LUCIA PATIENT PRIVACY NOTICE

LUCIA Study Data Protection Notice

 

The use of this app is part of the LUCIA Study:

 

Study title: Understanding Lung Cancer related risk factors and their Impact
Study acronym: LUCIA
Funding: European Health and Digital Executive Agency

(Grant Agreement Nr. 101096473)

Study Coordinator: Instituto de Investigación Sanitaria Biobizkaia

Plaza de Cruces Nº 12 Edificio 1, CP 48903 Barakaldo, Spain

Clinical Centers: SERVICIO ANDALUZ DE SALUD

Distrito Sanitario Aljarafe-Sevilla Norte

Hospital Universitario Virgen Macarena

 

CHU DE LIEGE

Département de Pneumologie

 

UNIVERSITY OF LATVIA

Institute of Clinical and Preventive Medicine

 

SERVICIO VASCO DE SALUD OSAKIDETZA

 

The LUCIA Study is conducted in accordance with data protection regulations, including GDPR and national related laws.

The partners of the LUCIA consortium are joint controllers of the personal data processing activities within the LUCIA study and are all subject to the GDPR.

This Notice describes how your personal data will be processed and your rights regarding your data.

 

1.    Terminology

  • GDPR: the General Data Protection Regulation, meaning Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

All concepts used in this Notice such as “personal data”, “health data”, “data controller”, “purposes”, etc. have the same meaning as in the GDPR.

  • LUCIA Partners: the partners of the LUCIA consortium, as listed at the end of this information sheet.
  • Principal Investigator: the medical practitioner at your local Clinical Center with whom you will participate in this study, including their team of collaborators.
  • Clinical Center: a medical institution that is part of one of the LUCIA partners.
  • Other terms, such as the LUCIA devices, have the same meaning as in the LUCIA Patient Information Sheet.

2.   What personal data is collected ?

  • Age, gender, ethnicity, socioeconomic factors, deprivation index, education level and physical examination data.
  • Medical record and exposure to harmful agents.
  • Analytical variables based on blood test (such as general biochemistry data, tumor markers, hematology data, etc.).
  • Data from questionnaires collected in the LUCIA mHealth apps.
  • Data from the LUCIA devices: the Breath Analyzer (BAN), Wide-biomarker-spectrum Multi-Use Sensing Patch (WBSP) and Spectrometry-on-Card (SPOC).
  • Data from the analysis of low-dose CT scans and samples of body tissue.

3.   For what purposes is your data processed and on what legal basis?

We will only process your data for the following purposes: We rely on the following legal basis for processing your data:
·        To conduct the study in the Clinical Center (e.g. for administration and collecting medical measurements) and for research and statistical analysis to fulfill the objectives of LUCIA. Please see the Patient Information Sheet for more information on the LUCIA objectives. ·        Your freely given and explicit consent to process your (health) data (Articles 6.1.a and 9.2.a GDPR). You are free to withdraw this consent at any time during the study, please see section 7 below to see how.
·        For further scientific research purposes. This includes publication and dissemination activities (e.g. disclosure of the methods and results of the study through presentation at reputable scientific symposia, professional meetings, scientific journals, theses, or dissertations). This may also include the reuse of your data within the framework of new research related to the diagnosis, screening and prevention of lung cancer. ·        Your freely given and explicit consent to conduct the Study and conduct research and statistical analysis for LUCIA, so far as appropriate safeguards are applied (Articles 5.1.b, 9.2.j and 89 GDPR).
·        To comply with national or EU law. ·        A legal obligation (Article 6.1.c GDPR).

 

4.   How do we process and protect your data, and with whom we share it?

The LUCIA partners are joint controllers of the processing of your personal data. This section explains how your data is processed during the study and also summarizes the essence of the arrangement between the joint controllers. All of the LUCIA partners and their respective tasks are listed at the end of this information sheet.

Collection of your personal data

The Principal Investigator at your local Clinical Center will collect the personal data listed in section 1. The Principal Investigator will use your personal data for administration and conduct of the study. Study-related directly identifiable personal data will be kept for analysis, compliance and scientific investigation in your local Clinical Center, as will the original Informed Consent Form with your non-pseudonymized personal data.

Your Principal Investigator and Clinical Center are responsible for data collection, processing, and transmission. They will ensure that your data are adequately protected, just as when they process your health data for other purposes not related to the LUCIA Study.

Pseudonymization of your personal data

Your Principal Investigator will also assign you, at the very first appointment, a random code for the LUCIA Study.

This will allow your personal data to be pseudonymized: your direct identifying information (like name, national insurance number, etc.) will not be shared with the LUCIA partners, but only the unique code mentioned above, so that the persons handling the data cannot trace them back to you.

Only the Principal Investigator at your local Clinical Center has the list of codes and can trace the data back to the patient. This list is stored solely on paper at the Clinical Center and the key to access it is only available to the Principal Investigator.

Pseudonymization may also imply that some of your data will be slightly altered or rounded to avoid reidentification.

Storage of your personal data, transfers, and research activities during the LUCIA Study

Your personal data may first be stored on computer equipment on the premises of your local Clinical Center. This includes local storage of the phone that the Principal Investigator is using to collect data from the WBSP. To share your pseudonymized personal data with other LUCIA partners, the Principal Investigator will send it to a central database (the LUCIA Health Data Platform). The LUCIA Health Data Platform is located in Spain, at the premises of partner Vicomtech.

All partners that store personal data collected in the LUCIA Study implement appropriate technical and organizational measures to ensure that the requirements of the GDPR are met and that your rights are protected. Specifically, the necessary security measures have been taken to guarantee confidentiality of your personal data.

While your personal data will be physically stored, managed and processed in the EU, it may also be accessed from and processed in Turkey, the United Kingdom and Israel. The LUCIA Partners always ensure that any such data transfers outside the EU (in the meaning of Chapter V GDPR) are subject to appropriate safeguards. Specifically, potential transfers can be based on:

  • For Turkey: the European Commission’s Standard Contractual Clauses in their most recent version.
  • For the United Kingdom: the European Commission’s adequacy decision of 28 June 2021, Nr. 2021/1772/EU.
  • For Israel: the European Commission’s adequacy decision of 31 January 2011, Nr. 2011/61/EU.

For the duration of the study, the LUCIA partners will only access pseudonymized data when needed for the purposes of the Study as described above. They will carry out various processing activities to be able to conduct research and statistical analysis to fulfill the objectives of LUCIA. Please see the Patient Information Sheet for more information on the LUCIA objectives.

Limited access to your personal data

All data we process, and in particular all documents held by the Clinical Center that allow reidentification of your person, will be handled with strict confidence.

It is important to note that all personal data, including those that are kept by your local Clinical Center, can be accessed for audits, reviews or inspections (e.g. by the relevant Ethics Committee or health authority), who will be able to trace back to the individual participant and will be bound to confidentiality.

The pseudonymized data can also be examined by the auditors of the European Commission up to 5 years after the end of the study in order to verify the proper implementation of the project and the respect of our obligations towards the European Commission under the Horizon Europe program.

We will not grant access to the data when this is not necessary and we are not obliged to do so.

Subcontractors for processing your personal data

The Clinical Centers as well as other LUCIA Partners can hire subcontractors to conduct their processing activities and for their day-to-day operations (e.g., email providers, storage providers,…). Where this is the case, these subcontractors will act under the instructions of the Partner which engages them and will qualify as data processors within the meaning of the GDPR. The LUCIA Partners shall only commission subcontractors who meet the requirements of the GDPR and data protection laws and of their joint controller arrangement, undertake to conclude a data processing agreement, and to take adequate measures with these processors to protect your personal data.

Further scientific research

As the study progresses, we will observe the results and improvements of the LUCIA project. We will share these results with the scientific community and the public, such as through presentation at reputable scientific symposia, professional meetings, reputable scientific journals, theses, or dissertations. The data will be shared in the form of statistics, trends, and/or will be fully anonymized. If for any reason it is not possible to anonymize the data with sufficient confidence, it will at least be strongly pseudonymized, in accordance with Article 89 of the GDPR, so that it will not be possible for people outside the LUCIA consortium to identify the data subject.

Going forward, it is not impossible that the data collected in this study may become relevant to a future study, related to the diagnosis, screening and prevention of lung cancer. If this is the case, your data may be reused for such study, in accordance with applicable European and national legislation on the further use of personal data for scientific purposes and, where applicable, the requirements for pseudonymization and protection of your data. If this is ever the case, we will inform you, unless not required by national or EU law.

5.   How long will your data be kept?

Your data will be kept during the duration of the LUCIA Study and the related dissemination activities.

After the end of the study, your data will be kept on file for 10 years, based on the following obligations:

  • EU law, for example personal data potentially contained in the documentation covered by Chapter III of Annex XV of the Regulation (EU) 2017/745 on medical devices.
  • National laws.
  • Moreover, data must be kept for 5 years after the end of the study as part of the obligations of the LUCIA consortium towards the European Commission under the Horizon Europe program.

After the 10-year period, your person-related data will be deleted unless there are other legal obligations that require us to store the data for even longer periods.

Please note that the results of the study may be published in medical journals; in this case data will be anonymized (or at least strongly pseudonymized) and it will not be possible to trace any published results back to you, so those publications will remain available after the above-mentioned period(s).

6.   What are your rights related to your personal data?

You have a number rights related to your personal data. If you wish to exercise any of these rights, or if you have questions or complaints, please contact your Principal Investigator. If, for exceptional reasons, this is not possible or appropriate, please contact the LUCIA consortium through the website: https://luciaeuproject.technion.ac.il/.

  • Right to withdraw your consent: you are free to withdraw your consent to (part of) the processing of your data at any time during the study. In your request, please specify what you are withdrawing your consent for.

Please note that if you discontinue your participation in the study or withdraw your clinical consent for this study (given in the Study Informed Consent Form) without further clarification, this will also have the effect of withdrawing your consent for the collection of additional personal data, but not for the processing of data already collected. If you also wish to withdraw your consent for the processing of your data collected prior to the discontinuation, please let us know.

If you expressly indicate that you want to withdraw your consent for any processing of any of your personal data for the purposes to which you consented, no new data will be collected, and your stored (pseudonymized) personal data as well as the corresponding LUCIA code will not be processed anymore and will be deleted or destroyed, unless the exemptions of Article 17 or 89 GDPR apply, or unless there are legal regulations that require storage or processing for certain periods.

  • Right of access and data portability: you have the right to receive confirmation as to whether or not personal data are processed, which personal data and in which way, and the right to access all or part of your personal data that are collected, processed or, where applicable, disclosed to third parties (including a free copy) in the course of the study. You also have the right to receive the data you provided in a structured, commonly used and machine-readable format, or transfer it to another (additional) person responsible for data processing who is appointed by you.
  • Right to rectification: you have the right to have your personal data corrected in case of inaccuracies.
  • Right of deletion: you have the right to request that we delete your personal data, e.g. if these data are no longer needed for the purpose for which they were collected.
  • Right to restrict processing: under certain conditions (Article 18 GDPR) you have the right to request a restriction on processing, meaning that the data may only be stored, but not processed.

These rights can be restricted in accordance with GDPR provisions or legal obligations.

If, after contacting your Principal Investigator, you are not satisfied with the answer you received, you can contact the Data Protection Officer (DPO) of your local Clinical Center. Please refer to the contact details at the end of this Notice.

If you are still unsatisfied, you have the right to lodge a complaint with the supervisory authority of your habitual residence (or where the Clinical Center is established) if you assume that the processing violates the GDPR.

 

 

 

 

 

LUCIA consortium partners

 

This list contains all of the partners in the LUCIA consortium and their tasks:

Clinical Centers

The main tasks of the Clinical Centers in regards to personal data processing during the LUCIA Study are to obtain ethical approval from the ethics boards, recruit patients, collect, format and pseudonymize health data pursuant to agreed protocols and processes, and provide the data to the Technical Partners.

The list below also provides contact details for the Clinical Partners and the hospitals at which each of them will be conducting the LUCIA Study.

This list also provides contact details for the partner that coordinates the LUCIA Study, but is not a Clinical Center itself: Biobizkaia. Biobizkaia provides services to the Clinical Centers for the Study, like coding (pseudonymization) of clinical data, drafting of the clinical protocol, etc.

 

Partner Address Hospitals Contact person DPO
Latvijas Universitate Rainis Boulevard 19, Riga 1586, Latvia Centre for Tuberculosis and Lung Diseases (CTLD) of Riga East University Hospital (REUH) Dr. Alvils Krams

Dr. Ilmārs Stonāns

datu.specialisti@lu.lv
Centre Hospitalier Universitaire de Liège Avenue de l’Hôpital 1, Liège 4000, Belgium Centre Hospitalier Universitaire de Liège Dr. Julien Guiot

Dr Astrid Paulus

Dr. Renaud Louis

dpo@chuliege.be
Servicio Andaluz de Salud Avenida De La Constitucion 18, Sevilla 41071, Spain ·        Virgen Macarena University Hospital (VMUH)

·        Aljarafe-Sevilla Norte Health District (ASNHD)

Dr. David Vicente Baz

Dr. Luis Gabriel Luque Romero

dpd.sspa@juntadeandalucia.es
Servicio Vasco de Salud Osakidetza Plaza de Cruces Nº 12 Edificio 1, CP 48903 Barakaldo, Spain ·        San Eloy Hospital

·        Galdakao-Usansolo University Hospital

·        Bilbao-Basurto University Hospital

·        Cruces University Hospital

·        Alfredo Espinosa – Urduliz Hospital

·        Gordexola Health Care center

·        Balmaseda Health Care center

·        Mamariga Health Care center

Dr. Larraitz García Echeberria DBO-DPD@osakidetza.eus
Biocruces Bizkaia Health Research Institute Plaza de Cruces Nº 12 Edificio 1, CP 48903 Barakaldo, Spain N/A Dr. Eunate Arana Arri dpd@bio-bizkaia.eus

 

Technical Partners

The main tasks of the Technical Partners in regards to personal data processing during the LUCIA Study are to establish a novel toolbox for discovering and understanding new risk factors contributing to lung cancer development. They will do so by developing processes for collecting, formatting and sharing data, by establishing storage for data, by developing devices for lung cancer screening and diagnosis and by developing and using AI tools for analysis of risk factors.

 

Partner Country Tasks
Technion – Israel Institute Of Technology Israel Technion analyses the volatile organic compound samples (from SPOC and WBSP) during the Study, and therefore uses pseudonymised personal data for each collected sample in order to build the machine learning classifier algorithm.
Deutsches Krebsforschungs-Zentrum Heidelberg (DKFZ) Germany DKFZ has no active role during the Study.
Fundacio Institut de Recerca Biomedica (IRB Barcelona) Spain IRB conducts the statistical analysis of inherited genetic variants and DNA methylation data and of risk factor related observational data based on, amongst others, data from the Study.
Consorcio para la Explotacion

el Centro Nacional de Analisis

Genomico (CNAG)

Spain CNAG conducts the genetic testing of the pseudonymised samples collected during the Study.
Fundacion Centro de Tecnologias de Interaccion Visual y Comunicaciones Vicomtech Spain Vicomtech provides storage for most of the personal data from the Study in the form of the “health data platform”, Vicomtech ingests, integrates and harmonises the data into the health data platform, Vicomtech is responsible for access to data on the health data platform by other partners (user & access management), and Vicomtech also builds AI models based on pseudonymised data.
Ruprecht-Karls-Universitaet

Heidelberg (UHEI)

Germany UHEI performs in vitro and in vivo validation of the contribution of molecular risk factors to lung cancer development, and analyses pathways of risk factors, but does not process data from the Study when doing so.
Emoda Yazilim Ve Danismanlik Sanayi Ticaret Limited Sirketi Turkey Emoda supports the input and visualisation of data and builds AI risk factor models based on pseudonymised data. Emoda also develops the mobile applications used by patients and clinicians during the Study.
Universidad Politecnica de Madrid (UPM) Spain UPM builds AI models based on pseudonymised data.
Bilbomatica SA Spain Bilbomatica develops and improves software for LUCIA.
Fundacion Publica Andaluza para la Gestion de la Investigacion en Salud de Sevilla (FISEVI) Spain FISEVI supports the Servicio Andaluz de Salud during the Study.
Nanose Medical Ltd Israel Nanose provides the BAN devices and analyses the resulting pseudonymised data.
Pronat Industries Ltd Israel Pronat provides the patch devices but does not collect or use any of the data.
University of Ulster United Kingdom Ulster performs a risk factor analysis on environmental and sociodemographic data using geospatial analytics and machine learning techniques and develops AI models with patient records provided by the pilot site countries to develop models.

 

Support Partners

The main tasks of the Support Partners are not related to the processing of personal data during the LUCIA Study, but to ethical requirements, communication, dissemination and exploitation activities and project and innovation management. The Support Partners are:

  • YAGHMAV., provides ethics support to the LUCIA Partners.
  • Timelex provides legal and data management support to the LUCIA Partners.
  • Fédération Européenne des Hôpitaux et des Soins de Santé (HOPE) provides dissemination and communication support.
  • DEXAI – Etica Artificiale provides ethics support to the LUCIA Partners.