Last updated 10 August 2021
Document Code: LDP-FRM-002 Version 3.0
Note: For all EU/EEA Personal Data collected by Genuity Science, reference to “Genuity Science” below means Genuity Science (Ireland) Limited. Genuity Science (Ireland) Limited is the Data Controller of all Personal Data collected by Genuity Science (Ireland) Limited and/or its Affiliates in the EU/EEA.
This information is divided into the following 5 sections
WHAT DATA DOES GENUITY SCIENCE COLLECT?
When you volunteer to participate in one of our research studies, with your consent, the research team will collect the following data:
Only the information required to address the research question will be taken from your medical records.
The data we collect will never include your name, address, date of birth, or other information which directly identifies you.
During our research studies we will also collect a biological sample from you such as blood or saliva. In some studies, we may also request access to a small portion of a tissue sample which was previously obtained from you. We use techniques such as whole genome sequencing, which reads every letter of your DNA (i.e. your “genomic instructions”), to enable us to read your genomic data from these biological samples.
WHY DOES GENUITY SCIENCE COLLECT YOUR DATA?
Genuity Science collects your data in order to try to identify similarities across different diseases in order to maximise discoveries that could lead to drug discoveries and better use of existing drug treatments.
We combine your data with data from thousands of other participants (with similar diseases and without any diseases) in our database to study the similarities and differences in the data and how they relate to health. Researchers then look for patterns that may give clues about the causes of health conditions, or patterns that might help us to better understand a condition or find a new way to treat it.
WILL YOU GET FEEDBACK FROM GENUITY SCIENCE ON YOUR DATA?
With the exception of our Rare Disease Programme, all participants join Genuity Science’s studies on the explicit understanding (as described in the patient information leaflet and consent form) that there shall be no feedback of any individual information that maybe discovered about you from using your data.
You are entitled to a copy of any part or all of your personal data processed by Genuity Science upon request, which shall be provided to you in accordance with Data Protection Laws.
In order to request access to your data you will need to contact the study site/clinic where you signed up to our study, as Genuity Science does not know your identity.
WHO IS THE CONTROLLER OF YOUR DATA?
Genuity Science is the data controller of all de-identified or coded (pseudonymised) medical health, lifestyle and genomic data (“Coded Data”) collected as part of our studies.
The institution, where you participated in the study, is the data controller of any personal information pertaining to study participants that remains at the study site and the institution continues to be the data controller of all medical files.
WHO CAN ACCESS YOUR DATA?
Genuity Science controls all access to the Genuity Science database where your coded data is stored. Genuity Science’s researchers, Genuity Science’s commercial partners (such as pharmaceutical or biotech companies) and authorised research partners can access your coded data for commercial and academic research projects.
Other than Genuity Science, only our commercial partners and authorized research groups can access the study data as follows:
HOW DOES GENUITY SCIENCE KEEP YOUR DATA SAFE?
Keeping your data safe is a priority for Genuity Science. All samples and study information are assigned random study ID numbers at the clinic/study site in a process called pseudonymisation. This process is used to mask your identity and code your data.
We have a robust level of technical and organisational measures in place to protect your data from unlawful or unauthorised destruction, loss, change, disclosure, acquisition or access. We ensure that all personal data controlled by us is stored securely in Europe using the highest level of security measures.
Only your doctor, their research team or the Genuity Science study personnel at the research study site has access to directly identifiable personal data such as your name and date of birth. They keep that information so they can facilitate a request to withdraw from the study.
At Genuity Science, we never receive any directly identifiable personal data such as your name, date of birth or address. All your data in Genuity Science’s database is de-identified and coded. Genuity Science study monitors liaise with your doctor and the research team at the research study site to check that the study is being carried out correctly, adhering to the institution’s approved ethics terms and ensuring the correct consent is in place. The study monitors never remove any identifiable data such as your name and date of birth from the research clinic/ study site.
Our commercial partners and approved researchers only have restricted access to select de-identified datasets which contain only the information they need for their specific and approved research study. Furthermore, your data can only be read or analysed by these researchers on the execution of a legal agreement. These researchers are prohibited from attempting to identify an individual participant from the data in the database.
WILL YOUR DATA BE TRANSFERRED OUTSIDE OF THE EUROPEAN ECONOMIC AREA (EEA)?
Some of our commercial partners and authorised research groups may be located outside the EEA. These approved third parties can remotely access and read select de-identified datasets to address a specific research question but never download any data. This is called a data transfer, even though no data actually moves outside of our database.
We have technical and organisational measures in place to protect your personal de-identified data and ensure it is transferred in accordance with the requirements of the EU data protection law. This may involve the use of data transfer agreements in the form approved by the European Commission (known as standard contractual clauses) or the use of other mechanisms recognised by EU data protection laws as ensuring protection for personal data transferred outside the EEA.
We do not allow access to any data for marketing or insurance purposes.
HOW LONG DOES GENUITY SCIENCE KEEP YOUR DATA?
As science advances, we will continue to analyse the data in our database for many years to come. For this reason, your medical, lifestyle and biological data generated as part of the study will be retained for the duration of the scientific research, in accordance with relevant Data Protection Laws in Ireland and the European Union (“EU”), including the General Data Protection Regulation (“GDPR”), together referred to in this leaflet as “Irish Data Protection Laws”. This data will only be processed for the purposes outlined in the patient information leaflet you receive at the study site.
WHAT “LEGAL BASIS” UNDER EU DATA PROTECTION LAWS DOES GENUITY SCIENCE RELY ON TO COLLECT AND USE YOUR DATA?
In accordance with Irish Data Protection Laws, we shall only process, store and use your data in a manner that is consistent with the basis on which you joined Genuity Science’s research study as described in the information materials and consent form you receive at the research study site.
As the information or data that Genuity Science collects for this study relates to your health, it is known as “personal sensitive data” under Irish Data Protection Laws. In accordance with Irish Data Protection Laws, your explicit consent is the lawful basis on which Genuity Science will process your personal data in the first instance.
In the event that you exercise your right to withdraw your consent from this study, Genuity Science may need to continue to process your data on the basis of the legitimate interests of Genuity Science (and its commercial and academic research partners) in the pursuit of scientific research, as deletion of your data would seriously impair the purpose of the research. Further information on your right to withdraw is set out in WHAT HAPPENS TO YOUR DATA IF YOU WITHDRAW FROM A STUDY?
WHAT HAPPENS TO YOUR DATA IF YOU WITHDRAW FROM A STUDY?
You can withdraw from a Genuity Science study at any time. You will need to contact the clinic where you signed up to the study to exercise your right to withdraw, as Genuity Science does not know your identity and cannot correlate your name with the Coded Data which Genuity Science holds. However, please be aware that the timing of withdrawal from a Genuity Science study, and whether or not your data has been included in a “data freeze”, will affect whether or not Genuity Science needs to continue to process your data.
A “data freeze” means that all the data collected up to a certain point in time is effectively “frozen” to create a fixed point of reference for our research. Each time Genuity Science carries out a new data freeze, the previous one is archived.
In the event of any request by you to withdraw your consent, your Informed Consent Form will be retained at the clinic for legal, regulatory and audit purposes.
Withdrawal before your data has been included in a data freeze:
Withdrawal after your data has been included in a data freeze:
WHAT ARE YOUR RIGHTS UNDER IRISH DATA PROTECTION LAWS?
Right to Withdraw:
You can withdraw from a Genuity Science study at any time. You will need to contact the clinic where you signed up to the study to exercise your right to withdraw, as Genuity Science does not know your identity and cannot correlate your name with the Coded Data which Genuity Science holds. Please see section “WHAT HAPPENS TO YOUR DATA IF YOU WITHDRAW FROM A STUDY?” above for more detail.
Other Data Subject Rights:
All of your rights to manage the processing of your personal data under Irish Data Protection Laws can be exercised at any time by contacting the study clinic where you signed up to the Genuity Science study. As Genuity Science does not know your identity and cannot correlate your name with your Coded Data, the clinic will liaise with Genuity Science’s Data Protection Officer (“DPO”) on your behalf to ensure the continued protection of your identity and right to privacy.
Your rights under Irish Data Protection Laws to restrict and manage the processing of your personal data by Genuity Science in the context of this research study are given effect primarily through your ability to withdraw from this study as outlined in WHAT HAPPENS TO YOUR DATA IF YOU WITHDRAW FROM A STUDY?
Once your Coded Data has been included in the Genuity Science database, the right to be forgotten no longer applies where deletion of the Coded Data would render impossible or seriously impair scientific research. However, similar to the withdrawal process, if you exercise your right to be forgotten before your data is entered into a data freeze all your personal data and samples will be deleted or destroyed. Your Informed Consent Form will be retained for legal, regulatory and audit purposes.
Where your personal data is processed on the basis of the legitimate interests of Genuity Science (and its commercial and academic research partners), you have a right to object to such processing at any time. Your right to object to the processing of your personal data will be assessed by Genuity Science’s DPO on a case by case basis in accordance with Irish Data Protection Laws, having regard to your personal circumstances and factors such as the integrity of the scientific research.
You are entitled to a copy of any part or all of your personal data processed by Genuity Science upon request, which will be provided to you in accordance with Irish Data Protection Laws.
For the reasons mentioned above, in order to request a copy of or to correct errors in your personal data, you will need to contact the clinic where you signed up to our study who will liaise with Genuity Science on your behalf.
Genuity Science’s processing includes profiling of the data it collects. Genuity Science uses profiling to analyse the impact of a person’s lifestyle on health and applies this analysis across all the data it collects. However, Genuity Science does not make any automated decisions based on this profiling exercise.
All participants agree to join Genuity Science’s studies on the explicit understanding that there will be no feedback of any information that was discovered about you from the use or analysis of your personal data.
WHAT DO YOU DO IF YOU HAVE A QUERY OR COMPLAINT ABOUT HOW WE COLLECT AND USE YOUR DATA?
Please contact our Data Protection Officer (DPO) with any questions or concerns relating to Genuity Science’s approach to data protection that you may have. Please write to the DPO using the email address: dataprivacy@genuitysci.com or via the post: FAO The Data Protection Officer, Genuity Science, Building 4, Cherrywood Business Park Dublin D18 K7W4.
Participants in our studies have the right to contact Ireland’s data protection authority, the Data Protection Commission (DPC), if you have any concerns about Genuity Science’s use of personal data and/or Genuity Science’s approach to data protection.
WHAT IF GENUITY SCIENCE MAKES CHANGES TO THIS PRIVACY STATEMENT?
This Privacy Statement may change from time to time. We keep prior versions of our Privacy Statements in an archive and these are available on request.
