10x Genomics single-cell RNA sequencing of cerebrospinal fluid

Cambridge University Clinical Neurosciences MS genetics

Thank you for your interest in our work. Under UK law (in particular GDPR, https://gdpr-info.eu/) we are only able to share data with researchers from countries that are covered by UK “adequacy regulations” (for more information please see, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/#Q1). The basic text of our Data Transfer Agreement (DTA) is shown below. Please be aware that this text may be changed by our research office from time to time. Please also note that the DTA we will provide will be non-negotiable. Some countries are considered to have “partial adequacy” in which case additional terms will be added to the agreement. Data Transfer Agreement basic text for EU (fully adequate countries) for other countries with partial adequacy addition terms will be included. Terms and Conditions 1. Definitions 1.1 Data: means the data described in Schedule A (which includes Personal Data). 1.2 EGA: means The European Genome-phenome Archive. 1.3 UK Data Protection Laws: means all laws relating to data protection, the processing of Personal Data, privacy and/or electronic communications in force from time to time in the UK including the UK GDPR and the Data Protection Act 2018. 1.4 Personal Data: shall have the meaning given in the UK Data Protection Laws. 1.5 Process: shall have the meaning given in the UK Data Protection Laws. 1.6 Research Project: means the research project described in Schedule B. 1.7 Results: means all information, techniques, data, results, design, technology, materials, inventions, algorithms and software identified or first reduced to practice or writing in the course of undertaking the Research Project. 1.8 UK GDPR has the meaning given to it in section 3 of the Data Protection Act 2018. 2. Use of Data 2.1 Cambridge confirms that it is entitled to provide the Data to the Recipient for use as described in this Agreement. Nothing in this Agreement shall affect the ownership of the Data. 2.2 Cambridge grants the Recipient a non-exclusive, non-transferable licence to use the Data solely for the Research Project in accordance with this Agreement. All other rights are reserved. 2.3 The Recipient undertakes: 2.3.1 to use the Data solely for the Research Project in accordance with this Agreement and all applicable laws; 2.3.2 subject to clause 2.3.9 to restrict access to the Data to the Recipient Scientist and the individuals working under the Recipient Scientist’s direct supervision, and to ensure that those individuals are aware of and comply with this Agreement; 2.3.3 to keep the Data confidential and subject to clause 2.3.9 not to sub-licence, transfer, disclose or otherwise make the Data available in whole or in part to any third party; 2.3.4 to refer to EGA any request for the Data from anyone other than the individuals working under the Recipient Scientist's direct supervision; 2.3.5 to keep the Data secure by implementing organisational and technological measures appropriate to the nature and sensitivity of the Data to protect against the unauthorised or accidental access, use or disclosure of the Data; 2.3.6 to notify Cambridge as soon as reasonably practicable after becoming aware of any unauthorised or accidental access, use or disclosure of the Data and to cooperate with any investigation made by Cambridge in connection with such access, use or disclosure; 2.3.7 not to attempt to re-identify any individual from the Data or to communicate with any individual re-identified from the Data, or to link or attempt to link the Data to other data or information if doing so might identify any individual; 2.3.8 to Process the Data in accordance with UK Data Protection Laws and to comply with Schedule C; and 2.3.9 to delete all copies of the Data from its hard drives and moveable media and destroy all physical copies of the Data as soon as reasonably practicable on termination of this Agreement This obligation does not extend to automatically generated computer back-up or archival copies generated in the ordinary course of the Recipient’s information systems procedures, provided that the Recipient makes no further use of those copies. 3. Confidentiality & Publication 3.1 The Recipient will not be in breach of any obligation to keep the Data confidential if the Data: a) enters the public domain through no improper act of the Recipient; b) must be disclosed for minimum lawful compliance with court orders, regulations or statutes, provided in all cases Cambridge is notified as early as possible prior to disclosure. 3.2 The Recipient is free to publish the Results of the Research Project provided it does not disclose the Data. The Recipient shall acknowledge Cambridge and the International Multiple Sclerosis Genetics Consortium (IMSGC) as the source of the Data in any publication that arises from the use of the Data. 4. Results 4.1 The Recipient shall promptly notify Cambridge of any application for patent or other proprietary rights to protect intellectual property contained in the Results. The Recipient shall not use the Results for any commercial purpose without the prior written consent of Cambridge. 5. Termination 5.1 This Agreement will terminate on the earliest of the following dates: (a) completion of the Research Project; or (b) expiry of thirty days written notice from one Party to the other. 5.2 Without prejudice to clause 5.1, Cambridge may terminate this Agreement with immediate effect by written notice to the Recipient if the Recipient is in material breach of this Agreement and the breach: (a) cannot be remedied; or (b) can be remedied, but the Recipient fails to do so within 30 days starting on the day after receipt of written notice. 5.3 Any provision of this Agreement that expressly or by implication is intended to survive termination of this Agreement including but not limited to the Recipient’s obligations in clause 2.3.7 shall remain in full force and effect. 6. Liability 6.1 Except as provided in clause 2.1, Cambridge provides the Data “as is” and makes no representation and gives no warranty of any kind either express or implied in relation to the Data, including but not limited to warranties of accuracy or fitness for a particular purpose, or that the Data will not infringe any patent, copyright, trademark or other proprietary rights, accordingly Cambridge will not be liable for any loss arising from any reliance placed on the Data by the Recipient. 6.2 Cambridge will not be liable to the Recipient for any use made of the Data by the Recipient, including but not limited to any claim made against the Recipient by a third party due to or arising from the use, handling, storage or disposal of the Data by the Recipient. Subject to clause 2.1, the Recipient agrees to be liable for any loss, damage, claim and other liability of whatsoever kind or nature due to or arising from its use, handling, storage or disposal of the Data. 6.3 Nothing in this Agreement limits or excludes either Party’s liability for (a) death or personal injury resulting from negligence, (b) fraud or fraudulent misrepresentation, or (c) for any other liability which by law cannot be limited or excluded. 6.4 The liability of either Party for any breach of this Agreement will not extend to loss of business or profit or to any indirect or consequential loss or damage. 7. General 7.1 Costs: The Data is provided at no cost. 7.2 Assignment: The Recipient may not assign or transfer this Agreement or any of its rights or obligations under it without the prior written consent of Cambridge. 7.3 Entire Agreement: This Agreement constitutes the entire agreement between the Parties and supersedes all negotiations, understandings or previous agreements between the Parties relating to its subject matter. 7.4 Third Parties: A person who is not a Party to this Agreement shall not have any rights under or in connection with it. 7.5 Governing Law: This Agreement is governed by and shall be construed in accordance with English law. The English courts shall have exclusive jurisdiction to deal with any dispute which may arise out of or in connection with this Agreement, except that either Party may bring proceedings for an injunction in any jurisdiction. 7.6 Escalation: Either Party may give a dispute notice to the other to escalate any dispute under this Agreement for joint resolution by senior representatives of the Parties. Either Party may litigate if the dispute has not been resolved within twenty-eight (28) days beginning on the date of the dispute notice. Either Party may apply for an injunction whether or not any dispute has been escalated under this clause. 7.7 Counterparts: This Agreement may be executed in one (1) or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument. This Agreement may be executed electronically using Docusign and delivered by email. Schedule A The Data These data were generated by the University of Cambridge, Department of Clinical Neurosciences as part of their efforts to understand the genetic architecture of multiple sclerosis. The data …….. as described in EGAS00001007478. Categories of data subjects whose data is transferred Research Participants – individuals who have given fully informed valid consent to the Provider for the processing of their personal data and for the sharing of said data with bona fide researchers for specific research purposes Categories of data transferred Special Category Data – Genetic data of research participants together with basic demographic and clinical data Provider’s lawful basis for sharing Personal Data Personal Data: • Legitimate Interests (Article 6(1)(f) UK GDPR) Special Categories of Data: • Scientific research purpose (Article 9(2)(j) UK GDPR Nature of the processing For the purpose of the Research Project described in Schedule B The Data released from EGA Services will be analysed as described in the research project. Schedule B The Research Project [YOU WILL NEED TO INSERT A DESCRIPTION OF THE RESEARCH PROJECT HERE] NB It is vital to provide adequate data. If this section is inadequate your application will be rejected. Schedule C Personal Data: security obligations 1. The Recipient shall be clear about who is responsible for ensuring information security and other provisions for the protection of Personal Data. 2. The Recipient shall ensure that appropriate security measures including technical and organizational measures are in place at all times and backed up by robust policies and procedures to protect the Personal Data (copies to be provided to Cambridge on request). Such measures shall include without limitation: o providing an appropriate level of information governance for all Personal Data; o ensuring that the hardware and software used in Processing the Personal Data are reliable and protected against all kinds of malicious software and viruses; o ensuring the method of storing Personal Data is secure and controlling access to the Personal Data; o using password protection on computer systems on which Personal Data is stored; o taking reasonable steps to ensure the reliability of individuals who have access to the Personal Data, including but not limited to ensuring all such individuals understand the confidential nature of the Personal Data and the issues which arise if proper care is not taken in the use of the Personal Data and that all such individuals are properly trained in how to comply with UK Data Protection Laws prior to accessing the Personal Data; o properly controlling remote access and ensuring that Personal Data is not downloaded to portable devices unless strictly necessary and only then if encrypted; and o having a secure method for the deletion and disposal of Personal Data in whatever form. 3. The Recipient shall have in place systems for swiftly and efficiently detecting, investigating and remedying Personal Data breaches (as defined in the UK Data Protection Laws), and promptly reporting any such breaches to Cambridge. 4. In the case of Personal Data concerning health, the Recipient shall meet the appropriate requirements of the NHS Digital Data Security and Protection Toolkit or equivalent level of information governance.