“DECISION” European Research Project Privacy Policy
1. Introduction
The DECOMPENSATED CIRRHOSIS: IDENTIFICATION OF NEW COMBINATORIAL THERAPIES BASED ON SYSTEMS APPROACHES (DECISION) is a European Union-funded research project (Grant Agreement number 847949), under the Horizon 2020 topic “Systems approaches for the discovery of combinatorial therapies for complex disorders (SC1-BHC-02-2019, https://cordis.europa.eu/project/id/847949). DECISION gathers the expertise from 21 different European public and private partners in the field of liver research (hospitals, research foundations and institutes, patient and physician associations, and small-and-medium-sized enterprises, SMEs).
The project aims to identify and enable the development of tests and combinatorial therapies tailored to the needs of individual patients or identified groups of patients to reduce the risk of short-term death of patients with acute decompensation of cirrhosis. Readily available clinical data obtained from three large prospective clinical studies (CANONIC, PREDICT and ACLARA) will be used to identify new combinatorial therapies and to develop new tests. The efficacy of these tests and therapies and the response to them will be tested in a clinical trial (the “COMBAT Trial”), which will be carried out in a second phase of this Project.
The DECISION research project is committed to processing personal data in a secure, fair and transparent manner. Therefore, the partners of the Project process such data in accordance with the European Union’s General Data Protection Regulation 2016/679 of 27 April (hereinafter, the “GDPR“) and in compliance with the principles of the Declaration of Helsinki (2013), the principles of Good Clinical Practices and according to the indications of the study protocol approved by the entitled research ethics committees and the local regulatory authorities at each site/country. Likewise, the research project will be developed in accordance with the international, European, national and local regulations on biomedical research, clinical trials, and the use of human biological samples, i.e. the Universal Declaration on Bioethics and Human Rights, UNESCO (2015) and Convention on Biomedicine and Human Rights, Council of Europe (1997).
2. Definitions
Unless otherwise required by its context, these terms shall have the following meaning:
“We“, “Our” or “Us“: refers to the 21 European partners that are part of the DECISION research consortium.
“Data controller” or “Controller“: Shall have the same meaning as in the GDPR, i.e. the party who determines the purpose and means used for data processing.
“Data Processor” or “Processor“: Shall have the same meaning as in the GDPR, i.e. the party who carries out the processing of data on behalf of a Data Controller.
“Datahub”: The central web-based database where all Personal Data of the DECISION Project is securely stored and accessed by the different Partners for fulfilling the purposes of the Project.
“Joint controller”: Shall have the same meaning as in the GDPR, i.e. where two or more controllers jointly determine the purposes and means of processing.
“Personnel“: Shall refer to persons engaged by us, as employees or independent contractors, as appropriate to carry out the Project.
“You” or “Data Subjects“: Shall mean natural persons whose personal data is being processed by us, as participants of the ACLARA, CANONIC, PREDICT studies and the COMBAT Trial.
“Personal Data“: Shall have the same meaning as in the GDPR, i.e. any data associated with a natural person that allows him/her to be identified or that makes him/her identifiable.
“Pseudonymized Data”: The personal data that is processed in such a manner that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
“Processing” or “Data Processing”: Shall have the same meaning as in the GDPR, inter alia, the following constitute Data Processing: the collection, recording, use, storage, modification, adaptation, disclosure, transfer or transmission, structuring, use, combination and deletion or destruction of personal data.
“Project” or “DECISION Project” is the DECISION research project that aims to discover novel combinatorial therapies for patients with acute decompensation of cirrhosis using readily available clinical data.
3. Scope and Identification of Joint Controllers
3.1. Scope
This Privacy Policy has been designed to comply with the GDPR and is addressed to Data Subjects that are residents in the European Economic Area (EEA).
This Privacy Policy applies to personal data collected by us from any and all Data Subjects involved in the Project. We are committed to complying with applicable laws, regulations and guidelines in relation to the processing of the data We collect. It is essential that the Data Subject understands and is fully informed at the time of collection on the processing of their personal data for the purposes set out herein.
3.2. Identification of joint controllers
The following entities are joint controllers of your personal data:
| Organisation | Organization’s responsible | Country | Contact Details regarding Privacy matters |
| EUROPEAN FOUNDATION FOR THE STUDY OF CHRONIC LIVER FAILURE (EF Clif) – Coordinator- | Pierre-Emmanuel Rautou | Spain | dpo@efclif.com |
| Fundació Clinic per la Recerca Biomèdica (FCRB) | Joan Claria | Spain | protecciodades.recerca@clinic.cat |
| Institut National de la Santé et de la Recherche Médicale (INSERM) | Richard Moreau | France | dpo@inserm.fr |
| Westfälischen Wilhelms-Universität Münster (WWU) | Jonel Trebicka | Germany | datenschutz@uni-muenster.de |
| Universitaetsklinikum Aachen (UKA) | Christian Trautwein | Germany | jwillems@ukaachen.de; datenschutzbeauftragter@ukaachen.de |
| Navarrabiomed – Fundacion Miguel Servet (NBM-FMS) | David Gomez Cabrero | Spain | dpd-navarrabiomed@navarra.es |
| YH YOUHEALTH AB (YouHealth) | Jesper Tegner | Sweden | narsis.kiani@ki.se |
| Nordic Bioscience Compound Development A/S (NordicBio) | Morten Karsdal | Denmark | dpo@nordicbio.com |
| University of Bologna (UNIBO) | Paolo Caraceni | Italy | dpo@unibo.it |
| Servicio Madrileño de Salud (SERMAS) | Agustin Albillos | Spain | dpd.fibiohrc@salud.madrid.org |
| University College London (UCL) | Raj Mookerjee | United Kingdom | a.potts@ucl.ac.uk; s.crouch@ucl.ac.uk |
| Università degli studi di Torino (UNITO) | Carlo Alessandria | Italy | rpd@unito.it |
| Institut Catala de la Salut – Hospital Universitari Vall D`Hebron (ICS-HUVH) | Joan Genesca Ferrer | Spain | dpd@ticsalutsocial.cat |
| Assistance Publique-Hôpitaux de Paris (APHP) | Pierre-Emmanuel Rautou | France | protection.donnees.dsi@aphp.fr |
The parties are joint controllers of the Personal Data processed under this Project, on the basis that the Partners jointly decide on the purposes of the processing and the means to be used.
You may find more information about the objectives and the Partners that are involved in the DECISION Project by following this link: https://decision-for-liver.eu/.
3.3. Data protection officer
The Data Protection Officer (DPO) of the Coordinator of the Project (EF CLIF) will be the point of contact for all privacy related aspects of the Project and will be at your disposal for any doubts, queries or issues you may have in relation the processing of your personal data within the scope of the Project.
You may contact the DPO through this email address: dpo@efclif.com or this Company’s address: Travessera de Gràcia, 11, 7th floor 08021 Barcelona – Spain.
4. Sources and Types of Personal Data Processed
4.1. Sources of Personal Data
We collect and process both information that directly identifies the Data Subject, and information that does not directly identify the Data Subject.
Personal Data is collected from patients and healthy volunteers via:
- (i) Three previous studies (cohorts), which will provide with data from 2,200 cirrhotic patients: CANONIC, 800 patients, PREDICT and ACLARA, 700 patients each. These are three observational studies with patients hospitalized with acute decompensation of cirrhosis.
- (ii) The COMBAT Trial, which is being conducted at multiple clinical sites by the Partners in the DECISION Consortium. In this clinical trial, both patients and healthcare professionals know which treatment is being administered (open label), and patients are randomly assigned to receive the combinatorial therapy or usual care to avoid selection bias (randomized clinical trial).
In all cases the research protocols are approved by the entitled Research Ethics Committees.
4.2. Types of Personal Data
- (i) Existing data and samples provided by the Data Subject from previous studies (CANONIC, PREDICT and ACLARA)
We use the categories of Personal Data and personal data associated with human biological samples collected for biomedical research purposes in previous studies (cohorts). This secondary use has been consented to by the individuals who participated in the aforementioned studies and is in accordance with the ethical and legal standards and regulations for biomedical research in force at the international, European and local levels.
- (ii) Data collected via the COMBAT Trial
If potential participants wish to take part in the COMBAT Trial, they may provide us with their personal data in order to achieve the objectives of the Project. This information is considered to be information that directly identifies a Data Subject, i.e. it relates to an identifiable individual and will be considered and processed as “Personal Data”. Such data may include:
- a. Names and surnames of the Data Subjects.
- b. Health data, such as patient history data and clinical data and genetic information among others.
- c. Personal characteristics, such as family information, date of birth, place of birth, age, sex, nationality, physical or anthropometric characteristics to the extent necessary to carry out the Project.
- d. Human biological samples and personal data associated.
5. Data Processing Purposes and Lawful Bases
5.1. Purposes of the processing of the Personal Data
All Personal Data will be pseudonymized, which means that each patient will be assigned an alpha-numeric identification code and/or some other type of pseudonymization technique to separate the data from the individual’s identifying information and thus ensuring the privacy of the Data Subjects.
This Pseudonymized Data will be processed in accordance with the purposes set out in this Privacy Policy to achieve the objectives of the Project.
Partners of the Project, in their capacity as Joint Controllers, process the Personal Data collected for the following purposes:
- (i) identify and develop novel combinatorial therapies for patients with decompensation of cirrhosis tailored to the needs of individual patients or identified groups of patients to predict outcome and decrease the risk of short-term death. This objective will be achieved through segmentation of groups of patients.
- (ii) Evaluate / test the treatment response to the novel combinatorial therapies, discovered in DECISION in the COMBAT Trial.
- (iii) better predict outcome of patients with acute decompensation of cirrhosis testing the response to standard treatment administered to patients in the COMBAT Trial.
- (iv) identify the patient population responding to the developed combinatorial therapy.
The processing of personal data for the COMBAT Trial will be established before the beginning of the study.
Personal Data may be further used for scientific research purposes, and data and research results of the Project may be published, only if appropriate safeguards are in place. No personal information revealing the identity of participants will be published.
Pseudonymized data may be re-used after the relevant publication, if this has been agreed between the Project Partners.
5.2. Legal Basis for the processing of the Personal data
Previous studies (cohorts): The legal basis for the processing of data collected in previous studies (cohorts) is the informed consent. The informed consent signed by the patients for the CANONIC, PREDICT and ACLARA -cohort from Latin-America- studies refers to the possibility of using the participants’ Pseudonymized Data, including personal data associated to human biological samples, in future medical research involving the same condition and disease area (cirrhosis and its complications).
In relation to Personal Data collected via the COMBAT Trialcarried out by the Partners, the above purposes are based on different legal basis depending on the Partner:
- (i) For those Partners which are public entities (e.g. universities and research institutes) the lawful basis for the processing of Personal Data, under GDPR, is ‘the public interest’. The processing of special categories of data in the DECISION Project, such as health data is legitimated for reasons of public interest in the field of public health. The human biological samples are securely stored in biobanks (public and private biobanks located in Barcelona, Spain) following international, European and national regulations.
- (ii) For those Partners which are not public entities, the lawful basis for processing Personal Data are their legitimate interests in conducting research projects. The processing of special categories of data in the DECISION Project, such as health data, is legitimated by the biomedical research regulations (the processing is necessary for scientific purposes) and it is performed with all safeguards established by the privacy regulations in place.
- Please note that additional information regarding the balancing test carried out in order to verify the existence of a legitimate interest pursued by the Partners can be obtained upon request to the DPO of the Coordinator of the Project (EF CLIF) at the following email address: dpo@efclif.com.
- (iii) For UNITO and UNIBO the lawful basis for the processing of Personal Data, under GDPR, is the consent. For these Joint Controllers, there is also the possibility of having to request a prior consultation with the Privacy Guarantor in the cases indicated by art. 36, GDPR, and also in the cases indicated by art. 110 of Italian Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018.
Prior to enrolment in the COMBAT Trial conducted by Us, potential participants will be provided with all the necessary tools (Informed Consent Forms (ICF) and Information Sheets (IS)) to make a rational, free, and voluntary decision. Information will be presented clearly, using short, understandable sentences and avoiding technical terms, so they can properly understand the implications of their participation and their rights. Participants will be asked to give their fully informed written consent by signing the informed consent form.
Likewise, Participants’ informed consent also allows the use personal data in future biomedical research on the same condition and disease area (cirrhosis and its complications).
6. Assignments and International Data Transfers
6.1. Assignments
In general, we will not share your data to third parties outside of the DECISION Partners, unless We are required to do so by law or if required by a public authority, judicial or data protection authorities in order to comply with legal obligations applicable to Us.
We use the services of service providers, (see list below) which in order to provide their services, require limited access to the Personal Data, acting as Data Processors. In these cases, We guarantee that We have signed specific agreements with these service providers as required by law, requiring them to have the same or a higher level of security to protect the information provided to them.
The following entities act as Data Processors on behalf of the Partners to carry out some activities of the processing:
- ID GROUP, which provides technical support for the Data Hub.
GENOSPLICE, subcontractor to Joint Controller INSERM, which provides us with data analytical services; - CIC Biogune, which provides us with transcriptomics services;
- Hospital Clínic de Barcelona (HCB), linked third party to Joint Controller FCRB, involved in the collection and processing of the samples from the clinical trial (CANONIC, ACLARA, PREDICT) as well as in data analysis and integration of results.
- Université Paris Diderot (UPD), linked third party to Joint Controller INSERM, involved in the processing of the biological samples from the ACLARA and PREDICT cohorts.
- Azienda ospedaliero-universitaria di Bologna policlinico Sant’Orsola-Malpighi (AOSP), linked third party to Joint Controller UNIBO.
- Royal Free Hospital (RFH), linked third party to Joint Controller UCL, will allow use of the hospital premises/equipment for the COMBAT trial (WP5).
- AZIENDA OSPEDALIERA CITTA DELLA SALUTE E DELLA SCIENZA DI TORINO (AOUTO), linked third party to Joint Controller UNITO, will be involved in the recruitment of patients in the COMBAT trial (WP5).
- Fundación para la Investigación Biomédica del Hospital Universitario Ramón y Cajal (FIBIOHRC), linked third party to joint controller SERMAS, which handles the financial and administrative aspects of the Hospital’ involvement in research projects, including all issues relating to the employment and payment of additional personnel, purchase of equipment and consumables, etc., will provide the DPO.
- ERASMUS UNIVERSITAIR MEDISCH CENTRUM ROTTERDAM (“EMC”), which will process biological samples.
- COMMISSARIAT A L ENERGIE ATOMIQUE ET AUX ENERGIES ALTERNATIVES (“CEA”), which will process biological samples.
6.2. International Data transfers
We inform you that the objectives and patient populations have been obtained from many different countries outside the EU (involving, among others, Latin American countries -part of the ACLARA study. In any case, the origin of the personal data will not lead to a reduced compliance with the standards applicable within the EU, and therefore, within the framework of this Project, Project’s partners will adhere to the Ethical and legal requirements that are applicable within the EU.
Regarding data transfers to third countries, some of the partners and data processors are from the United Kingdom. Such cross-border transfers of personal data have an adequate level of data protection, as they are based in an adequacy decision adopted by the European Commission on 28th June, 2021. Apart from that, We do not to transfer your Personal Data to third countries outside the European Economic Area (EEA).
7. Information Security
As explained above, all data to be integrated into the Project’s Data Hub will be Pseudonymized Data in order to guarantee the confidentiality of the Personal Data.
The code or hash resulting from the application of Pseudonymization techniques will be stored separately and will only be accessible to the participating investigators of the Partners where the data was generated.
The Personal Data allowing the direct identification of the Data Subjects will be stored in a specific password-protected file, accessible only for security purposes or to identify those Patients who wish to withdraw their consent to the use of clinical or biological data generated during the Project. In this way, the Project’s Data Hub will ensure the pseudonymity and non-identifiability of the Data Subjects.
Personal Data will be exchanged with the consortium Partners as appropriate, but it will not be possible to establish a link between the personal data of the Patients and the metadata processed, so it will always be considered as Pseudonymized Data.
All Personnel authorised to process the Personal Data are required to know and comply with the policies, rules, procedures, and standards that are applicable to the performance of their duties in relation to the Project and the processing of Personal Data. In this context, they have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
8. Personal Data Retention
The Pseudonymized Data will be uploaded in the DECISION Data Hub, and data generated in DECISION will be kept for the full duration of the Project and will be deposited at public repositories for long-term preservation (common practice and required for projects funded by the EU).
Upon completion of the Project, the pseudonymised data will be retained by the Joint Controllers for a minimum of twenty-five (25) years in accordance with applicable clinical trial regulations. Data will be processed longer if the individual has consented to the use of their data for future studies. However, the data will be destroyed at the request of the Data Subjects. The information and knowledge generated until the date of the withdrawal will remain for the sake of scientific advancement as stated in the regulation. From that moment the human biological samples and associated personal data should be eliminated from the storage facilities and the data base of the selected biobanks.
9. Data Protection Rights
9.1. Data protection rights
You may exercise the following rights that the law guarantees you in relation to the processing of your Personal Data.
Any complaint received will be dealt with as soon as possible, always in compliance with the time limits established by law. In some cases, it may be necessary to ask for a copy of your identity card or other form of identification in order to verify your identity.
- (i) Right of access
You have the right to know which data are being processed, if any, and, if so, to obtain a copy of them, as well as to obtain information about: the origin and recipients of the data; the purposes of the processing; the categories of personal data being processed; whether there is any automated decision-making process, including profiling; the period of data retention; and the rights provided for by law.
- (ii) Right of rectification
You have the right to have your Personal Data corrected or completed if is incomplete.
- (iii) Right to erasure
You have the right to request that your Personal Data be deleted if it is no longer necessary for the purposes for which it was collected or if We are no longer authorised to process it.
- (iv) Right to data portability
You have the right to request data portability in the case the processing of your data is based on your consent or the performance of a contract, and where the processing is carried out by automated means. If You exercise this right, You will receive your personal data in a structured format, that is commonly used and readable by any electronic device. However, You may also request, where possible, that your data be transferred directly to another entity.
- (v) Right to restriction of processing of your personal data
You have the right to restrict the processing of your data in the following cases:
- a) If You have requested the rectification of your personal data during the period in which We are verifying its accuracy.
- b) If You believe that it is no longer necessary for Us to continue processing your data and You want us to keep it for the purpose of exercising or defending claims.
- c) If You believe that We are not authorized to process your data. In this case, You may ask Us to restrict its use instead of requesting its deletion.
- d) In cases where processing is based on our legitimate interest and You have exercised your right to object, You may ask Us to limit the use of your data while we consider whether those interests outweigh yours.
- (vi) Right to object
You have the right to object at any time to the processing of your personal data on the basis of Our legitimate interests, including profiling.
- (vii) Right to withdraw consent
You may withdraw your consent in connection with any processing based on it. However, We remind You that withdrawal of consent does not affect the lawfulness of any processing based on consent prior to the withdrawal. Therefore, although the patient’s Personal Data will no longer be processed, the knowledge obtained through the previous processing will not be affected by the withdrawal.
- (viii) Right to file a complaint with the Supervisory Authority
Remember that, at any time, and in the event that You consider that We have violated your right to the protection of your data, You may lodge a complaint with the competent Data Protection Authority, which, in the case of Spain is the Spanish Data Protection Agency (www.aepd.es).
9.2. Channels for the exercise of rights
You may exercise your rights at any time and free of charge by sending an e-mail to the Data Protection Officer of the Coordinator of the Project: EUROPEAN FOUNDATION FOR THE STUDY OF CHRONIC LIVER FAILURE (EF-CLIF), which will be the point of contact for the exercise of Data Subject rights for the DECISION Project, in the following e-mail address: dpo@efclif.com or EF CLIF’s postal address: 1 1Travessera de Gràcia, St., 7th floor 08021 Barcelona – Spain.
Depending on the Partner who collected your data or the study from which it was obtained, your request may be forwarded to the appropriate persons at the relevant Partners.
Notwithstanding the foregoing, you may exercise your data protection rights with respect to and before any Partner.
10. Updates to this Privacy Policy
This Privacy Policy may be updated in the future, either to improve it, or to comply with and adapt to new applicable legislation that may affect the processing, collection and management of personal data. Any changes to this policy will be clearly and conspicuously disclosed, for example, we may use your email address to notify you of such changes.
11. Joint Controllership Agreement
The Consortium Partners have signed a JOINT CONTROLLERSHIP AGREEMENT which sets out their respective responsibilities for compllying with the obligations under the GDPR reflects the key principles of the GDPR,in particular the principles of transparency, purpose limitation and data minimization, accuracy, quality control, storage limitation, and data integrity and security.
According to the GDPR, the essence of the agreement must be made available to the Data Subject. Therefore, more detailed information can be obtained upon request by contacting the Coordinator of the Project, EF-CLIF, through the following electronic address: dpo@efclif.com.
12. Acknowledgement and Disclaimer
The DECISION project has received funding from the European Union’s Horizon 2020 research and innovation Programme under Grant Agreement No 847949.
This policy reflects only the author’s view and the Commission is not responsible for any use that may be made of the information contained herein.
This Privacy Policy has been created and published in August 2023.