WES bam files associated with HNSCC patients in the LIONESS study

1. The User Organisation agrees to only use the Data (i) for the duration and purpose of the Project; (ii) for Research Purposes; and (iii) in accordance with Research Ethics Board Approval, and any conditions or restrictions imposed pursuant to such Research Ethics Board Approval. The User Organisation further agrees that it will only use these Data for Research Purposes which are within the limitations (if any) set out in Appendix I. 2. The User Organisation agrees that in handling this Data it will follow an up-to-date information technology (IT) policy that must include, at a minimum, the following items: a. Logging and auditing of access to the Data and to the computer network; b. Password protection to computer network and/or strong data encryption; c. Virus and malware protection to computers on the computer network; d. Secure backup procedure. 3. The User Organisation agrees to preserve, at all times, the confidentiality of these Data. In particular, it undertakes not to use, or attempt to use these Data to compromise or otherwise infringe the confidentiality of information on Research Participants. Without prejudice to the generality of the foregoing or the provisions of section 2 above, the User Organisation agrees to use at least the measures set out in Appendix 1 to protect these Data. 4. COMPANY intends that any patient-level data to be disclosed to the User Organisation hereunder will be de-identified to the standard set forth at 45 CFR 164.514(b) such that it no longer constitutes protected health information (“PHI”) as such term is defined in the Privacy Rule promulgated under the Health Insurance Portability and Accountability Act of 1996, as amended. If the User Organisation becomes aware that it has received any patient-level data that has not been de-identified to this standard, the User Organisation shall notify DAC within twenty-four (24) hours of such discovery and shall follow COMPANY instructions to ensure proper return or destruction of such PHI. 5. In case of a breach of security resulting from ‘accidental’ use of Data by User Organisation or the Authorised Personnel, which leads to disclosure of Data, then User Organisation must report this to DAC within 72 hours maximum. 6. If requested, the User Organisation will allow data security and management documentation to be inspected to verify that it is complying with the terms of this agreement. 7. The User Organisation agrees to protect the confidentiality of Research Participants in any research papers or publications that they prepare by taking all reasonable care to limit the possibility of identification. 8. The User Organisation agrees not to link or combine these Data to other information or archived data available in a way that could re-identify the Research Participants, even if access to that data has been formally granted to the User Organisation or is freely available without restriction. 9. The User Organisation agrees only to transfer or disclose these Data, in whole or part, or any material derived from the Data, to the Authorised Personnel. Should the User Organisation wish to share these Data with an External Collaborator, the External Collaborator must complete a separate application for access to these Data. 10. The User Organisation agrees to follow the Fort Lauderdale Guidelines (http://www.wellcome.ac.uk/stellent/groups/corporatesite/@policy_communications/documents/web_document/wtd003207.pdf ) and the Toronto Statement (http://www.nature.com/nature/journal/v461/n7261/full/461168a.html). This includes but is not limited to recognising the contribution of the Data Producers and including a proper acknowledgement in all oral and written presentations, reports, disclosures and Publications resulting from all analyses of the Data. 11. The User Organisation agrees not to make intellectual property claims on these Data and not to use intellectual property protection in ways that would prevent or block access to, or use of, any element of these Data, or conclusion drawn directly from these Data. 12. The User Organisation can elect to perform further research that would add intellectual and resource capital to these data and decide to obtain intellectual property rights on these downstream discoveries. In this case, the User Organisation agrees to implement licensing policies that will not obstruct further research and to follow the U.S. National Institutes of Health Best Practices for the Licensing of Genomic Inventions (2005) (https://www.icgc.org/files/daco/NIH_BestPracticesLicensingGenomicInventions_2005_en.pdf ) in conformity with the Organisation for Economic Co-operation and Development Guidelines for the Licensing of the Genetic Inventions (2006) (http://www.oecd.org/science/biotech/36198812.pdf ). 13. The User Organisation agrees to destroy/discard the Data held, once it is no longer used for the Project, unless obliged to retain the data for archival purposes in conformity with audit or legal requirements. 14. The User Organisation will notify the DAC within 30 days of any changes or departures of Authorised Personnel. 15. The User Organisation will notify the DAC prior to any significant changes to the protocol for the Project. 16. The User Organisation agrees to submit a final report at the completion of the Data Access Period, or if a study is closed, upon request by the DAC. 17. The User Organisation will notify the DAC as soon as it becomes aware of a breach of the terms or conditions of this agreement. 18. The User Organisation agrees that the Data Producers, and all other parties involved in the creation, funding or protection of these Data: a) make no warranty or representation, express or implied as to the accuracy, quality or comprehensiveness of these Data; b) exclude to the fullest extent permitted by law all liability for actions, claims, proceedings, demands, losses (including but not limited to loss of profit), costs, awards damages and payments made by the User Organisation that may arise (whether directly or indirectly) in any way whatsoever from the User Organisation’s use of these Data or from the unavailability of, or break in access to, these Data for whatever reason and; c) bear no responsibility for the further analysis or interpretation of these Data. 19. The User Organisation agrees to hold the Data Producers, and all other parties involved in the creation, funding or protection of these Data harmless and to defend and indemnify all these parties against all liabilities, demands, damages, expenses, and losses arising out of the User Organisation’s use of the Data. 20. COMPANY may terminate this agreement by written notice to the User Organisation. If this agreement terminates for any reason, the User Organisation will be required to destroy any Data held, including copies and backup copies. This clause does not prevent the User Organisation from retaining these data for archival purpose in conformity with audit or legal requirements. 20. The User Organisation accepts that it may be necessary for the Data Producers to alter the terms of this agreement from time to time. As an example, this may include specific provisions relating to the Data required by Data Producers other than COMPANY. In the event that changes are required, the Data Producers or their appointed agent will contact the User Organisation to inform it of the changes and the User Organisation may elect to accept the changes or terminate the agreement. 21. The User Organisation agrees to distribute a copy of these terms to the Authorised Personnel. The User Organisation will procure that the Authorised Personnel comply with the terms of this agreement. 19. The User has to follow the General Data Protection Regulation (GDPR) as issued by the European Union (2016/679). If the User's institution is not part of the European Union, an appropriate Data Protection Policy has to be issued by the User, which will be checked by the legal and data privacy department of the LMU Klinikum Munich. 20. This agreement (and any dispute, controversy, proceedings or claim of whatever nature arising out of this agreement or its formation) shall be construed, interpreted and governed by the laws of Germany and shall be subject to the exclusive jurisdiction of the German courts.