Sample Business Contracts

License Agreement - Islensk Erfdagreining ehf.

Sponsored Links

         Date                 Ref.
                              -------------              -------------

Dr. __________, physician
______________ Hospital



The Data Protection Commission has at its meeting today resolved to issue to you
a Permit to use personal data for research into the ______________________. The
Permit is subject to the terms described in Chapter II below.


It is revealed that you intend to assign a considerable part of the processing
of the personal data to Islensk erfdagreining ehf., particularly the part
involving work with genetic material. The transfer of personal data between you
(Permit Holder/Responsible Party) and IE (Processing Party) shall take place in
accordance with the work procedures described in Chapter III below. The Data
Protection Commission will, pursuant to an agreement between the Commission and
IE, appoint a person to supervise that the work is performed in accordance with
such terms, the expense of such supervision to be paid by IE.

The Data Protection Commission points out that the general principle is that the
same cipher should be used in all genetic research carried out in co-operation
with Islensk erfdagreining ehf. Accordingly, the same cipher will be used for
the encryption of data in this research, unless you request otherwise - however,
it should be emphasised that you are responsible for the anonymity of all data.

The objective of the conditions established by the Data Protection Commission is
to ensure the anonymity of participants in genetic research, by use of the
following guidelines:

1.   That research data will be preserved as clinical data in accordance with
     the current Act on Patients' Rights, the Physicians' Act and regulations on
     clinical records.

2.   That all research data at Islensk erfdagreining ehf. will be encrypted so
     that neither blood samples nor other personal data identified with names,
     identity numbers or other comparable personal identifiers are transferred
     to Islensk erfdagreining ehf.

3.   That linking between personal data on the premises of the Responsible Party
     and Processing Party takes place only with the use of a cipher.

<PAGE>   3
                                                      DATA PROTECTION COMMISSION

4.   That the use of the cipher is restricted to the supervisors of the Data
     Protection Commission and in accordance with the terms described below.

5.   That the cipher is kept secure.

6.   That the cipher will never be used for the encryption/decryption of fewer
     identity numbers than twenty at each time.

7.   That data from the research of one disease, including biosamples, will not
     be used in the research of another disease, without the express written
     approval of the person recorded or a special authorisation from the Data
     Protection Commission.

                                 WORK PROCEDURES

All processing of personal data in relation to genetic research shall be
performed in accordance with the following work procedures:

1.   The Supervisor of the Data Protection Commission shall produce A CIPHER,
     which replaces the identity number with a Personal Number (PN), i.e. a
     code. Three copies may be preserved of the cipher, one by the Data
     Protection Commission, another by the Supervisor of the Data Protection
     Commission and the third in a safety deposit box at Islensk erfdagreining
     ehf. (IE). The copies to be kept by the Data Protection Commission and in
     the deposit box of IE shall be sealed by a public notary. The safety
     deposit box of IE shall be locked with two keys, one of which shall be
     delivered to the Data Protection Commission for custody. An inspection may
     be carried out at any time to ascertain whether any seals have been broken.

2.   Supervisors shall ENCRYPT THE GENEALOGICAL DATABASE (the Book of
     Icelanders) using the cipher. The database may be encrypted as soon as new
     updates of the Book of Icelanders are ready. An encrypted Book of
     Icelanders may neither be housed in the same computer nor on the same
     computer network as an unencrypted Book of Icelanders, except under the
     supervision of the Supervisor of the Data Protection Commission. In order
     to reduce the possibility of breaching the anonymity by comparing encrypted
     genealogical tables with genealogical tables containing identity numbers,
     IE shall classify individuals according to their age so that if there are
     few individuals registered as born in certain years, the registered year of
     birth is altered so that the minimum number of individuals within any age
     group is twenty.

3.  The Supervisor shall receive:

a.  Reykjavik Municipal Hospital's register of patients diagnosed with

b.  The National Hospital's register of patients diagnosed with

c.  The Akureyri District Hospital's register of patients diagnosed with

d.  The University of Iceland Institute of Pathology's register of received
     _______ samples; diagnosis: ________________________________.

e.  The State Social Security Institute's register of patients who have been
     prescribed medication against ________________________.

<PAGE>   4
                                                      DATA PROTECTION COMMISSION

As it is important that outside parties do not obtain information on the names
of patients, except with the express consent of the patient, the assumption is
made in this Permit that the individuals in question will be contacted and that
the willingness of each individual to participate in the research ascertained
before work with data on such patients begins. It is proposed that this will be
done by the same physician who has treated the person in question, or in the
name of an institution and with the approval of a senior physician in the event
that the patient's physician is deceased or for any other reason unavailable.

The Supervisor encrypts THESE NAME LISTS with the above cipher and delivers the
lists in encrypted form to IE. The Supervisor may, if he so chooses and the
Permit Holders agree, perform such encryption in co-operation with the Genetic
Research Service Centre (GRSC), a foundation domiciled at Noatun 17, Reykjavik.
No copies shall remain in the possession of the Supervisor.

     i.e. a list of patients and relatives, and an encrypted genealogical table.

5.   The Supervisor receives from IE the encrypted list of participants,
     DECRYPTS it and prepares a list of the identity numbers and names of the
     participants. Then he decrypts the genealogical table in the same manner.
     The Supervisor may, if he so chooses and the Permit Holders agree, perform
     this decryption in co-operation with the Genetic Research Service Centre
     (GRSC), a foundation domiciled at Noatun 17, Reykjavik. The Supervisor
     delivers to you the list of identity numbers and the decrypted genealogical
     table. No copies may remain in the possession of the Supervisor.

6.   IE prints out and delivers to the Permit Holders STICK-ON LABELS for the
     labelling of blood samples, connection sheets and forms to be filled out
     for health information. Each label contains:

     - a three-letter code which is the set identifier

     - a number specifying the number of labels in the set

     - a label number (bar code)

     - the term of validity (month/year in numerals and as a bar code) The term
       of validity of labels shall be three months from the date of issue. There
       shall be no connection between label numbers and set labels. IE may,
       until three months have passed from the date of issue of the label
       number, preserve information on issued label numbers (label number
       register), the date of issue, the number of labels in each set and sample
       numbers, cf. Sub-Section 9.

7.   Participants are selected for a priority list for calling in (from families
     with two or more individuals who have been diagnosed with _________________
     ___________). You shall PRESENT THE RESEARCH PROJECT to potential
     participants and explain, among other things, issues regarding the handling
     and security of personal data, and ascertain their willingness to
     participate. The patient himself/herself shall, to the extent possible, be
     charged with the task of contacting his/her relatives. Those who are
     willing to participate shall sign a declaration of their informed consent.
     Such declarations of consent shall be in a form requiring the specific
     approval of the Data Protection Commission and the Science Ethics

<PAGE>   5
                                                      DATA PROTECTION COMMISSION

     You shall preserve all declarations of consent in a single file and treat
     them in accordance with current rules on the handling of clinical records.
     Measures shall be taken to ensure that patients have a copy of the granted
     declaration of consent. When this has been done, YOU SHALL COLLECT
     BIOSAMPLES AND CLINICAL DATA on the participants as follows:

     a.   On the arrival of the participant, a so-called CONNECTION SHEET is
          filled out. The sheet states the identity number and name of the
          participant, the date of arrival and the identifier of the research,
          i.e. the name of the disorder and the names of the Permit Holders. One
          label from a set is attached to the connection sheet.

     b.   Then BLOOD IS DRAWN from the participant, and tubes with blood samples
          labelled with labels from the same set of labels used to label the
          connection sheet. Other biosamples shall be labelled in the same

     c.   When this has been done, THE PERMIT HOLDERS RECORD CLINICAL DATA
          regarding the participant on special forms. Other information than
          specified by the Permit Holder as necessary for his purposes in the
          research plan/declaration of consent may not be collected. The above
          forms shall be devoid of any personal identifiers, and identified
          using labels from the same set of labels as used in labelling the
          connection sheet and the blood sample.

     The Permit Holder may assign the work described in this Sub-Section to the
     Genetic Research Service Centre or individual employees working on the
     responsibility of the Centre, cf. Sub-Section 10.

     All collection of health data from other sources, e.g. from clinical
     records, is subject to the permission of the registered person if he/she is
     alive. Otherwise, the authorisation of the senior physician in question
     shall be obtained.

8.   The Supervisors shall supervise the transfer of DATA FROM CONNECTING SHEETS
     encrypt identity numbers in the register and then deliver them to IE in a
     sealed envelope. When this transfer has been completed, the Supervisors
     shall keep the connection sheets for one month and then destroy them. No
     copies may remain with the Permit Holder or the Supervisor.

9.   Blood samples and forms with health data are sent to IE. On receipt of the
     data, IE RE-LABELS them and replaces label numbers with sample numbers. As
     soon as all labels of the label set in question have been received, or on
     expiry of the label number, the record in question shall be deleted from
     the Register of Label Numbers. IE shall recycle the label number as soon as
     possible. The Supervisor of the Data Protection Commission shall supervise
     the deletion of records from the Register of Label Numbers in accordance
     with the above instructions.


You are RESPONSIBLE for ensuring the treatment of all personal data as clinical
records, pursuant to the current Act on Patients' Rights, the Physicians' Act
and government regulations on clinical records, that such data are not
transferred out of the country

<PAGE>   6
                                                      DATA PROTECTION COMMISSION

and that all handling of genetic research data is in accordance with the above
work procedures.

The validity of the said Permit is subject to the condition that the required
authorisation of the Science Ethics Committee has been granted for the research
in question.

The Data Protection Commission reserves the right to revoke this Permit or amend
certain terms at any time, if this is required in the interest of personal
protection, especially if it is discovered that the Responsible Parties include
staff of the Processing Party (IE), or if there are other such reasons which may
be regarded as invalidating the premises of the Permit. Concurrently with the
issue of this Permit, older permits of the Data Protection Commission relating
to the same project are cancelled.

                   On behalf of the Data Protection Commission

                                Managing Director
Svana Helen Bjornsdottir
Kolbeinsmyri 14
170 Seltjarnarnes

Islensk erfdagreining ehf.
Kari Stefansson
Lynghals 1
110 Reykjavik