Privacy statement HDGW series   (FOR PATIENTS, PARENTS AND CAREGIVERS)
Version: February 19, 2025

Who are we and what is our purpose?
Human Disease Genes website series (HDGW) is an international library of websites for professional information about genes and copy number variances and their clinical consequences.

HDGW is a research initiative of the department of Human Genetics of the Radboud university medical center, Nijmegen, in collaboration with the University of Washington and the University of Adelaide. These parties are joint controllers within the meaning of art. 26 GDPR. Radboudumc shall act as a data processor on behalf of all joint controllers. Considering art. 26 GDPR, the main agreements between these parties are mentioned below.

The aim of the Human Disease Genes website series (HDGW series) is to establish an international rare disease (patient) registry to collect the clinical features of new variants in the human genome (gene variants) and to share this information so that clinical information is up to date and can be used in primarily patient follow-up and care, and for future research on rare diseases.

Data subjects
Personal data of different data subjects may be processed on the platform:
•    patients, parents and care-givers (who will find useful information on the disease). Any individual with a rare genetic disorder is welcome to enroll in the HDGW series patient registry. A parent or guardian may enroll a child who is under the age of 18. A Legally Authorized Representative (LAR) may enroll an adult over the age of 18 who is unable to consent. This privacy statement only includes information for patients, parents and caregivers;
•    professionals (who will find relevant information that helps with interpretation of variants and counselling of their patient and will have the opportunity to share clinical data);
•    researchers (who can use the platform to share functional or other data).

Please click here for the privacy statement with information for professionals and researchers.

Categories of data

These categories of data may be processed on the platform:
•    personal data (e.g. contact information, date of birth);
•    health data (clinical and phenotypic features);
•    genetic data (specific gene variants);
•    country of origin  and/or racial data

What are our grounds of processing and what will happen with this collection?
Participation in the HDGW series patient registry is voluntary. Processing of your data does not take place without your explicit consent or other legal basis for processing.

If you choose to enroll, you will be asked to complete a brief questionnaire(s). The questionnaire(s) requests your basic contact information, socio-demographic, and clinical features related to the genetic disorder. In addition, you are asked to inform us on the way you wish to communicate and which data you provided may be used.

The provided data will be stored in the Netherlands in accordance to the General Data Protection Regulation (GDPR). HDGW series will send a reminder if your questionnaire has not been completed, and will send an annual reminder to update your information or confirm that it is up to date.

Optional: linking your account to a family member’s account

Sometimes, it is important for researchers to know how many members of a family are affected by a given condition and how the disorder is inherited within a family. You will have an option to link your account with other family members who are enrolled in HDGW series. By linking your account to a family member's account, you are agreeing to have your date of birth, and family relation shown to the family member to which you would like to be linked. You will not be able to look at or edit each other’s  accounts and therefore medical information. The exchange of the linking information is automated and clinicians and researchers will not be able to identify who the individuals are; rather they will only know that you are related to the family member you have linked to.

Clinical data
It may also be important for clinicians and researchers to know how you presented in the clinic. To compare this your data will be linked to the professional data that is entered in the HDGW series professional Registry. For this your date of birth and/or the name of your physician will be used. This will not be visible for the other clinicians and researchers; however they will see the specific clinical data that was entered. All relevant clinicians and researchers will be bound contractually to prevent further use or sharing of that data.

Research
There are no direct benefits to participating in the HDGW series but the data you contribute may help advance clinical insight for rare genetic disorders which would benefit not only the families involved but also a wider population. By participating in the HDGW series patient Registry you may be contacted about research opportunities and clinical care you or your family member qualify for, and can decide at that time if you would like to participate, however the HDGW series cannot guarantee that a clinician or researcher will request to contact you.

What if I want to withdraw my consent?
Participation in the HDGW series patient registry is voluntary. You are free to withdraw at any time, for any reason. To withdraw, please contact the HDGW series by mail or via the contact form and select one of the following option:

1. leave all information in the HDGW series, but do not contact me again;
2. remove all information from the HDGW series.

Security
All data in the HDGW series is stored in compliance with regulations under the General Data Protection Regulation (GDPR). All information about yourself or the person under your care is also covered by medical confidentiality. The HDGW Registry database is located in a secure and fully certified data centre in the Netherlands and is certified to store medical data (NEN 7510, ISO 9001, ISO 27001). In this regard, the services of our sub-processor Moos and Spike are used. Data will be entered encoded and will be stored encrypted.

The personal data, such as name, address and other personal data that can be traced back to a person, will be kept in the hospital where the person you care for is or was being treated, with due observance of the statutory regulations. This directly identifying personal data will remain known only to the attending physician and the hospital administration and will not be given to others. The medical data that can be used for research are stored under a unique code, so that accidental incorrect linking of data is prevented, but also so that the person carrying out the research or collaborating with them does not have access to directly identifiable personal data. The results of the research may be published, for example in scientific journals. Directly identifiable data can never be found in these journals.

How will my information be accessed? Can I choose how my information is shared?
On the questionnaire(s), you can choose how you would like HDGW series to share your information. Information in HDGW series may be accessed in the following ways:

1.    the clinical and molecular data collected for a specific gene will be displayed group wise in an open ‘graph and chart’ page per gene, when data of at least three individuals is available. On this level, only the summarized clinical data is available, for instance, how many patients in total have feature x or y. These anonymized data will be visible to all the professionals and patient/families and/or any other individuals that enter this open resource. This will allow better insight in the clinical variance of the rare genetic variants and improve the clinical diagnostics.

The aggregated clinical and molecular data compiles the ages of the patients at last examination, the countries of origin, the sex, and the clinical features he/she has at present or has had. Molecular data is information about the mutation that has led to the genetic disorder;

2.    each specific gene website has a  moderator(s), who is responsible for  entering all clinical data in the protected database. These password protected data can be used by the moderator(s) to perform studies for this specific gene. This data will only be available to the specific moderator team and the professionals of the HDGW series team to perform a clinical meta-analysis;

    a.    the clinical and molecular data are the same as in the level above, but for the moderator, the data is available on a per patient basis;

    b.    if the individual submitting the data is not a physician, but him/herself or a family member (usually a parent), we will collect the name, e-mail address, country, date of submission, relation to the patient and their consent information;

    c.    the Moderator or the professionals of the HDGW series may be requested by companies to answer specific research questions in exchange for a financial reimbursement. A Registry Data Access Committee  will need to approve such use. This Committee is composed of qualified health professionals of the HDG website team, as well as members with legal and ethical expertise. If necessary, a representative of the patient board will be included in the committee. This ensures that the request for Data use aligns with the purposes of the registry and its policy. If such research is approved, the Data may be used to answer the research question but the Data itself will not be provided to such companies. However, the company may be provided with fully anonymous combined data;

3.    research by third party academic researchers;

    a.    the clinical and molecular data is the same as in the level above and possibly available on per patient basis. The third party academic researcher will be contractually bound to confidentiality and will be forbidden to use the data for other purposes than approved for.

Transfer
We are responsible for the safeguarding that the transfer of Personal Data takes place in accordance with the transfer requirements of the GDPR. We can only transfer the Data outside the European Economic Area, provided that the following conditions are met: 1) the Steering Committee has approved such transfer 2) the Coordinator has put in place appropriate safeguards such as signing the Standard Contractual Clauses in accordance with decisions by the European Commission to safeguards such transfer (to the extent the importer is located in a country outside the EEA for which no adequacy decision is in place), 3) such third parties are only allowed to process Data in accordance with the Joint Data Registry Agreement, and 4) Coordinator will on request provide information about the third party, where Data is transferred to, including copies of safeguards that is governing such transfer. Only pseudonymized data  will be shared with Partners.

Privacy agreements joint controllers (art. 26 GDPR)


Automated decision making
With us, you will not be subject to automated decision-making within the meaning of art. 22 GDPR. This means that there is always a person behind our decisions.

Your rights
Would you like to inspect the personal data we process about you or would you like to receive your (personal) data (in the context of data portability) or have it corrected, amended, supplemented or deleted? Or do you want to exercise your right to object to processing or to restrict processing?

Please let us know using the contact details. We may ask you to adequately identify yourself, for example by means of proof of identity. At that time, we request that you make your photograph, MRZ (Machine Readable Zone, the strip of numbers at the bottom of the identification document), document or passport number and BSN unrecognizable. We may also ask for further information to enable us to fulfill your request, such as sending you documentation.

We will respond to your request for access, receipt, correction, amendment, addition, deletion, objection and restriction within a reasonable period of time. This reasonable time is no later than four weeks after your request, identification and any additional documentation. Under certain circumstances, we are entitled to extend the deadline by up to two months. Our response may be a confirmation that your request will be complied with or a reasoned refusal.

Questions
For general questions about HDGW series or enrollment, please email info@humandiseasegenes.nl

If you have questions regarding the use and storage of your data, you can contact the DPO of the Radboudumc (gegevensbescherming@radboudumc.nl).

You have the right to file a complaint with the Dutch supervisory authority (for the most recent contact details see https://www.autoriteitpersoonsgegevens.nl) if you suspect that your personal data is not being processed in accordance with the applicable privacy legislation. We do hope that you will contact us first so that we can try to work things out together.

Amendments to this privacy statement
We reserve the right to change the privacy and cookie statement at any time. These changes will be announced via the Human Disease Genes website. The most current version can be found on this website. We recommend that you check this webpage regularly to see if changes have been made. We may process your personal data for new purposes not yet mentioned in this statement, as long as these purposes are in line with the purpose for which the data was collected.