#  Summary

This deliverable describes plans of how data will be managed in the CO-ADAPT
project. The focus is on guidelines and practices to ensure ethical handling
of data, in particular protect privacy and confidentiality. The sensitive data
that is collected is of participant volunteers that have signed an informed
consent to allow the project to analyse and reuse the data. The project
includes four activities where data of participants is collected: The CO-ADAPT
conversational agent application (T2.2, T2.3, T5.4, T6.4), The smart shift
scheduling study (T6.1), The proactive recommender (T2.4 , T6.3), adaptive
assembly line with cobots (T2.5, T6.2). These four activities can be
considered subprojects and operate data collection on participants all four
with different technologies and tools but respecting the guidelines proposed
on this document.

Since the technologies and tools are still being defined, the document will
not contain specific technologies, protocols and formats, as these will
specified in the deliverables concerning each of the four activities.

The conclusions are that the plan identifies activities in the project where
data is collected and clearly proposes guidelines for the data management. The
main guidelines include 1) Obtaining ethical approval from local committees
for all data collection activities, 2) Obtaining informed consent from all
participants 3) Right to refuse or withdraw for participants, 4)
Confidentiality and anonymization of data 5) Use of state of the art security
in protecting the data 6) Nominating data protection

officers 8) Training project participants on Ethical Handling of data.

#  Introduction

The project will make use of a mixture of data collection methods.

  1. **Codesign and qualitative data.** The focus groups and ethnographic observations are qualitative in nature, relying on rich data that can tell us much about people’s experiences with current technologies and preferred design aspects of the new system. All data collected through these methods will be kept confidential and will be stored on secured servers. If any of the materials in which participants could be identified are to be used in academic or educational (classroom) settings, the participants need to provide separate consent for this use. 

  

  2. **Experiments and field studies/trials** . These whether at work or in personal life, have a more quantitative approach. The project will make use of several behavioural measures (physical activity, heart rate, sleep patterns, work sheet logs, etc). 

  

  

The types of data collection for experiments and field trials are summarised
below.

_Figure 1 Overview of the 4 data gathering activities in CO-ADAPT_

The project includes four activities where data of participants is collected:
The COADAPT conversational agent application (T2.2, T2.3, T5.4, T6.4), The
smart shift scheduling study (T6.1) , The proactive recommender (T2.4 , T6.3),
adaptive assembly line with cobots (T2.5, T6.2). These four activities can be
considered subprojects and operate data collection on participants all four
with different technologies and tools but respecting the guidelines proposed
on this document.

This deliverable first introduces **GDPR** **section 2** confirming that the
project follows the principles of the regulation. **Section 3** introduces the
main Data Management approach in particular regarding ethical handling of
data. **Section 4** discusses how the project conforms with the FAIR Data Use
principles. Finally, **section 5** reports the nominated Data Protection
officers for all partners that handle and collect data.

#  GDPR

As of May 2018, the GDPR regulation applies in the European Union member
states, which creates the obligation for all consortium partner to follow the
new rules and principles. This section describes how the founding principles
of the GDPR will be followed in the CO-ADAPT project.

##  Lawfulness, fairness and transparency

_**Personal data shall be processed lawfully, fairly and in a transparent
manner in relation to the data subject.** _

The CO-ADAPT project describes all handling of personal data in this DMP. All
data gathering from individuals will require informed consent of the test
subjects, or other individuals who are engaged in the project. Informed
consent requests will consist of an information letter and a consent form.
This will state the specific causes for the experiment (or other activity),
how the data will be handled, safely stored, and shared. The request will also
inform individuals of their rights to have data updated or removed, and the
project’s policies on how these rights are managed.

The project will anonymise the personal data as far as possible, however it is
foreseen that this will be possible in all cases. In those cases, further
consent will be asked to use the data for open research purposes, including
presentation at conferences, publications in journals as well as depositing a
data set in an open repository at the end of the project.

The consortium will be as transparent as possible in the collection of
personal data. This means when collecting the data information leaflet and
consent form will describe the kind of information, the manner in which it
will be collected and processed, if, how, and for which purpose it will be
disseminated and if and how it will be made open access. Furthermore, the
subjects will have the possibility to request what kind of information has
been stored about them and they can request up to a reasonable limit to be
removed from the results.

##  Purpose limitation

_**Personal data shall be collected for specified, explicit and legitimate
purposes and not further processed in a manner that is incompatible with those
purposes** _

CO-ADAPT project will not collect any data that is outside the scope of the
project. Each researcher will only collect data necessary within their
specific work package.

##  Data minimisation

####  Personal data shall be adequate, relevant and limited to what is
necessary in relation to the purposes for which they are processed

Only data that is relevant for the project research questions and the required
coaching strategies will be collected. Since this data can be highly personal,
it will be treated according to all guidelines on special categories of
personal data and won’t be shared without anonymisation or explicit consent of
the patient.

##  Accuracy

_**Personal data shall be accurate and, where necessary, kept up to date.** _

All data collected will be checked for consistency.

##  Storage limitation

####  Personal data shall be kept in a form which permits identification of
data subjects for no longer than is necessary for the purposes for which the
personal data are processed

All personal data that will no longer be used for research purposes will be
deleted as soon as possible. All personal data will be made anonymous as soon
as possible. At the end of the project, if the data has been anonymised, the
data set will be stored according to the partners practices more information
in section 5. If data cannot be made anonymous, it will be pseudonymised as
much as possible and stored following local regulations.

##  Integrity and confidentiality

_**Personal data shall be processed in a manner that ensures appropriate
security of the personal data, including protection against unauthorised or
unlawful processing and against accidental loss, destruction or damage, using
appropriate technical or organisational measures** _

All personal data will be handled with appropriate security measures. This
means:

  * Data sets with personal data will be stored servers that complies with all GDPR regulations and is ISO 27001 certified. 

  

  * Access to this server will be managed by the project management and will be given only to people who need to access the data. Access can be retracted if necessary. 

  

  * All people with access to the personal data files will need to sign a confidentiality agreement. 

  

  * These data files cannot be copied, unless stored encrypted on a password protected storage device. In case of theft or loss, these files will be protected by the encryption. 

  

  * These copies must be deleted as soon as possible and cannot be shared with anyone outside the consortium or within the consortium without the proper authorization. 

  

In exceptional cases where the dataset is too large, or it cannot be
transferred securely, each partner can share their own datasets through
channels that comply with the GDPR.

##  Accountability

_**The controller shall be responsible for, and be able to demonstrate
compliance with the GDPR.** _

At project level, the project management is responsible for the correct data
management within the project. For each data set, a responsible person has
been appointed at partner level, who will be held accountable for this
specific data set. Each researcher will need to make a mention of a dataset
with personal information to their Data Protection Officer, in line with the
GDPR regulations.

#  Project Policies on Data

##  Overview of ethical handling of data in CO-ADAPT

As described in the 1 Introduction In the field trials, monitoring of
participants will take place. The task 8.4 Ethical Issue Management will
verify and provide to EC ethical approvals obtained by relevant local ethical
committees in Italy (UNITN, UNIPD) and Finland (FIOH, UH).

Transmission of personal data over open communication channels will be done in
encrypted form only. The people working with the data will have to have a
unique password to access the database for security purposes. In all phases of
CO-ADAPT, these crucial ethical and legal aspects will be taken into account.
As a further measure to ensure compliance with legal and ethical conduct with
private data, CO-ADAPT will provide a mandatory training session on data
privacy for all CO-ADAPT researchers (see dedicated subsection in this section
on Milestone 2) at the project kick-off and three further ones before the
start of the last user studies. The consortium is committed to maintain strict
rules of privacy and prevent all personal data from being abused or leaked.
Under no circumstances, the consortium will provide, give or sell any
information on its users to any third party (data will not be used under any
circumstances for commercial purposes).

Relatedly, CO-ADAPT will be based on strong analyses of how the design of
persuasive interaction paradigms can be created such that the influencing
strategies take into account specific ethical constraints by including
relevant ethical content and appropriate influencing strategies in the very
design of the CO-ADAPT influencing framework (developed in WP1) and thereby in
the hardware and software interfaces. Main guidelines:

**Ethical Approval** . All studies involving data collection from participants
will obtain a ethical approval from local relevant committees and such
approvals will be kept on file.

**Minimal risk** . CO-ADAPT will only use hardware that users interact with
(wearable sensors or devices for showing conversational agents) that do not
need additional safety certification (i.e., that already have been EC
certified for the specific use conditions, or that do not need any
certification as a coffee mug).

**Informed Consent** \- Written and verbal informed consent will be obtained
from all subjects participating in the lab and field trials. All consent forms
will be approved by the local ethical committees.

**Confidentiality** The confidentiality of data obtained in the study will be
safe guarded by anonymization. Encryption and anonymization of data will avoid
to identify participants or view the sensitive data. Researchers involved
commit themselves not to misuse the data collected during and after the extent
of the research. In particular they commit not to use them against
participants, nor to sell this information to third parties, and to use the
data only in anonymous format unless specifically agreed with you.

**Data security and restricted access** . The project partners commit to
employ state of the art data security and restricted access only to
researchers that have signed a confidentiality agreement.

**Sharing the Results.** We will share with participants from which data come
from the results of the overall study with you once the data has been
analyzed.

**Right to Refuse or Withdraw.** Participant has the right to withdraw
him-/herself and his/her data from the project at any time. In the case that
the participants decide to withdraw from the experiment, all data collected up
to that point would be destroyed within the following 24 hours.

**Incidental findings.** These refer to the medical problems discovered in the
course of a research / trial which were not related to the topic of research.
As a first step the research subject will be made aware of the approach being
taken in the event of incidental findings, which include the right to decide
to be informed or not of such findings, as well as the right to request data
about such findings would be deleted.

##  Co-design and Participatory Design

The CO-ADAPT project will implement active and continuous user participation
from a co-design perspective. The involvement of older users in participatory
design activities such as focus groups, ethnographic observation and co-design
workshops is foreseen. CO-ADAPT will give specific attention to any ethical
issues that will arise and will address them in a professional way following
very closely established EU regulations and corresponding national laws about
user privacy, confidentiality and consent. The main ethical issues to address
center on involving older persons in the various methods of the development
process of the augmented objects and the virtual e-coaching agent. Following
guidelines from research ethics throughout these stages ensures that
potentially problematic issues would be identified and assessed. All the work
that is done with human participants will therefore be submitted to ethical
review boards for approval. This approval will only be given if the proposed
research follows ethical codes of conduct that apply to the research
population.

Most participants in the co-design and implementation stages of the project
will be older users (contact with user groups will be established through
several consortium partners; IDEGO, UNIPD, UH, UNITN, FIOH). Participants in
all stages of the research will be given informed consent about the research
objectives. To this end, an informed consent form will be used on which it is
explained what the research is about, what is expected from the research
participants, and whether and how they will be compensated for participation.
The informed consent forms will be drafted in understandable terms to the
older participants. Additionally, there always needs to be the possibility for
participants to ask for clarifications regarding the content of the informed
consent form. Importantly, in line with codes of ethical conduct, participants
can always terminate their participation at any time with no negative
consequences whatsoever.

##  Task 8.4 Ethical Issues Management (M1-M42)

In the work package Management CO-ADAPT includes a task on Ethical Issues
Management. The aim of this task is to monitor ethical issues, where users’
personal and potentially sensitive data are collected both explicitly and
implicitly, to ensure that the CO-ADAPT activities unfolds in the respect of
the EU Regulation 2016/679 (27 April 2016) and of the codes of conduct for
professionals doing research with technologies (e.g. IEEE and ACM) and human
beings (e.g. American Psychological Association).

The deliverables D9.1-D9.5 define a set of requirements to the ethical conduct
that will be monitored by this task. In addition, a yearly presentation will
ensure training of project partners on these ethical requirements and common
ethical conduct guidelines (MS2).

The Advisory board will be called to comment on the possible ethical issues.
provide a set of guidelines at the beginning of project. These suggestions
will inform the development of the adaptive systems in CO-ADAPT.

##  MS2 Ethical practices and training

A milestone is foreseen to be delivered as a presentation for training all
project participants in ethical handling of data.

The training will include an overview of ethics in Co-adapt DoA and on the
deliverables 9.1-9.5 guidelines (inf consent, ethical app, DPM etc.). It will
also include an overview of established guidelines for example APA codes of
conduct for research with humans, with technologies and with personal data.

##  Local legislations

All studies will be conducted adhering to all regulatory and ethical national
and international requirements. More precisely:

**Finland** The data protection legislation of Finland and EU, and
corresponding regulations and guidelines are followed, as well as instructions
by the authorities responsible for each individual registry database used in
the FIOH registry study and for the study conducted by UH.

**Italy** We will comply with GDPR and with art 22 of the old national norm
(Decreto legislativo 30 giugno 2003, n. 196) regarding processing health data.
Indeed, Italy has not made public its new data protection law, although it
seems to have approved it recently ("On the 8th of August 2018, the Italian
Board of Ministries announced that they have approved the Italian privacy law
integrating the GDPR. The law has not yet been published on the Official
Gazette. According to the Government, the decisions and the authorizations
issued by the Italian DPA, the Garante per il trattamento dei dati personali,
under the regime prior to the GDPR, as well as the existing Ethical Codes,
will remain in place “to ensure continuity“ until they are updated by the
Italian DPA. Source:
https://www.lexology.com/library/detail.aspx?g=8e76f584-b6a1-4762bb1c-86aeac143c4b).

#  FAIR Principle

The CO-ADAPT project, representing a Research Innovation Action within the
H2020 framework, has a clear focus on the development of a framework that
provides principles for a two-way adaptation in support of ageing citizens. As
such, the project’s primary objective has never been to generate datasets that
are re-usable for whichever purpose. The project’s current focus is on the
design and implementation of a working software prototype. The final stage of
the project includes an evaluation study that may result in a dataset that has
potential value outside the project. As the evaluation protocol for that study
becomes clear, we will re-visit this document to describe potential FAIR Data
Use principles.

##  Making data findable, including provisions for metadata

CO-ADAPT will offer open access to results gathered throughout the project.
General awareness and wider access to the CO-ADAPT research data will be
ensured by including the repository in registries of scientific repositories.
DataCite offers access to data via Digital Object Identifier (DOI) and
metadata search, while re3data.org and Databib are the most popular registries
for digital repositories.

##  Making data openly accessible

As the repositories cover the basic principles of CO-ADAPT for publishing
research data, the consortium will pursue membership to them, without
excluding new initiatives which may arise during the forthcoming years due to
the increased interest for open access to research results and the new
European policy framework for sharing and freely accessing data collected
during publicly funded research activities. As a result, the partners will
keep track of those initiatives and will try to deposit the project’s
generated data sets at repositories which ensure compliance with the relevant
proposed standards in order to be easily exchanged. Dryad and figshare can be
also used as alternative repositories. In any case, open access to data,
following appropriate licensing schemes will be ensured. CO-ADAPT will target
“gold” open access for scientific publications and has foreseen budget for
this activity. Wherever “gold” is not possible, “green” open access will be
pursued. The target is to maximize the impact on scientific excellence through
result publication in open access yet highly appreciated journals (see initial
list below). It is worth stressing that this list includes targets where CO-
ADAPT partners have already published previous results. Furthermore,
repositories for enabling “green” open access to all project publications will
be used, as well as the OpenAIRE, which provides means to promote and realise
the widespread adoption of the Open Access Policy, as set out by the ERC
Scientific Council Guidelines for Open Access and the EC Open Access pilot.

In addition, CO-ADAPT will also release a set of core libraries from CO-ADAPT
as open source, which will be part of their exploitation strategy towards wide
adoption (D3.4, D4.4, D5.5).

##  Making data interoperable

Depending on the scientific field where the data set will originate from,
additional metadata standards might be used.

##  Increase data re-use (through clarifying licenses)

The CO-ADAPT will be implemented based on a variety of background components,
including proprietary. Based on these components and the effort to be
allocated in the project, CO-ADAPT will produce foreground, also by including
open source (royalty free) components.

#  Subprojects specific plans

##  Smart shift scheduling FIOH

####  General description of data

The data consists of quantitative registry and survey data associated to the
Finnish Public Sector (FPS) study. The registry data includes information on
the daily working hours of the employees (starting and ending times of the
work shifts), as well as information on sickness absence (without diagnosis)
as obtained from the use of shift scheduling software Titania® in the co-
operating organizations in the health and social care sector in Finland. The
survey data includes questionnaire information on areas like perceived work
ability, sleep, mental health and individual differences.

The obtained registry data of working hours consist of raw data, pre-processed
data, data analysis results as well as managerial documents and project
deliverables. Raw data are in ascii mode (work hour register), csv form
(health registers) and excel form (surveys) and will be stored in SAS-format.
The data analysis results of the raw data include data averaged for each 3 and
12 months in relation to the four main dimensions of the working hours: length
(e.g. the percentage of long work shifts or work weeks), timing (e.g. the
number of night shifts), recovery and work-life interaction.

Data consistency and quality are ensured by centralized processing and storage
of the data enabling efficient curation, harmonization and integration of the
data, resulting in reliable high-quality research data. The data has and will
be linked between registers using the Finnish personal identity codes unique
to each resident. The data will be version controlled and backed up, ensuring
its efficient storage and re-use.

####  Ethical and legal compliance

FPS data are owned by the Finnish Institute of Occupational Health (FIOH). FPS
consists of the 10-town study (PI Tuula Oksanen), hospital cohort (PI Mika
Kivimäki) and Working Hours in the Finnish Public Sector study (WHFPS, PI
Mikko Härmä). The FPS study has been approved by The Ethics Committee of the
Hospital District of Helsinki and Uusimaa (HUS 1210/2016). We will comply with
the protocol by removing personal information (personal identification code)
from the data before sharing it with researchers to ensure privacy protection.

FIOH has written contracts with all the FPS and other organizations to agree
on the use of obtained data, co-operation and feedback in this project.
Results of the COADAPT project will be presented in statistical form so that
no individual can be identified indirectly from published reports.

Ethical issues are considered throughout the research data life cycle. The
data includes personal and sensitive information, and therefore we will ensure
privacy protection and data pseudonymisation. Data quality control ensures
that no data are accidentally changed and that the accuracy of data is
maintained over their entire life cycle. We take into account the effects of
the new Finnish data protection act (based on the EU’s General Data Protection
Regulation) on data security, personal data processing and  _anonymisation_ .

####  Documentation and metadata

The datasets in the Finnish Public Sector study (FPS) and Working hours in the
Finnish Public Sector (WHFPS) (for the register-based working hours data) are
documented as standardized metadata (person file description) on the project
websites.

##  Proactive entity recommender

**Short description** : This activity is aimed at developing intelligent
recommendations of useful entities (people, documents, topics, etc.) utilising
easily accessible interfaces that minimise for example keyboard input (Vuong
et al 2017). A user's digital activities are continuously monitored by
capturing all content on a user's screen using optical character recognition.
This includes all applications and services being used and relies on each
individual user's computer usage, such as their Web browsing, emails, instant
messaging, and word processing. In addition, microphone and camera are used to
capture entities in the real world as well. Unsupervised machine learning and
topic modelling is then applied to detect the user's topical activity context
to retrieve information. Based on this autonomously learned user model, the
system proactively retrieves information entities directly related to what the
user is doing as observed on the screen.

_**Digital activity logs** _

The digital activity logs will be recorded in a similar way of the operating
system event logs, which commonly exist in any operating systems. Logs include
the following information.

  * Text read by the user: A digital activity monitoring software attempts to capture any information changes on a device’s screen (laptop or smartphone) or waits 2 seconds upon any user keystrokes, touch, or mouse behavior (clicks/taps, scrolls, drags, gestures) and commence taking a screenshot. A screenshot will be converted into text using Tesseract 4.0, an open source Optical Character Recognition (OCR) engine. After text conversion, screenshots will be deleted to reserve a device’s disk space. 

  

  * Operating system logs: time of when the text is read, title of an active document, directory/url of the document, and an active application will be logged in the below format. 

  

_**Voice activity logs** _

The voice activity logs will be recorded based on speech recognition
technology.

  * A software attempts to capture information from a device’s microphone. Audio streams will be converted to textual logs. 

  

_**Detection of entities in the real world** _

Using computer vision technology entities will be recognised in the real world
for example through OCR.

####  Relevance Assessments

We collect relevance assessments on the entity information that are
recommended during the task. The participants rate the entity information
(keywords, documents, applications) on a scale from 0 to 3 (0: not relevant,
1: low relevance, 2: medium relevance, 3: high relevance). Participants assess
relevance of recommendation in an excel file with 3 fields (word ID, plain
text words, relevance score). This file is automatically generated after the
participant finishes a task. Plain text words column will be manually removed
by participants before handing over the excel file to the experimenter.

####  Data minimization, security and management

_Data minimization_ : We minimize the amount of data processed to what is
absolutely necessary for carrying out the purpose of the research. We avoid
storing and archiving personal data, such as plain texts of the digital and
voice activity logs.

_Data security_ : We provide a level of security that is appropriate to the
risks represented by the processing of personal data (both digital and voice
activity logs). Personal data collected are stored on local hard drive during
data collection phase. We use encryption to ensure that personal data would be
unintelligible even if data breaches occur. We also minimize the risk of any
data breaches on users’ personal computers by helping them fulfilling basic
security measures and by using the secure infrastructure of University of
Helsinki during the lab tests.

_Data management_ : All interaction logs during the lab tests and relevance
assessment sheets collected and archived for the purpose of the evaluation of
the system will be anonymized. Users are identified by 5-digit codes given by
themselves. Identifiable information about users in the logs and relevance
assessment sheets will be removed before handing over to the researcher in
charge. Signed informed consent sheets will never be digitised and kept in a
locked room; Anonymized logs and relevance assessment sheets are stored in the
secured server located in University of Helsinki.

We expect no risk beyond the risks users encounter in their normal life, but
any potential security risks of data breaches mentioned above which can be
minimized by advising the users to install a reliable antivirus software and
avoid new software installation during the study.

Additional information that cannot be determined at this point such as server
setups, formats and security measures will be found in:

19

**Data Management Plan**

##  Adaptive Assembly line with co-bots

**Short description:** the activity comprises the introduction of an adaptive
workstation paired with a collaborative robotic arm (i.e., a cobot) that will
support the employees in the unfolding of their regular working tasks. More
specifically, the adaptive assembly workstation, will adjust its features to
the physical and perceptual characteristics of each specific user, e.g.,
height and level of brightness. Furthermore, the workstation will assist the
worker as s/he is performing her/his usual activities. Indeed, several
implicit metrics (e.g., pupil dilation, blink duration and rate) will be
continuously and unobtrusively acquired to monitor the user’s workload by
means of wearable devices (e.g., eye-tracking glasses, smart T-shirts/chest
band, surface electromyography (EMG). By doing so, the workstation will detect
transient changes in the employees’ status and will adjust accordingly and in
real-time its operating, so as to support her/him. For instance, if the system
senses that the user’s cognitive workload or stress level have overpassed a
given threshold, it would activate a ‘lightguidance’ indicating to the
employee the next action to accomplish or it would slow down the workflow
speed. In addition, the cobot should assist employees in repetitive tasks,
e.g., handing over the components to be assembled, thereby relieving their
workload. Taken together, such interventions are expected to reduce the
overall level of stress and to positively impact on well-being and
satisfaction. Overall, the targeted working activities will be video-recorded
in order to allow a subsequent computersupported video-analysis to investigate
how and to what extent the employee’s working practices change as a
consequence of the cobot introduction. The working experience will be assessed
also through self-reported metrics, i.e., questionnaires and interviews.

**Data collected** : Overall, several metrics will be gathered in order to
accomplish the planned adaptations in the work system: physical
characteristics of the workers (e.g., height), measures of cognitive workload
(i.e., pupil dilation, blink duration and rate, saccades amplitude and
duration), indices of stress (i.e., heart rate and heart rate variability,
prolonged muscle contraction as well as reduction in the frequency of
decontraction). Part of the measures are collected in order to assess the
effect of the adaptations in terms of: efficiency (system log-files, time on
tasks, errors, decrease in accidents); perceived well-being, safety, security,
and satisfaction (self-reported measures). The actual working practices
observed before the introduction of the cobot will be investigated using
computer-supported video-analysis that will allow to understand both
quantitative aspects of the work (e.g., frequency of specific behaviors, time
required to accomplish specific tasks) and qualitative aspects of the working
activities (e.g., need to use special equipment). A subsequent
computersupported observation, following the cobot introduction, will allow to
understand the changes in the working practices brought about by the robot.

Pupil dilation, blink duration and rate, saccades amplitude and duration will
be collected utilizing eye-tracking glasses (i.e., 120 Hz Pupil Labs). Pupil
Capture software will record the raw eye-tracking data while Pupil Player will
allow to export the abovementioned eye-tracking metrics.

A smart T-shirt/chest band (i.e., Smartex) will be utilized to record heart
rate and heart rate variability. Furthermore, surface electrodes (i.e.,
ProComp Infiniti 5) will be considered to monitor electromyographic activity.
Dedicated software will be utilized to record and export the data (e.g.,
Biograph Infiniti).

The software The Observer by Noldus will be utilized for the video-analysis of
the operator-cobots interactions.

The measures collected are then motivated by the multifold goal of the
activity, that is evaluating the performance of the user’s interaction with
the adaptive assembly workstation; identifying the most suitable and
informative psychophysiological and cognitive indices upon which the adaptive
system should rely; and finally, comprehensively investigating the workers’
perceptions regarding their own overall experience.

Additional information regarding the security measures, that cannot be
determined at this point, will be found in:

####  Data security and management

Data security: the level of security will be appropriate to the sensitivity of
the collected data (i.e., implicit psychophysiological and cognitive metrics,
self-reported evaluations, interviews recording and transcriptions,
videorecordings) and the associated risks. All the data in their raw format,
either digital or not, and in their processed versions will be archived in a
dedicated location at the premises of the HIT Center, where only the
researchers directly involved in the project will have the access. They will
be anonymized, meaning that each user will be assigned a pseudonym (e.g., P01)
unrelated to his/her actual identity, to protect his/her privacy.

Data management: Before starting the activity, all participants will receive
full and detailed explanation regarding the data that will be collected, the
modality that will be employed and the possible risks. To maximize the
understandability of the information, care will be given to avoiding technical
jargon, and participants will be encouraged to make any question to the
researchers. In addition, they will be provided an informed consent describing
all the details pertaining to the data collection, storage and management. The
aim of collecting and exploiting also implicit personal data (e.g.,
psychophysiological metrics), by means of wearable devices, will be clarified
in order to avoid any possibility of privacy and ethics violation insofar as
participants have reduced control on this type of information. The informed
consents, containing the personal data of the participants, will be never
converted in digital format and will be kept within secure locations.

21

**Data Management Plan**

The data collected using paper and pencil surveys will be converted into
electronic spreadsheets, assigning an encrypted code to each participant, to
allow their processing. Similarly, qualitative data pertaining to the
interviews will be transcribed to allow for thematic analysis.

##  CO-ADAPT conversational agent

**Short description** : The CO-ADAPT conversational agent supports the
communicative engagement between ageing workers, digital professionals (e.g.
counsellors, psychotherapists) through AI-based conversational technology. The
conversational agent will support ageing workers and digital therapists in
coping and assessing states of stress or anxiety as they go through major life
changes at home and at work. The conversational technologies will be able to
learn from different streams of signals: implicit physiological and explicit
linguistic signals. Conversational agents will be personalized to deliver
therapies to ageing workers and monitoring compliance and support digital
therapy.

The conversational agent will infer their actions and behaviour (linguistic or
multimodal) from the interaction signals with users and from the behavioural
knowledge base. The knowledge base will model and encode the possible
relationships between emotional patterns and factors of change (e.g. life
events) and resistance to change, and the role of persuasion in that process.

The framework will manage data in compliance to the processes and API that
will be established in the data collection and analytics work package (WP4).

**Data collected** :

The knowledge base to be used to feed the conversational agent includes
physiological signals - recorded by wearable sensors, and behavioural data.
According to GDPR definition, in CO-ADAPT we will deal with sensitive personal
data, including biometric data. Sensitive personal data will be held
separately from other personal data, and both categories of data will be
pseudonymised by replacing identifying information with artificial
identifiers. Pseudonymised data will be dealt with by CO-ADAPT partners IDEGO
and UNITN. Pseudonymised individual data of the subjects participating in the
data collection will be kept on separate file and locked cabinet by IDEGO.
UNITN will receive data in pseudonymised format, and will store such data by
technical measures that prevent the re-identification of data subject.
Security incidents, if any, will be immediately notified by UNITN researches
to their DPO (see Section 6). Data in the pseudonymised format will be kept
and dealt with for the purposes of the CO-ADAPT project. After the completion
of the project, data may be used by UNITN for further research activities, and
will not be transferred to third parties outside of an agreement that takes
into account the GDPR and the National regulations for the application of such
legislation. In particular, the data will not be transferred to research or
industrial organizations outside the European Union.

#  Data Protection Officers

Five of our partners, who process and/or store large amounts of personal data,
have appointed DPOs. They will be in charge of monitoring performance and
providing advice on the impact of data protection efforts. In addition, they
will maintain comprehensive records of all data processing activities.

_Table 1. DPOs and contact details_  
  
<table>  
<tr>  
<th>

**Partner**

</th>  
<th>

**DPO**

</th>  
<th>

**Details**

</th>  
<th>

**E-mail**

</th> </tr>  
<tr>  
<td>

**FIOH**

</td>  
<td>

Specialized researcher Simo

Virtanen

</td>  
<td>

Topeliuksenkatu 41B,

00250 Helsinki,

Tel. +358 43 825 6330

</td>  
<td>

simo.virtanen@ttl.fi

</td> </tr>  
<tr>  
<td>

**UH**

</td>  
<td>

Professor Giulio Jacucci

</td>  
<td>

Department of

Computer Science

P.O. Box 68 (Gustaf

Hällströmin katu 2b)

FI-00014 University of

HelsinkiI

Finland,

Tel. +358 29 415 1153

</td>  
<td>

giulio.jacucci@helsinki.fi

</td> </tr>  
<tr>  
<td>

**UNITN**

</td>  
<td>

Anti-corruption and

Transparency

Officer Fiorenzo Tomaselli

</td>  
<td>

Via Verdi, 8 - 38122

Trento, Tel. 0461 281114

</td>  
<td>

fiorenzo.tomaselli@unitn.it

</td> </tr>  
<tr>  
<td>

**UNIPD**

</td>  
<td>

Postdoctoral

Researcher Valeria Orso

</td>  
<td>

Human Inspired

Technology Research Centre

Via Luzzatti, 4 - 35121 Padova, Italy.

Tel. +39 049 827 5796

</td>  
<td>

valeria.orso@unipd.it

</td> </tr>  
<tr>  
<td>

**AALTO**

</td>  
<td>

Research Assistant

Zeinab Rezaei Yousefi

</td>  
<td>

Department of

Computer Science

Aalto University,

Konemiehentie 2,

02150 Espoo, (P.O.Box

15400, FI-00076 Aalto)

Finland ,

Tel. +358 46 951 8283

</td>  
<td>

zeinab.rezaeiyousefi@aalto.fi

</td> </tr> </table>