#  INTRODUCTION

##  Share4Rare motivation

The projects’ overarching goal is to break the vicious circle of the rare,
scarce investment and of the reduced research on rare diseases, and find
possible schemes and initiatives that social innovation can bring using the
value of collective intelligence. A cross-cutting model of collaboration in
the "digital arena" is needed to erase the geographical and language
boundaries that exist among the different European countries and to increase
the awareness about rare diseases. This approach will allow connecting all the
dots, needs and stakeholders in the virtual world and offering a unique
environment to improve the quality of life of the population suffering rare
conditions. In Europe they represent a significant number: around 30 million
of people. In addition caregivers and other relatives, clinicians and other
professionals can be beneficiaries of this collective awareness platform for
social innovation (CAPS) involving them in the collaborative model based on
the principles of the health crowdsources research studies (Swan, 2012).

Share4Rare (S4R) will be a bottom-up awareness platform, with the aim of
improving three important pillars: **Education** , **Sharing** and
**Research** . It will build on existing knowledge and initiatives ensuring a
space for debate and co-creation, a space for further research based on
clinical data donation and priorities set collectively.

##  Purpose of the Data Management Plan

In the Share4Rare platform data is a new gold in order to bring to the world
the real value of collective intelligence that emerges when patients, families
and clinicians share knowledge. All together they can create medical, social
and emotional information that will allow further initiatives (projects) in
order to promote better quality of life for patients and families in the field
of pediatric rare diseases.

The aim of this Data Management Plan (DMP) is to provide an analysis of the
main elements of the data management policy that will be used by the
Consortium with regard to the different types of data collected with the
Share4Rare platform.

The DMP specifically regarding clinical data covers the complete life cycle of
research. It describes the types of research data that will be generated or
collected during the project, the standards that will be used, how the
research data will be preserved and what parts of the datasets will be shared
for verification or reuse.

Figure 1: Research data life cycle (adapted from UK data archive  1  )

The DMP is not a fixed document, but will evolve during the lifespan of the
project, particularly whenever significant changes arise such as dataset
updates or changes in Consortium policies.

This document is an agreed version among the partners of the DMP, delivered in
Month 9 of the project. It includes an overview of the datasets to be produced
by the project, and the specific conditions that are attached to them.

The development of the platform that will allow the access in a private
environment to the users is expected to be ready at the end of the first
year’s project (2018). Until this moment, the unique data that we will storage
is regarding the people subscribed to the newsletter of the project (First
name, second name and email).

If before launching the tools that will facilitate sharing experiences
(virtual communities) and to donate/collect clinical data is required a new
version of this DMP the coordinator of the project will lead the process to
review this document. In this case, the revision will be aligned with the last
stage of the technical development of the platform.

##  Research data types

For this first release of DMP, the data types that will be produced during the
project are focused on the Description of the Action (DoA) and on the results
obtained in the first months of the project.

According to such consideration, a list of types of research data that S4R
will produce has been collected. These research data types include data
structures, sampling and processing requirements, as well as relevant
standards. This list may be adapted with the addition or removal of datasets
in the next versions of the DMP to take into consideration the project
developments, if this is required. A detailed description of each dataset is
given in the following sections of this document.

  1. Types 

    1. **Sign-up data** . Every user needs to be registered to access to the private areas of the platform. According with the different roles (patient, caregiver or legal guardian, clinician and researcher) a specific dataset will be collected and a specific system of authentication will ensure the access with the right role (CDA, consent document and diagnosis proof). Detailed information about the different profiles, authentication, content process, etc. has been included in the complementary deliverable “Protection of Personal Data Report”. 

  
  

  

  

An independent dataset will work for the general people interested to receive
the newsletter of the project which have consented this purpose during the
subscription process.

  2. **Observational data** . The primary source of observational data will be online questionnaires. Questionnaires will include data capture from the following areas: clinical aspects of the disease, disease development, genetic information, lifestyle, and quality of life. Observational data can be acquired at different periods and will be longitudinal. 

  

  3. **Derived data** (depending on the evolution of the platform). Data sources for derived data can be data provided in educational resources, accessed by text mining techniques. 

  

  4. **Modelling data** . Statistical modelling may provide statistical descriptions, prediction models, prognostic estimates, among other scores built from derived, observational and external databases data. 

  

  

  2. Formats 

    1. For software communications systems related to data visualization and report generation, questionnaire data and metadata will be requested and transferred in JavaScript Object Notation format (.json). 

  

    2. Plots and patient reports will be generated in Hypertext Markup Language (.html) and/or Portable Document Format (.pdf). 

  

    3. For statistical purposes, table-like formats such as comma separated value (.csv) and MS Excel compatible files (.xls, .xlsx) might also be used for data transfer. 

  

    4. The project will store information in other specialized formats including .R, .Rdata, .RProj (R); .py, .ipynb (Python); and plain text .txt files. 

  
  

  

  3. Re-used data 

  

  

S4R will use external data in order to enrich internal data generated by the
project. Initially the project will also re-use data from related data
platforms such as RD Connect  2  or OMIM  3  , among others. This will
facilitate the user experience avoiding the need to fulfill complex data
connecting this data bases in autocompleted fields, and also ensure the
validation of the data reducing the margin of error.

  4. Origin of the data 

    1. The data will be admitted from patients (parents or legal guardians) with paediatric rare diseases with no geographic constraint. Depending on the evolution of the platform, clinicians and patient advocates might also provide useful data. 

  

    2. In the case of re-used data from other external platforms, it will be retrieved from the specific data sharing platforms offered by each source, such as custom APIs or REST APIs. 

  
  

  

  

Sensitive data linked to exploitable results will not be put into the open
domain; the protection of sensitive data is a H2020 obligation. Other types of
research data will be deposited in open access repositories as described in
Section 2.

In the case of data which is linked to a scientific publication, the
provisions described in Section 6 will be followed regarding the authorship.
Underlying data will consist of selected parts of the general datasets
generated, aggregated and anonymized, with the aim of analyzing and answering
research questions.

Other datasets might be related to any public report or be useful for the
research community. These datasets might be either selected parts of the
general datasets generated in the project or full datasets (i.e. up to 2 years
of key operating data); they will be published as soon as possible, after
being review and agreed by the corresponding research team.

##  Responsibilities

Each S4R partner has to respect the policies set out in this DMP according
with the Spanish Personal Data Law and the GDPR. Datasets have to be created,
managed and stored appropriately and in line with applicable legislation.

The Project Coordinator has a particular responsibility to ensure that data
shared through the S4R website is easily available for the patient or legal
guardian (as owners of the data). Also is responsible of guarantee that
backups are performed and that proprietary data are secured (FSJD).

Authentication of the user profile will be ensured by a signed consent
document in the case of adult patients or caregivers. The electronic consent
will be followed by to sign the paper copy of the document and by send to the
Coordinator of the project (FSJD). This will be safely secured in a locked
place by the coordinator according with the legal rules. See the section
number 5 of this document for further information about the consent process
and document.

Similarly, clinicians will have a mandatory non-disclosure agreement (NDA) in
order to access to the questionnaires in the platform. This NDA will be
mandatory to be accepted after received the invitation to fulfill a
questionnaire from an adult patient or caregiver. They will be the responsible
to decide if they want to invite them in order to obtain additional wealth
data about the patient. They might accept or decline this invitation. The NDA
signature has the purpose to ensure that they don’t have any conflict of
interest regarding the research project underlined in the Share4Rare platform.

FSJD as coordinator of the project will be the responsible to lead and setup a
research team for the two pilot groups of conditions that will be studied
during the project. All the members will sign an agreement with the project
coordinator (FSJD) according with the rules that they need to follow regarding
the GDPR and about the management of the research project in which they will
be involved.

FSJD will be part of all the research projects that aim to explode the data
collected as legal responsible.

UPC, as Working Package (WP) 7 leader, will ensure dataset integrity and
compatibility for its use during the project lifetime by partners responsible
of the platform development (FSJD, Omada and UPC).

Validation and registration of datasets and metadata is the responsibility of
the partner that generates the data in the WP. Metadata constitutes an
underlying definition or description of the datasets, and facilitate finding
and working with particular instances of data (UPC).

Backing up data for sharing through open access repositories is the
responsibility of the partner possessing the data (FSJD).

Quality control of the data is the responsibility of the relevant WP leader,
supported by the Project Coordinator (UPC and FSJD).

Last but not least, all partners must consult the Project Coordinator (FSJD)
before publishing data in the open domain that can be associated to an
exploitable result and aligned with the purposes that the owners of the data
(adult patients or legal representatives) have allowed through the signature
of the Consent Document.

#  DATASETS

##  Dataset reference and name

All datasets generated by S4R should include a Uniform Resource Identifier
(URI) that uniquely identifies the dataset. Every individual dataset of a
patient will be identified by a number code (ID) in order to ensure the
anonymization of the personal data and facilitate the cross-relation between
the different datasets.

##  Dataset description

After URI information, the dataset description should include the following
information: title and description of the dataset, a set of keywords
describing the dataset, release date, publisher, contact point including name
and email, contents coverage (such as survey, genetic, clinical, aggregated,
quality of life data), multilingual information, origin of the data, target
user of the data (e.g. for general use, for computer use), versioning
information, publication scope and license.

##  Standards and metadata

Strategy for data standardization will differ depending on the structure of
the data stored within S4R. We can differentiate:

  * Raw data, stored as UTF-8 that will be enriched through the Linked Data approach (with help of RDF  4  and tools developed by Linda Project  5  ). 

  

  * Genetic data, stored in the following formats (as far as possible): Human Genome Variation Society (HGVS  6  ) Nomenclature, Human Gene Nomenclature Committee (HGNC  7  ), Reference Sequences NCBI (RefSeq) and Logical Observation Identifiers Names and Codes (LOINC  8  ). 

  

  * Clinical data will use HL7 to ensure transferability between systems, and will be enriched with Human Phenotype Ontology (HPO). 

  

  * Quality of life data will be enriched with help of a Quality of Life Ontology initially referenced from WHO ICF structures  9  . 

  

Metadata must be provided redundantly for both human and computer
interpretation. We consider two metadata content: a) Overall features within
dataset metadata should include the content described in Section 2.2; and b)
Specific features for a dataset with panel data should include specific
metadata about variables and samples, including information such as units,
variable explanation, variable long name and variable short name.

Metadata will be provided, to the extent that it is possible, adopting the
Metadata Standards Directory Working Group directives at RD-Alliance  10  .

##  Data sharing

Ultimate S4R goals stand for sharing the data generated at the end of the
project in order to allow its open use. S4R will consider different data
sharing schemes depending on the contents of the data.

For specific requests of aggregated data from third parties which has not been
approved by the patient or his/her legal representative in the Consent Form,
the Coordinator of the project can ask in the case of any need of advice to an
_ad hoc_ Data Access Committee (S4RDAC). A specific meeting may be set up to
decide if a new reuse of said data will be requested to the owners and to
initiate a re-consent process. Data sharing will be supervised by a Data
Access Committee (S4RDAC) that will be constituted at the end of year 2.
S4RDAC will be formed under the following structure:

  * One representative of the coordinating institution of the project 

  

  * One representative from the Ethics Committee of FSJD 

  

  * One representative of the patient organizations related to the specific condition - One data scientist 

  

  * One member from clinical research 

  

  * One legal advisor 

  

All authorizations by the S4RDAC should be taken by unanimous voting.

Data project access will be available in two approaches: a) bulk download; b)
data access following REST (REpresentational State Transfer) architectures.
REST APIs will be maintained by the technical partners from the project (UPC,
OMADA and FSJD). REST APIs will be described and versioned within the
platform. Older API versions will be maintained jointly with the current API
definition for the full lifetime of the project.

Dataset publication will be submitted to the authorization of the S4RDAC that
will approve/deny requests for accessing the data. The committee will evaluate
data access proposals and define a guideline of requirements for access
authorization.

All data access should be performed under identification of the accessing
user.

##  Archiving, presentation and security

All data will be physically stored within FSJD premises that are aligned with
Sant Joan de Déu Hospital Information Department Systems where physically is
located the hosting system. Anonymized datasets will also be stored at the UPC
for data analysis and scientific analysis. Releases of public datasets will be
published on the S4R project and also uploaded to the EU Open Data Portal  11
, Google Public Data  12  and the Registry of Research Data Repositories  13
, depending on the nature and target of the dataset release.

Initially, data will be processed at UPC and FJSD. Automated analysis will be
carried out at HSJD by the S4R automated analysis software. Non-anonymous data
will be analyzed exclusively within FSJD premises throughout all phases of the
S4R project.

S4R will provide feedback data with information about individual measurements
vs population measurements for different diseases in a restricted-to-user
environment. Statistical population data (free of individual identifications)
will be offered within the S4R platform for the users of any research
community (private environment). S4R will also offer APIs for exposing under
controlled access to ensure full-anonymity.

Hosting, persistence and access will be managed by FSJD and UPC, with help of
virtual machines and data processing clusters under high availability. UPC as
a public institution follows the instructions of the APDcat (Autoritat
Catalana de Protecció de Dades) regarding the data analysis of its activity
which includes several H2020 projects.

Long term value of the data will be ensured by following the best practices.

FSJD and UPC will provide with means for restricted physical access to the
data server and computing systems for avoiding unauthorized access to data
from S4R.

Long-term and large-scale digital archiving of selected primary data will be
ensured by perpetual storage at university library system (UPC) and FSJD.

Back-up systems will consist on weekly automated data back-up setups offered
by UPC (for anonymous data) and FSJD. Target data for back-up will be primary
data.

##  Versioning

Dataset and API versioning will be enforced. As a large part of the data comes
from questionnaires, changes on questionnaires should propagate to different
versions of data. Versioning will virally propagate downstream through the
analysis pathway, including secondary data, statistical models, plots and
reports. All reports should include comprehensive information on the versions
employed for the report contents including data, questionnaire and software
versions.

##  Quality assurance processes

S4R Quality Assurance and quality Control (QA/QC) will consider the following
four practices:

  1. QA/QC publications. Documents describing best practices for questionnaire creation, data input and data analysis will be written and maintained by UPC/FSJD. 

  

  2. Training. QA/QC publications will be explained in training sessions to the relevant stakeholders. 

  

  3. Verification tests. Automated controls in software will be in place to ensure that data input will comply with the QA/QC defined in the QA/QC publications. 

  

  4. Data exploration tests. Custom analysis will be performed by data scientists to check for errors through visual (scatterplots, mapping, distribution plots, and others) and automated analysis (multivariate outlier detection algorithms, and others). 

  

  

#  KEY PRINCIPLES FOR OPEN ACCESS TO RESEARCH DATA

These principles can be applied to any project that produces, collects or
processes research data. As indicated in Guidelines on Data Management in
H2020  14  , scientific research data should be easily:

##  Discoverable

The data and any associated software produced and/or used in the project
should be discoverable (and readily located), and identifiable by means of a
standard identification mechanism (e.g. Digital Object Identifier).

##  Accessible

Information about the modalities, scope and licenses (e.g. licensing framework
for research and education, embargo periods, commercial exploitation, etc.) in
which the data and associated software produced and/or used in the project are
accessible should be provided.

##  Assessable and intelligible

The data and any associated software produced and/or used in the project
should be assessable for and intelligible to third parties in contexts such as
scientific scrutiny and peer review (e.g. the minimal datasets are handled
together with scientific papers for the purpose of peer review, data are
provided in a way that judgments can be made about their reliability and the
competence of those who created them).

##  Usable beyond the original purpose: open data use

The data and any associated software produced and/or used in the project
should be useable by third parties even long time after the collection of the
data (e.g. data are safely stored in certified repositories for long term
preservation and curation; they are stored together with the minimum software,
metadata and documentation to make it useful; the data are useful for the
wider public needs and usable for the likely purposes of non-specialists).

##  Interoperable to specific quality standards

The data and any associated software produced and/or used in the project
should be interoperable, allowing data exchange between researchers,
institutions, organizations, countries, etc. (e.g. adhering to standards for
data annotation, data exchange, compliant with available software
applications, and allowing re-combinations with different datasets from
different origins).

#  LEGAL ASPECTS

##  Spanish National Law

Fundació Sant Joan de Déu (FSJD), coordinator of the Share4Rare project, is
under the Spanish legislation on data protection, and the applicable law is
Organic Law 15/1999, of December 13, on the protection of personal data
(LOPD), as the Royal Decree 1720/2007, of December 21, which approves the
Regulation of development of the Organic Law 15/1999, of December 13, of
protection of personal data (RLOPD); both norms in force in the precepts not
repealed by the Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 of April of 2016 relative to the protection of physical persons
with regard to the treatment of personal data and to the free circulation of
said data, and repealing Directive 95/46 / EC (GPDR).

FSJD conducted all the checks that were marked under the LOPD, as were the
mandatory audits in biannual data protection. The last audit dates from 2016
and was conducted by the external consultant Faura-Casas, Auditores
Consultores.

##  GDPR

FSJD is in the process of adapting to the GPDR and the new guiding principles
of the Regulation, which came into force in May 2016 and applicable as of May
2018.

The GDPR is a directly applicable standard, which does not require internal
transposition nor, in most cases, norms of development or application. For
this reason, the FSJD assumes it as a reference standard.

Two elements of a general nature constitute the GPDR's greatest innovation for
the FSJD (and for Share4Rare): the principle of _proactive responsibility_ and
the _risk approach_ .

The aspects that directly affect the Share4Rare project and under the prism of
the GPDR:

  * Legitimation basis for data processing: 

    * The platform will have a specific form to request access as active user in the private communities where users will share personal stories and experiences. At this level of interaction, non-clinical or personal data will be donated and stored in the platform. 

  

    * The website will have the informed consent for clinical data donation and data processing of Share4Rare. This consent will identify the legal basis on which the treatments will be developed, such as the new requirements of the RGPD. This document will be approved by the Ethics Committee of FSJD. 

  

    * The consent is unequivocal and explicit -following and in compliance with article 9.2.a) of the GDPR. 

  

    * The information is provided in a concise, transparent, intelligible and easily accessible manner, with clear and simple language. 

  

  

  * Exercise of rights: 

  

Whether in forms or in internal procedures of the FSJD, the exercise of rights
- access, rectification, deletion, opposition, forgetting, treatment
limitation and portability - will be facilitated in a visible, accessible,
simple and free manner.

  * Managers of treatment: 

  

FSJD will adopt the appropriate measures in the selection of the possible
persons in charge of treatment in a way that guarantees and is in a position
to demonstrate that the data processing is carried out in accordance with the
GDPR (principle of proactive responsibility).

  * Measures of proactive responsibility: 

  

This is one of the main novelties, and the Foundation and Share4Rare must
perform and keep in mind:

  * Risk analysis. 

  

  * Registration of activities. FSJD has a registry of treatment operations which contains the information established by the GDPR on issues such as: 

    * Name and contact information of the person in charge and the Delegate of Data Protection. 

  

    * Purpose of the treatment. 

  

    * Description of categories of interested parties and categories of data treated. 

  

    * International data transfer. ▪ Security measures. 

  

  

  * Data protection from design and default: 

  

The procedural measures have been thought in terms of data protection from the
very moment that data processing of Share4Rare has been designed. Such
measures are reflected in the Share4Rare platform as only treating the
necessary data regarding the quality of the data, the extension of the
treatment, the conservation periods and the accessibility of the data.

  * Security measures: 

  

FSJD (for the Share4Rare platform) has established the appropriate technical
and organizational measures to guarantee an adequate level of security based
on the risks detected. The technical and organizational measures have been
established taking into account:

  * The cost of the technique. o The costs of application. o The nature, scope, context and purposes of the treatment. o Any risks to rights and freedoms. 

  

  * FSJD has a data breach procedure, which includes any incident that causes the accidental or unlawful destruction, loss or alteration of personal data transmitted, conserved or otherwise processed, or communication or unauthorized access to said data. 

  

  * The Foundation will prepare and comply with the requirements of the GDPR a DPIA (Data Protection Impact Assessment), prior to the implementation of Share4Rare, as it is a treatment that entails a high risk for the rights and freedoms of the interested parties. 

  

  * The Foundation as an obligated entity set up the figure of the Delegate of Data Protection since May. The functions it performs both in the foundation and in the exercise of the Share4Rare are: 

    * Informing and advising on the protection of data to the FSJD and its employees. o Supervising the compliance with internal policies on data protection. o Cooperating with control entities. 

  

    * Acting as a point of contact with control entities. 

  

  

  * Data processing with minors: 

  

The Consortium is aware that it dealing with a sensitive group of patients.
The data will always be donated by adult patients (if it is the case that the
natural history of the disease allows to include them) or, in the case of
paediatric patients, by their parents or legal guardians. Considering this,
S4R takes the corresponding measures, among them:

  * The information offered to interested parties in relation to the treatment or exercise of rights must be especially concise, transparent and intelligible, and provided with clear and simple language. 

  

  * In the context of data erasure. 

  

  * The consent will be valid from the age of 18 years directly from the patient, and only in the case that the patients do not have any cognitive impairment that does not allow him or her to participate in the platform. 

  

  * Security measures and controls to ensure identities. 

  

#  CONSENT FORM

Informed consent will be mandatory for all users in the platform that will
contribute to the data donation on behalf of a pediatric patient (parents or
legal guardians) or directly and adult patient. This process is aligned with
the ethics principles and GDPR principles.

The document has been approved for the Ethics Committee of FSJD as coordinator
of the project and legal responsible of the data of the Share4Rare platform
users.

The process of obtain the consent of the user will include this steps:

  1. Sign up form. Users must accept the Privacy terms of Share4Rare in accordance to GDPR law and full fill an initial list of fields in order to identify the different roles in the platform (patient or caregiver). 

  

  2. After, the user will validate his/her email and accept the terms of participation of the platform operating policy. Afterwards the user will access to a secondary process that will finish with the signature of the consent form. 

  

  3. Questionnaire about the disease in order to fulfill this information in the electronic consent form will be mandatory for the users. 

  

  4. A copy paper of the consent form needs to be signed and send by postal mail to the coordinator of the project. 

  

  

The standard consent form itself is attached in the appendix and also the
approval of if from the Ethics Committee of FSJD.

#  SCIENTIFIC PUBLICATIONS

The Project’s authorship policy will follow the rules for academic
publications. The ICMJE  15  recommends that authorship be based on the
following 4 criteria:

  * Substantial contributions to the conception or design of the work; or to the acquisition, analysis, or interpretation of data for the work; and 

  

  * Drafting the work or revising it critically for important intellectual content; and 

  

  * Final approval of the version to be published; and 

  

  * Agreement to be accountable for all aspects of the work in ensuring that questions related to the accuracy or integrity of any part of the work are appropriately investigated and resolved. 

  

All those designated as authors should meet all four criteria for authorship,
and all who meet the four criteria should be identified as authors. These
authorship criteria are intended to preserve the status of authorship for
those who deserve credit and can take responsibility for the work.

  1. Authorship positions and the Corresponding Author will be decided, ideally, before the work is started, by the respective members of the Project Team Board. They will also be expected as individuals to complete conflict-of-interest disclosure forms. 

  

  2. According to ICMJE, the corresponding author is the one individual who takes primary responsibility for communication with the journal during the manuscript submission, peer review, and publication process, and typically ensures that all the journal’s administrative requirements are properly completed, although these duties may be delegated to one or more co-authors. The corresponding author should be available throughout the submission and peer review process to respond to editorial queries in a timely way, and should be available after publication to respond to critiques of the work and cooperate with any requests from the journal for data or additional information should questions about the paper arise after publication. 

  

  3. All authors will reserve the right to withdraw from authorship at any time. All acknowledgements must be with the consent of the persons involved. 

  

  4. A person who has contributed to Share4Rare publications but does not meet all four criteria for authorship of the manuscript should be listed in its acknowledgements section. 

  

  5. Free and comprehensive acknowledgement of individuals and groups who have given support should be done wherever possible (i.e. we gratefully acknowledge…). 

  

  

##  Internal procedure for Publications review

The recommended internal review process is:

  1. Authors write a manuscript and Work Package Leader (WP Lead) sends a draft to Project Team 

  

  2. All the WP leaders that form the Project Team will review the manuscript 

  

  3. Authors update the manuscript and send it to the Project Team for the final approval 

  

  4. Submission of the final version 

  

  

Between phase 2 and 3 the maximum deadline to respond will be 2 weeks.

#  Appendix A – Informed consent form (template)

**Appendix B**

**–**

**Ethics Committee approval of the informed consent form**