Spatial predictors of response to immunotherapy in microsatellite stable metastatic colorectal cancer

Data Access Agreement (DAA) Term Definition Authorised Personnel The individual(s) at the Institution requesting Access to the Data. Data Refers to controlled access data (the Data). Under this Agreement, the Data is pseudonymised (coded) such that the identity of the individual is not readily accessible to the Recipient. Data Access/Transfer Refers to an Institution’s right to request access to the Data and retrieve them from the Data Controller’s Institution upon approval of this DAA by the corresponding DAC within the Data Controller’s Institution. Data Controller(s) Refers to an Institution responsible for the generation of the Data and its pseudonymisation. A key-code permitting relinkage to Data Subjects is kept by the Data Controller(s). Data Handling Refers to an Institution’s ability to analyse and manipulate the Data within its own computer network. Data Recipient (‘You’) Refers to the Institution who requests Access to the Data through this Agreement. Data Subject Refers to any Individual who is the source of any Data covered by this Agreement. PDPA This DAA makes both parties compliant with the Personal Data Protection Act 2012 (No. 26 of 2012) of Singapore (herein referred to as the ‘PDPA’). Publications Refers, without limitation, to any and all articles published in print journals, electronic journals, reviews, books, posters, and other written and verbal presentations of Research that have been accepted by peer review. Research Project The Project for which You have requested Access to the Data. Terms and Conditions In signing this Agreement: 1. Purpose Limitation You, the Data Recipient, agree to only use the Data for the Purpose of the Project. 2. Confidentiality & Privacy You agree to preserve, at all times, the confidentiality of information and Data pertaining to Data Subjects. You undertake not to use or attempt to use the Data to compromise or otherwise infringe the confidentiality of information on Data Subjects and their right to privacy. 3. Non-Identification You agree not to attempt to identify Data Subjects. 4. Usage Restrictions You and your Authorised Personnel agree to take into consideration any usage restrictions (if any), stemming from consent, i.e., the appropriate lawful basis for processing the Data, as well as any usage restrictions stemming from any applicable internal policies of your Institution. 5. IT Security Standards You agree that in handling this Data You will follow an up-to-date information technology (IT) policy that must include, at a minimum, the following items: (a) Logging and auditing of Access to the Data and to the computer network; (b) Password Protection to computer network and/or strong data encryption; (c) Virus and malware protection to computers on the computer network; (d) Secure backup procedure 6. Duration & Scope of Access You acknowledge that Access to the Data is granted for the duration of the Project described in Section I, as well as any new Project under the same research field or area. Any use of the Data for a Project of another research field or area will need to be approved under a new Agreement. 7. No Transfer of IP Rights You recognize that nothing in this Agreement shall operate to transfer to You any intellectual property rights to the Data. 8. Intellectual Property You agree not to make intellectual property claims on the Data and not to use intellectual property protection in ways that would prevent or block Access to, or use of, any element of the Data. 9. Further Research & Licensing You can elect to perform further Research that would add intellectual and resource capital to the Data, and decide to obtain intellectual property rights on these downstream discoveries. In this case, You agree to implement licensing policies that will not obstruct further Research. 10. Limitation of Liability You agree that the Research Project: 1. Bears no legal responsibility for the accuracy or comprehensiveness of the Data; 2. Accepts no liability for indirect, consequential, or incidental damages or losses arising from use of the Data; and 3. Bears no responsibility for the further analysis or interpretation of these Data over and above that published by the Controller(s). 11. Indemnification You agree to hold the Data Subject(s) and Data Controller(s) harmless and to defend and indemnify all these parties against all liabilities, demands, damages, expenses, and losses arising out of Your use for any Purpose of the Data. 12. Publication Moratorium You agree to a moratorium on publishing global analyses of the dataset until the Data Controller(s) have published their own global analysis or twelve (12) months, the maximum, have passed from the time the Data were deposited, whichever occurs first. You acknowledge that prompt publication or public disclosure of the results of the Research Project is encouraged. You also agree that by publishing Your global analyses of the Data, you will not disclose any results generated from the Data. 13. Acknowledgement of Contribution You agree to acknowledge the contribution of the Data Controller(s) in all oral and written presentations, disclosures, and Publications resulting from all analyses of the Data. 14. Laboratory Supervision You agree to use the Data in Your laboratory. Any Authorised Personnel shall work under Your direct supervision. You agree to distribute a copy of these terms to the Authorised Personnel. 15. Non-Transfer of Information You may not transfer any information included in the Data to anyone unless specifically designated in the Research Project, or by prior specific or general written authorisation of the Data Controller(s) responsible for the generation of the original Data in each case. 16. Non-Transfer of Data You may not transfer the Data itself to anyone outside the Institution, unless the Controller(s) has (have) approved such transfer and its terms in writing. 17. External Collaborators Should You wish to share the Data with an external collaborator, the external collaborator must complete a separate Data Access Agreement. 18. Personnel Responsibility You shall ensure that 'all' who have Access to the Data, namely You and Your Authorised Personnel, will be listed out, and are made aware and be bound by the terms of this Agreement. You remain solely and fully responsible for Your Authorised Personnel’s non-compliance with the provision of the Agreement and/or applicable laws. 19. Data Breach Reporting (Accidental) In case of a breach of security resulting from ‘accidental’ use of Data by You and Your Authorised Personnel, which leads to disclosure of Data, or any unauthorised access, collection, use, disclosure, copying, modification, or disposal of Data (a 'Data Breach'), You must report this to the Data Controller(s) as soon as practicable, but no later than three (3) calendar days after discovering the breach. You agree to cooperate with the Data Controller(s) to notify the Personal Data Protection Commission (PDPC) of Singapore if the breach is a Notifiable Data Breach under the PDPA. 20. Data Breach (Non-Accidental) In case of a ‘non-accidental or minor’ breach of DAA by You, You will further be required to destroy any Data held. 21. Termination Upon Breach You accept that this Agreement will terminate immediately upon ‘any’ breach by You, or its termination (see Section I). 22. Dispute Resolution You endeavour to settle any dispute with the Data Controller(s) amicably. If you are unable to reach an Agreement, you will meet and negotiate in good faith in an effort to resolve the issue. If the issue has not been resolved within a reasonable period (e.g. 30 calendar days), you are both entitled to submit it for resolution by arbitration in Singapore in accordance with the Arbitration Rules of the Singapore International Arbitration Centre ('SIAC Rules') for the time being in force, which rules are deemed to be incorporated by reference in this clause. 23. Language Further, the language of the proceedings will be ‘English’ if not otherwise agreed. The award of the arbitration will be final and binding upon the parties concerned. 24. Governing Law This Agreement (and any dispute, controversy, proceedings, or claim of whatever nature arising out of it or its formation) shall be interpreted, governed by and construed in accordance with the Laws of the Republic of Singapore, and shall be subject to the exclusive jurisdiction of the Courts of Singapore. Exceptions to Data Sharing The Data Controller(s) reserve the right to deny access to Data or exclude specific datasets from this Agreement under the following circumstances: 1. Risk of Re-identification Data will not be shared if there is a risk that Data Subjects can be re-identified, including but not limited to: (a) Studies with small patient populations (e.g., rare disease indications). (b) Single-centre studies where local knowledge could identify individuals. (c) Data types or formats that lack established anonymisation standards. 2. Commercial & Legal Risk Data requests may be declined if: (a) There is a significant commercial risk to the Data Controller(s) alongside a risk of patient re-identification. (b) The proposed research involves Artificial Intelligence (AI) solutions deemed "High" or "Very High" risk where re-identification risks persist. (c) The Data requested is subject to legal protections, intellectual property disputes, or ongoing regulatory exclusivity. 3. Conflict with Publication Timeline Data will not be shared if the request conflicts with the Data Controller’s publication plan. Access is generally subject to a moratorium until the Data Controller has published their global analysis or twelve (12) months have passed since study completion, whichever occurs first. 4. Inability to Anonymise Where the nature of the data (e.g., genomic data, complex imaging) makes effective anonymisation impossible without destroying the scientific utility of the dataset, sharing may be refused. 5. Lack of Valid Scientific Rationale Requests may be denied if the proposed research does not have a sound scientific basis or if the requested Data is not appropriate or sufficient to answer the proposed scientific question.