from thousands of other participants (with similar diseases and without any diseases) in our database to study the similarities and differences in the data and how they relate to health. Researchers then look for patterns that may give clues about the causes of health conditions, or patterns that might help us to better understand a condition or find a new way to treat it.

WILL YOU GET FEEDBACK FROM GENUITY SCIENCE ON YOUR DATA?
With the exception of our Rare Disease Programme, all participants join Genuity Science’s studies on the explicit understanding (as described in the patient information leaflet and consent form) that there shall be no feedback of any individual information that maybe discovered about you from using your data.

You are entitled to a copy of any part or all of your personal data processed by Genuity Science upon request, which shall be provided to you in accordance with Data Protection Laws.

In order to request access to your data you will need to contact the study site/clinic where you signed up to our study, as Genuity Science does not know your identity.


Section B: Securing your Data

WHO IS THE CONTROLLER OF YOUR DATA?
Genuity Science is the data controller of all de-identified or coded (pseudonymised) medical health, lifestyle and genomic data (“Coded Data”) collected as part of our studies.

The institution, where you participated in the study, is the data controller of any personal information pertaining to study participants that remains at the study site and the institution continues to be the data controller of all medical files.

WHO CAN ACCESS YOUR DATA?

Genuity Science controls all access to the Genuity Science database where your data is stored.
Other than Genuity Science, only your doctor and their affiliated institution, and our commercial partners and authorised research groups can access the Genuity Science database as follows:

  • Genuity Science may provide your Study Doctor, and the university (s)he is affiliated with, with a copy of your coded health and lifestyle data to use for their own teaching and research.
  • You can opt in to Genuity Science also providing a copy of your genomic data to your Study Doctor.
  • These groups can only use your data in a manner that is consistent with the basis on which you joined Genuity Science’s study as described in the Patient Information Leaflet and the Informed Consent Form that will be provided to you before you take part in the study . Your separate consent will be required for any other use.
  • Before Genuity Science’s commercial partners or authorised research groups can access the Genuity Science database to access your Coded Data, Genuity Science enters into legal agreements with these third parties, which strictly control their activities and prohibit them from ever attempting to re-identify a participant or from downloading your Coded Data from the Genuity Science database. These groups can only access select coded datasets that are needed for their specific study to read and analyse your Coded Data. They do not have access to your name, date of birth, or other similar identifiers that would allow anyone accessing the database to establish your identity. They can never download any participants’ personal data from the Genuity database.

 

HOW DOES GENUITY KEEP YOUR DATA SAFE?
Keeping your data safe is a priority for Genuity Science. Personally identifiable information, such as your name or date of birth, are never used to label your samples or clinical information. All samples and study information are assigned random study ID numbers at the clinic in a process called pseudonymisation. This process is used to mask your identity and code your data.

We have a robust level of technical and organisational measures in place to protect your data from unlawful or unauthorised destruction, loss, change, disclosure, acquisition or access. We ensure that all personal data controlled by us is stored securely in Europe using the highest level of security measures.
Only your doctor, their research team or the Genuity Science study personnel at the research study site has access to your traditional identifiable data such as your name and date of birth. They keep that information so they can facilitate a request to withdraw from the study. This traditional identifiable data never leaves the research study site.

At Genuity Science, we never receive any personal identifiable data such as your name, date of birth or address. All your data in Genuity Science’s database is de-identified and coded. Genuity Science study monitors liaise with your doctor and the research team at the research study site to check that the study is being carried out correctly, adhering to the institution’s approved ethics terms and ensuring the correct consent is in place. The study monitors never remove any traditional identifiable data such as your name and date of birth from the research study site.

Our commercial partners and approved researchers only have restricted access to select de-identified datasets which contain only the information they need for their specific and approved research study. Furthermore, your data can only be read or analysed by these researchers on the execution of a legal agreement. These researchers are prohibited from attempting to identify an individual participant from the data in the database.

WILL YOUR DATA BE TRANSFERRED OUTSIDE OF THE EUROPEAN ECONOMIC AREA (EEA)?
Some of our commercial partners and authorised research groups may be located outside the EEA. These approved third parties can remotely access and read select de-identified datasets to address a specific research question but never download any data. This is called a data transfer, even though no data actually moves outside of our database.
We have technical and organisational measures in place to protect your personal de-identified data and ensure it is transferred in accordance with the requirements of the EU data protection law. This may involve the use of data transfer agreements in the form approved by the European Commission (known as standard contractual clauses) or the use of other mechanisms recognised by EU data protection laws as ensuring protection for personal data transferred outside the EEA.

We do not allow access to any data for marketing or insurance purposes.


Section C: Sharing your Data

HOW LONG DOES GENUITY SCIENCE KEEP YOUR DATA?
As science advances, we will continue to analyse the data in our database for many years to come. For this reason, your medical, lifestyle and biological data generated as part of the study will be retained for the duration of the scientific research, in accordance with EU Data Protection Laws. This data will only be processed for the purposes outlined in the patient information leaflet you receive at the study site. It will not contain any information that traditionally would be used to identify you (such as name or date of birth).

WHAT “LEGAL BASIS” UNDER EU DATA PROTECTION LAWS DOES GENUITY SCIENCE RELY ON TO COLLECT AND USE YOUR DATA?
The information or data that Genuity Science collects for this study is known as “personal sensitive data” under EU Data Protection Laws as it relates to your health. Under EU Data Protection Laws, your explicit consent is the lawful basis on which Genuity Science can process your personal data in the first instance.

Once your biological sample has been converted into data, combined with your health and lifestyle data and entered into Genuity Science’s database, the lawful basis after this point is the legitimate interest of the scientific research being undertaken by Genuity Science (and our commercial partners), as deletion of your data after this point would seriously impair the purpose of the research.

In accordance with European and Irish Data Protection Laws, we shall only process, store and use your data in a manner that is consistent with the basis on which you joined Genuity Science’s research study as described in the information materials and consent form you receive at the research study site.

WHAT HAPPENS TO YOUR DATA IF YOU WITHDRAW FROM A STUDY?
If you wish to withdraw from a Genuity Science study and your biological sample has not been converted into data, we will destroy your biological sample and delete your medical and lifestyle data.

If you wish to withdraw from a Genuity Science study and your biological sample has been converted into data and included in Genuity Science’s database, then it will be necessary for Genuity Science to retain your Coded Data in our database and continue to process and analyse it in order to achieve the scientific purpose of the research. Your data cannot be withdrawn from published results or findings.

Genuity Science will destroy the code that links your Coded Data to your name so that it will no longer be possible to link your Coded Data held by Genuity Science back to your details held at the study site.

Genuity Science will also destroy any remaining biological sample so it can no longer be used.

Where Genuity Science continues to process your Coded Data, Genuity Science ensures that high levels of security measures are in place to protect all data in the database.


Section D: Your Rights under EU Data Protection Laws

WHAT ARE YOUR RIGHTS UNDER EU DATA PROTECTION LAWS?
Your rights to object and to restrict processing, are managed through your ability to withdraw from a Genuity Science study as outlined above.

The right to be forgotten does not apply in scientific research under EU Data Protection Laws.

You are entitled to a copy of any part or all of your personal data processed by Genuity Science upon request, which shall be provided to you in accordance with Data Protection Law.

In order to request access to, or correct errors in, your personal data, you will need to contact the study site/clinic where you signed up to our study, as Genuity Science does not know your identity.

Genuity Science’s processing includes profiling of the data it collects. Data profiling is a common practice widely used to understand personal preferences or in this instance, to understand certain personal aspects concerning participants’ health. Genuity Science uses profiling to analyse the impact of a person’s lifestyle on health and applies this analysis across all data collected. However, Genuity Science does not make any automated decisions based on this profiling exercise.


Section E: Queries / Complaints

WHAT DO YOU DO IF YOU HAVE A QUERY OR COMPLAINT ABOUT HOW WE COLLECT AND USE YOUR DATA?
Please contact our Data Protection Officer (DPO) with any questions or concerns relating to Genuity Science’s approach to data protection that you may have. Please write to the DPO using the email address: dataprivacy@genuitysci.com or via the post: FAO The Data Protection Officer, Genuity Science, Building 4, Cherrywood Business Park Dublin D18 K7W4.

Participants in our studies have the right to contact Ireland’s data protection authority, the Data Protection Commission (DPC), if you have any concerns about Genuity Science’s use of personal data and/or Genuity Science’s approach to data protection.

WHAT IF GENUITY SCIENCE MAKES CHANGES TO THIS PRIVACY STATEMENT?
This Privacy Statement may change from time to time. We keep prior versions of our Privacy Statements in an archive and these are available on request.