#  1 Introduction

###  1.1 Audience

This document is addressed to the general society, Commission services and
subcontracted parties.

###  1.2 Definitions / Glossary (REVISAR)

**Metadata** : Information about datasets stored in a repository/database
template; all the different elements that are defining the dataset (what,
where, when, why, and how the data were collected, processed, and interpreted,
the length of the data, resolution of the pictures, units included in each
table, picture or whatever, author, data of elaboration, etc…) are considered
as metadata.

Metadata also uses to include descriptions of how data and files are named,
physically structured, and stored as well as details about the experiments,
analytical methods, and research context.

**Dataset** : Digital information created in the course of the project which
is not a published. Administrative records are excluded. The most relevant
research data is the one related with a research output. Publications,
articles, lectures or presentations are not included also.

**Data Management Plan** : Detailed document which summaries how datasets will
be managed during the active research phase and as well as once the project is
completed. **Secondary data** : Sources that contain commentary on or a
discussion about a primary source.

**Repository** : Generally speaking, the mechanism by which the digital
content of a project is finally managed and stored.

###  1.3 Abbreviations

**DMP** : Data Management Plan

###  1.4 Structure

The document has been structured as follows:

#  2\. Data Summary

The main purpose of data collection/generation is to have available all the
data related with the patient’s participants of the study. Accordingly,
clinical, molecular and biochemistry data will be collected and reached the
right time, all this data will be analyzed. Generated data will be available
in different formats.

No pre-existing data will be use along the development of the project; all the
data involved in the achievement of the objectives will be data collected
along the same project.

Clinical data that will come from the patients recruited along the clinical
study; IPs from the hospitals selected for that purpose, will be the
responsible for collecting this information. Biochemical and molecular data
will be generated in central laboratories that have been selected for that
purposes.

At the time being, we do not have clear information about the expected size of
the all the dataset that will be generate; this in due to the fact that a
potential number of repetitions within the experimental assays will be
performed, affecting the global size of data to be collected and stored.

Clinical data provided as well as molecular information that will be generated
along the project are strictly necessary to reach the main goal of the
project, that basically is to validate and commercialize a novel, non-
invasive, simple to use kit (ColoFastTM), regulatory approved for the
diagnosis of CRC in blood.

##  3\. FAIR Data

###  3.1 Making data findable, including provisions for metadata

A standard identification mechanism has been not established yet for all the
metadata that will be generated along the development of the project.

Anyhow and generally speaking, metadata naming rules are based on CDISC SDTM
(global standards). A PDF file with CDISC annotations will be shared with
relevant study team members.

In any moment, every metadata already used can be copied, re-used and adapted
to current project.

Clear version numbers will be provided; e.g. for versioning of electronic case
report form (eCRF) by leaning on Semantic versioning structure (
_https://semver.org/_ )  .

Type of metadata expected to be created are included below:

  * Generated by Metronomia: Annotated CRF, Schema Report (Data base structure in XML format including table names variable names and labels, variable type, codelists). 

  

  * Molecular analysis data generated in central analytical labs will be generated as xls format or pdf format upon requested. 

  

  * In general, data to be storage will be save as pdf format. 

  

  * By contrast, all the intermediate data that will be used for statistical analysis purposes will be managed in xls files. 

  

###  3.2 Making data openly accessible

Research data collected from patients recruited within WP4 and generated along
the project by means of different molecular techniques will be not openly
available until data will be published in a scientific journal (always
following what was stated in articles 27, 28 and 29 of the agreement).

During research activities, only members that must in direct contact with the
metadata in order to perform activities described in the memorandum, will have
access to the data in the following conditions:

  * Regularly: 

    * CRO Project Leader and Amadix’ staff will have access to relevant protocol data within the EDC system. 

  

    * Principal investigators (PI), every site will have restricted access for the data collected in each place within the EDC system. 

  

    * External data (e.g. lab data) will be available only for selected staff in Data Management and at sites. They either have edit access (e.g. Study sites, Clinical Research Associates (CRAs), Data Management staff or read-only access (sponsor, auditors). 

  

  

  * Upon request: people involved in data management and analysis (statistician and bioinformaticians; according to agreement Art. 25). 

  

After the closure of the database, the data is downloaded as PDF files and
provided to sponsor and study sites in DVDs. Noteworthy, at the moment that
research data reach accepted status in any international journal, data will
become then open-access.

Results from the statistical analysis are highly confidential and will be
shared only under limited restrictions, mostly between CRO statistical
department and the sponsor. The same is valid for unblinded data, which can be
handled and seen only by a dedicated unblinded team.

Authorization to examine, analyze, verify, and reproduce any records and
reports that are important to evaluation of a clinical trial is restricted to
the sponsor.

Any party (e.g., domestic and foreign regulatory authorities, sponsor's
monitors and auditors) with direct access should take all reasonable
precautions within the constraints of the applicable regulatory requirement(s)
to maintain the confidentiality of subjects' identities and sponsor’s
proprietary information.

Data accessibility is depending on the type of data.

  * Access to clinical data from subjects participating in the clinical trial will be restricted to authorized personal and it will have done through logging credentials (username and password). o It is worth to mention that all data from patients will be maintained completely anonymous, only at the recruiting location, the information about the participants will be available by means of the corresponding informed consent; for the purpose of the project, participants will be exclusively identified by alphanumeric o numeric data. 

  

  * Access to systems containing patient data will be granted only to trained persons and the process for granting access is strictly defined. 

  

  * Other confidential data will be shared via username and password protected platforms (e.g. Sharepoint). 

  

  * Data included and being sent via emails: the file will be protected with password or the email will be encrypted. Internally the data will be protected by user management. Only dedicated people can access the data. 

  

With regard tools or software to be used with the aim of viewing or accessing
to the data; information is included as follows:

  * For monitoring the presence of clinical data, CLINCASE software from Metronomia will be used; (  _https://app.clincase.com/met-amadix1/app_ )  . 

  

  * For general clinical trial management (documentation managed by the CRO):  https://sis.cro-sss.de/sis 

  

  * In addition, for data viewing some tools will be needed such as: PDF Viewer, XML Viewer, SAS Viewer and eCRF access by standard browser. 

  

Data access committee was not considered as necessary since all the sites
involved in the RDM plan have already established their own management rules
according to the standards.

In the event of access data, the identity of the person will be ascertained by
means of their signature (Username and password).

Final version of metadata and/or processed data will be finally deposited in
an on-cloud infrastructure that will be under sponsor’s responsibilities.
Clinical as well as molecular data provided by Metronomia on one side and the
molecular laboratories selected for that purposes (CEA and FOBT samples
analyses and miRNA determination).

General scheme about how the on-cloud system is set up is included in the
following picture:

**Exhibit 1 On cloud Infrastructure**

Main characteristics of the infrastructure are:

  * Infrastructure installed in an external accommodation, outside the premises. 

  

  * Physical server that hosts and executes the virtual system. 

  

  * A virtual machine (VDI) for each user, which is accessed remotely through internet. 

  

  * File server and domain controller. 

  

  * Gextor application server. 

  

  * Backup management server. 

  

  * Algorithm server. 

  

  * Two external hard drives, where the backups of the IT system are stored 

  

###  3.3 Making data interoperable

Generally speaking, research data could be produced using CDISC standards
which are a global standard by definition. This is making a pooling of
different study data more effective, accordingly the data produced in the
project can be considered as interoperable that means that data exchange and
re-use between researchers, institutions, organisations, countries can be
possible if the mentioned rules for accession are fulfilled.

CDISC Standards (SDTM, ADaM etc..) will be applied in order to facilitate
interoperability of research data between members of the project according
conditions mentioned in the previous topic.

It is not expected to generate specific vocabularies that may avoid
interoperability of data, consequently, no further information or specific
elements will be generated to overcome this issue.

###  3.4 Increase data re-use

All the research data, even at the end of the project, will be of the highest
quality, have long-term validity and access will be guaranteed after 25 years
according to regulatory requirements, this responsibility lies on the sponsor.

If datasets are updated, the owner of the data is in charge of managing the
different versions and to make sure that the latest version is available in
the case of publically available data.

In any case, quality control of the data is the responsibility of the relevant
responsible partner generating the data.

No limitations have been established for the re-use of the data; accession to
the data have been already described.

#####  3.4.5 Data quality assurance

In all the situations, data quality is confirmed; information about this issue
is described in several documents that are being shared between all project’s
participants: Standard Operating Procedures, Data Management Plan, Data
Validation Plan, eCRF Test Plan, SOPs coming from the CRO.

##  4\. Allocation of resources

Each COLOFAST partner (including subcontractors) must respect the policies set
out in this DMP. Noteworthy, datasets have to be created, managed and stored
appropriately and in line with European Commission and local legislation.

Dataset validation and registration of metadata and backing up data will be
preserved indefinitely according to law; there are currently no costs for
archiving data in this repository.

Resources for long-term preservation are mainly discussed/fixed project by
project basis. A complete route map has to be established yet.

As it has been stated, CRO SSS by means of Metronomia, a German enterprise
located in Munich, will take care of the initial management of data research;
if any data is transferred to the sponsor or any of the sites (data access is
only available for specific information collected in any site), the receptor
of the information become then the responsible for the management of this
information; detailed information about the sponsor’ infrastructure for this
purpose has been described in 3.2.

**5\. Data security**

####  A) Sponsor’s infrastructure

#####  Repository access control

Both physical and logical access systems are installed in the global data
repository.

Physical equipment that supports sponsor’s central information systems are
housed in Acens, in the data center located at Madrid; VSistemas is taking
care of all this activities in the name of the Sponsor.

Access to facilities is restricted to authorized personnel only. In the case
of external personnel to Acens, this access can only be made upon request and
explicit authorization.

The premises have surveillance 24x7h and 365 days per year, with closed
circuit video surveillance. It also has redundant power systems to ensure the
continuous availability of the power supply.

With regard the logical access, to establish a connection with the computers
of the IT system, it will be necessary to authenticate with a user and
password, managed in the file server and domain controller. Different user
profiles have been established in the information system, to provide the
authorized accesses for each of them. These profiles establish their
privileges and accesses to system resources. All users must have a profile
assigned to access the system.

The user identifiers and passwords are for individual and non-transferable use
and therefore cannot be shared. Passwords are stored on the server in
encrypted form.

#####  Information backups

The procedure for backing up the system is as follows:

  * The physical server has two external hard drives connected via USB, in which the backup server makes the copies. 

  

  * Daily, at the end of the working day, incremental security backups are made of the Files, Gextor, and Algorithm servers. 

  

  * Weekly, full backup copies of the servers are made, including both data and internal security and operation configurations. 

  

  * An automatic check of the backups is carried out weekly to verify that they are correct and valid to be used in case of failure. 

  

  * A complete copy of all virtual machines (VDI) is made weekly. 

  

  * An automatic check of the backups of the virtual desktops is carried out monthly. 

  

  * Veeam Backup & Replication is used as backup software. 

  

All backups operations, both right or with error, are automatically e-mailed
to VSistemas personnel for follow-up and review.

#####  Emergency plan within repository environment

When a user of the system detects an incident, reported to the personnel of
VSistemas by means of an electronic mail or telephone call is done. This
notification is registered with the following data:

  * Incident number 

  

  * Date and time in which it occurred (in the absence of detection). 

  

  * Person who notifies it. 

  

  * Description of the incident. 

  

  * Incidence category 

  

  * Urgency or criticality 

  

The registration of the incidents will be made through the GLPI tool, based on
an internal VSistemas deployment, for its monitoring and control. The assigned
technician to the incident is responsible for resolving it and recording the
actions carried out. If he cannot resolve, it will be scaled to the
appropriate technical level, documenting this event in the IT tool and
continuing with the responsibility of racking the incident.

####  A) Clincase database information

Along the development of the trial, data storage is secure by means of the
following activities (Clincase Hosting):

  * Fully qualified hosting environment. 

  

  * All hardware owned and controlled by Quadratek Data Solution. 

  

  * First class data hosting centre with compromised security. 

  

  * Second data centre for real-time off-site mirroring of all data, daily full backups and disaster recovery. 

  

  * Automated failover of all hosting platforms (n+1 redundancy). 

  

Specifications for the second data storages are included as follows (location:
Hosting Center eShelter Berlin):

  * Server located at Collocation Area. 

  

  * All hardware owned and controlled by Quadratek. 

  

  * Vendor audit performed. 

  

  * Fully redundant hardware. 

  

  * 24x7h manned security, CCTV, electronic access system. 

  

  * Redundant power supply, internet connection, air conditioning system. 

  

  * Redundant data links. 

  

#####  Information backups

  * Backups located at second data center in Berlin (Level 3). 

  

  * All databases mirrored in nearly real time. 

  

  * Daily full backup stored on redundant encrypted hard drives. 

  

  * Retention period of daily backups up to 365 days. 

  

  * For true 24x7h operations: Independent full backups (not blocking the productive database instance). 

  

  * All Backups are tested every 6 months. 

  

#####  Security

  * Firewall protection of data hosting environment. 

  

  * Access to study servers only though HTTPS proxy. 

  

  * Use of Debian Linux Operating System for maximum access security and virus protection. 

  

  * Regular implementation of security patches (scheduled or urgent patches)  Remote access secured by SSH, role-based access restriction. 

  

  * Monthly back-up of all data to tape and daily back-up of all data to Cloud. Business Continuity Plan describes all the details. In general, all the processes have relevant standard operating procedures (SOPs). 

  

**6\. Ethical aspects**

COLOFAST project will follow ethical principles as set out in Article 34 of
the Grant Agreement, which states that all activities must be carried out in
compliance with:

  1. ethical principles (including the highest standards of research and 

  

  2. applicable international, EU and national law. 

  

  

In this line, all the institutions involved, is also taking care of respecting
the highest standards of research integrity fulfilling with the terms and
conditions described in article 34 of the agreement.

It is worth to mention that all the ethical requirements will be complied in
any case where activities put in place are linked with ethical issues.

As it has been informed, clinical trial protocol has been submitted in order
to obtain the corresponding approval in all the countries in which recruitment
sites are located; regarding the type of molecular data that will be
generated, all this information is described in the corresponding informed
consent that every of the participants must fulfil in order to participate in
the study.