SweGen whole-genome sequencing from the Northern Sweden Population Health Study

Uppsala University FEGA Access guide Requests for data Requests for access to these data will be assessed based on Swedish laws and regulations. Requests must include an explicit acceptance of the conditions stated below and information about the following aspects: - The requester must attach an approval from an ethics committee or equivalent body that allows the data to be handled in accordance to the laws and ethical guidelines in the receiving country. - For researchers in the European Union – specify the legal basis according to GDPR to use the data. - Information about how the data will be stored and managed with regards to information security procedures. Requests for data are only accepted if the recipient adheres to the following conditions: Purpose - The recipient agrees to use data only for research. Confidentiality -The recipient agrees to preserve, at all times, the confidentiality of data pertaining to identifiable data subjects. Data protection - Recipients in EU agrees that it, and its registered users, are covered by and shall comply with the obligations contained in the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Upon receipt of the data, the recipient will become controller of the personal data as defined in the GDPR. Recipients outside EU shall comply with relevant national laws concerning the protection of personal data. Uppsala University reserves the right to request and inspect data security and management documentation to ensure the adequacy of data protection measures. The recipient agrees that it, and its registered users, shall not analyse or make any use of the data in such a way that has the potential to: (a) lead to the identification of any data subject; or (b) compromise the protected identity of any data subject in any way. Access and Governance - The recipient agrees that it shall take all reasonable security precautions to keep the data confidential. The recipient agrees to, under no circumstances, give access to data to any third party, except to registered users (as described below). The recipient agrees to only give access to data, in whole or part, or any identifiable material derived from the data, to a registered user. The recipient agrees that before it gives any registered user access to data, it shall first inform about the conditions stated in this text and that he or she must comply with the obligations. The recipient shall only give registered users that are not researchers (including but not limited to students or new researchers to the field) access to the data if they are supervised by a researcher who will take responsibility for such registered users’ use of the data. The recipient must make sure that: - Data is processed in a way that ensures the confidentiality and integrity of the data. - Analysis and storage of the data must be performed in a secure environment that ensures that only registered users have access to the data. - Transfer of data must be done through encrypted channels. - There are standard operating routines that ensure that registered users handle the data in accordance with information security and legal requirements. - In the case of a personal data breach, the recipient must immediately inform Uppsala University, and the appropriate national data protection authority, of such an incident. Errors - The recipient must notify the Uppsala University of any errors detected in the data. Acknowledgement of data use - The recipient agrees to acknowledge the creators and source of the data in any work based in whole or part on the Data. Definitions: “Research” shall mean research that is seeking to advance the understanding of the research purpose stated in the ethics approval or equivalent document. “Registered User” shall mean a researcher (or an individual conducting research under the supervision of a researcher) that is employed by the recipient and is bound by confidentiality and has been informed of the conditions stated above. For the avoidance of doubt, “Registered User” may also include students, visiting academics, contractors, sub-contractors or independent consultants provided that any such individual is bound by confidentiality and non-use obligations no less onerous than those binding the recipient’s employees.