#  1\. Introduction

This document presents the first version of the Data Management Plan (DMP) for
the A-PATCH project. Projects funded by in the Horizon 2020 Open Research Data
Pilot are required to develop several versions of a Data Management Plan
(DMP), in which they will specify, among other things, what data will be kept
for the longer term.

The Consortium will follow the guidelines described in OpenAire1 platform and
the document “Guidelines on Data Management in Horizon 2020”. DMP describes
the data management life cycle for all datasets to be collected, processed or
generated by a research project. It must cover:

  * the handling of research data during & after the project; 

  

  * what data will be collected, processed or generated; 

  

  * what methodology & standards will be applied; • whether data will be shared /made open access & how; 

  

  * how data will be curated & preserved. 

  

The Data Management Plan will be updated - if appropriate - during the project
lifetime (in the form of updated deliverables D8.2b if needed). D8.3 in the
end of the project will conclude and describe the status of the project's
reflections on data management. New versions of the DMP could also be created
whenever significant changes arise in the project such as:

  * new data sets; 

  

  * changes in consortium policies; 

  

  * external factors’ needs. 

  

#  2\. Data Summary

Research data is any information that has been collected, observed, generated
or created to validate research findings. Datasets are the most common form of
research data. Research data can also consist field and laboratory notebooks,
diaries, questionnaires, transcripts, codebooks, videos, photographs, test
responses, slides, artefacts, specimens, samples, collections of digital
outputs, models, algorithms, workflow descriptions, standard operating
procedures and protocols.

During the initial clinical studies with off-line means, research data will be
generated with hybrid sensor array with multiplexed detection capabilities as
well as GC/MS means to detect disease-specific volatile organic compounds
(VOCs) from the surface of the skin. Furthermore, clinical data collection
forms, to obtain relevant information on disease/health status from study
participants, will be collected using secure encrypted data collection
software. The data will cover the main subject areas of the research:
demographic information, personal habits, collected clinical variables
identifying disease and measured VOC data, both signals from the sensors and
GC/MS chromatograms. The format used for the clinical dataset will be .accdb.
For the sensors’ signals and GC/MS

chromatograms, formats will include .csv and .qgd files, respectively.
Sensors’ responses can be structured in a dataset after analysis by the
Technion.

Clinical datasets will be processed and analysed using Apache Flink or Spark
software. Files from the sensors’ signal can be processed and analysed using
Matlab or python software. GC/MS chromatograms will be processed and analysed
by designated GC/MS analysis as well as Matlab or python software.

Information, which will be collected in a later stage with the A-PATCH
prototypes (not by off-line means), will generate secured files in a possible
format such as .dat and will be uploaded to the cloud to will be stored there
in a dataset structure in a combination with the clinical dataset. A
classification algorithm will be applied on these datasets in order to provide
the test result.

In Grant Agreement under Task 7.3 also various other kind of data collection
is described: _“Focus groups, interviews, and specific co-design sessions with
stakeholders will take place starting in the first year. Interactions with
users can be web-based user surveys, through interactive websites such as
Twitter or_

_Facebook, but it is also vital to encourage real-life, face-to-face exchanges
in workshops, public discussions, and general interest conferences to gather
feedback from future potential users on important issues such as acceptance,
enduser value and business opportunities. Stakeholder engagement meetings will
take place at relevant conferences and in tandem with consortium meetings as
well as activities of VTT within WP8, exploitation activities of BRL and of
end-user partner FIND_ .”

As a general rule, all persons who take part in surveys, interviews and
testing experiments conducted in project and register on the various platforms
will be fully informed and will be asked in advance to state, by signing an
informed consent form, that they are fully aware of the study procedure and
that their participation is completely voluntary. In the informed consent
form, it is explained that research subjects can withdraw from the experiment
at any time. Participants will be explicitly asked for permission for
recordings (audio or video) and permission to use the material for the
research and where feasible in other purposes _e.g._ further research, further
development or demonstration purposes ( _e.g._ conference presentations). To
formalise the agreements with the research subjects, a template for Informed
Consent Form has been prepared and will be translated into the national
languages, when needed. Similarly information sheets will be prepared in
relevant national languages to explain the project and its objectives to the
research subjects.

Potential re-utilization will be enabled and quality of the data ensured by
careful documentation of data collection methods as well as the contents of
the datasets. Possibility to re-use any existing open research data will be
examined carefully during the project.

#  3\. FAIR data

##  3.1. Making data findable, including provisions for metadata

Quality control measures will be taken to maintain the accuracy of data during
the project. Discipline compliant metadata elements will be used describing
the data to aid data discovery and potential re-use. Metadata of opened data
will be made available for research and re-use after project closure.

##  3.2. Making data openly accessible

Decisions concerning the sharing of (selected) datasets will be taken by
project steering group. Project manager in collaboration with project partners
will take all the appropriate measures to make relevant data openly available
and usable for third parties for study, teaching and research purposes.

If, after project closure, permission to re-use the data is required, all
requests for further use of data will be considered carefully and whenever
possible approved by the principal investigator or the person mandated with
the task. Permission for data use will be granted providing there are no IPR
or confidentiality issues involved or any direct overlap of research questions
with the primary research. Permission will be provided by contacting Principal
Investigator (project manager). Contact information and appropriate procedure
will be provided in connection with other metadata.

Main focus in data sharing will be on the data underlying prospective
scientific publications ensuring the validation of results presented in
publications.

Published and FAIR-compatible data will be archived in a common and open data
repository. Recommended generic and certified repository services, either
CSC’s

IDA or CERN’s Zenodo, will be used to enhance long-term accessibility and
reusability of the data.

##  3.3. Making data interoperable

Variables and value names will be constructed following general data
processing conventions common to the research subject. List of value names and
used vocabulary will be provided in a separate list. Examples of vocabulary
information to be managed within the project will be _e.g._ number of
variables / units of observation, list of variables with the name and label of
each variable as well as its values and value labels, frequency distribution
of each variable, information on the classifications used and meanings of
abbreviations used.

##  3.4. Increase data re-use (through clarifying licences)

Ownership of datasets will belong to project consortium after the project
completion. Creative Commons licence CC-BY-SA or CC-BY will be used for any
opened datasets, unless there are compelling reasons to select more restricted
type of CC-licence. Creative commons licences will by default include also a
disclaimer of liability for the re-use of opened data.

No definite period or time limit is planned for access or re-use of the data.
Justification for possible case-specific embargo for published data will be
decided by project consortium. Embargo will be sought primarily in connection
with any potential patent application based on project results.

#  4\. Allocation of resources

Costs related to research data management and opening are eligible as part of
the project grant. Cost allocation is based on the assumption that maximum of
5 % of total project costs will be needed to make research data quality-
controlled, FAIRcompatible and as open as possible.

During the project consortium partners will be responsible for managing and
curating datasets at their possession. At the project ending, consortium
steering group will mandate Principal Investigator or project data manager to
take care of long-term preservation and sharing of datasets.

#  5\. Data security

At the beginning of the research project, the research consortium will decide
and agree on the tasks, roles, responsibilities and rights relating to data
collection, dataset management and data use.

During the project research, datasets will be available only to those project
partners or project consortium members, who have been accredited by and their
data usage has been approved by Principal Investigator or authorized project
consortium member. Project partners will be responsible for curating,
preserving, disseminating and deleting in appropriate manner the datasets in
their possession. Retention time for curated datasets will be the same as for
other project results at the project consortium partners.

Data collected or acquired within the project will be stored in a secure IT
environment behind a firewall at premises or in secure cloud environment
provided by project consortium partners. Access to it will need registration
and authentication. Principal Investigator will check applications for the use
of data. Where access is granted to research data, this will be provided
through a physically and virtually secure telecommunications network.

Long-term and secure preservation of published research data will be ensured
by using only certified and OpenAIRE guidelines compatible repositories.

#  6\. Ethical aspects

Privacy of the project participants and persons involved will be secured by
following closely all the relevant EU General Data Protection Regulations. No
person or organisation involved will be unintentionally identifiable directly
or indirectly in the datasets. Besides storing separately from the data, all
direct identifiers of any respondents or subjects ( _e.g._ names and contact
information of persons and organisations) - also indirect references to _e.g._
lines of businesses, branches or industries - will be removed and destroyed
after the anonymised dataset has been checked and validated.

Research integrity and ethical principles related to data collection and use
are covered in detail in the ethics self-assessment section of the grant
application. According to guidelines set by Research Ethics Committee, ethics
review is required for the project as sensitive personal data will be
collected or handled within the project. Approvals by the competent legal
local Ethics Board will be provided in the clinical evaluation site. By
submitting the application for scrutiny to the competent local/national
ethical boards/bodies for authorization, detailed information will be provided
on the informed consent procedures that will be implemented. Copies of
examples of Informed Consent Forms and Information Sheets in language and
terms understandable to the participants will be included.

Ethical issues in relation to data collection and management are presented in
the following deliverables:

##  D9.1 H - Requirement No. 1

2.9 Copies of opinions/approvals by ethics committees and/or competent
authorities for the research with humans must be kept on file.

2.3 Templates of the informed consent/assent forms and information sheets (in
language and terms intelligible to the participants) must be kept on file.

##  D9.2 POPD - Requirement No. 2

4.2 The host institution must confirm that it has appointed a Data Protection
Officer (DPO) and the contact details of the DPO are made available to all
data subjects involved in the research. For host institutions not required to
appoint a DPO under the GDPR a detailed data protection policy for the project
must be kept on file.

4.3 Justification for the processing of sensitive personal data must be
included in the grant agreement before signature.

4.6 A description of the technical and organisational measures that will be
implemented to safeguard the rights and freedoms of the data subjects/research
participants must be submitted as a deliverable.

4.7 A description of the security measures that will be implemented to prevent
unauthorised access to personal data or the equipment used for processing must
be submitted as a deliverable.

4.8 Description of the anonymization/pseudonymisation techniques that will be
implemented must be submitted as a deliverable.

4.9 Confirmation that transfers of personal data from the EU to a non-EU
country ( _i.e_ . Israel) are in accordance with Chapter V of the General Data
Protection Regulation 2016/679, must be submitted as a deliverable.

4.11 Detailed information on the informed consent procedures in regard to data
processing must be kept on file.

4.12 Templates of the informed consent forms and information sheets (in
language and terms intelligible to the participants) must be kept on file.

4.15 In case of further processing of previously collected personal data, an
explicit confirmation that the beneficiary has lawful basis for the data
processing and that the appropriate technical and organisational measures are
in place to safeguard the rights of the data subjects must be submitted as a
deliverable.

**D 9.3** **A - Requirement No. 3**

5.1. Copies of relevant authorisations for animal experiments must be kept on
file

##  D 9.4 NEC - Requirement No. 4

6.1. The applicants must ensure that the research conducted outside the EU is
legal in at least one EU Member State. This must be specified in the grant
agreement.

6.4. Copies of export authorisations, as required by national/EU legislation
must be kept on file.

##  D 9.5 GEN - Requirement No. 5

12.4. A report by the Ethics Advisory Committee must be submitted as a
deliverable at the end of each reporting period.

#  7\. Other issues

At this stage project will not make use of other

national/funder/sectorial/departmental procedures for data management

#  8\. Conclusions

All participants in this project are committed to the responsible professional
principles and code of conducts and will conform to the current legislation
and regulations in countries where the research will be carried out. The
consortium is committed to rigorously apply Ethical standards and guidelines
of Horizon 2020 in all work regardless of the country in which the
research/demonstration is carried out. The project complies with the Charter
of Fundamental Rights of the EU. We subscribe to the requirement within H2020
to deal with ethical issues, which is anchored in the regulation setting up
H2020 (Regulation No1291/2013). Article 19 (1) of this regulation is as
follows: “ _All the research and innovation activities carried out under
Horizon 2020 shall comply with ethical principles and relevant national, Union
and international legislation, including the Charter of Fundamental Rights of
the European Union and the European Convention on Human Rights and its
Supplementary Protocols. Particular attention shall be paid to the principle
of proportionality, the right to privacy, the right to the protection of
personal data, the right to the physical and mental integrity of a person, the
right to non-discrimination and the need to ensure high levels of human health
protection_ .”

In the A-PATCH project, privacy and data security in data collection, analysis
and storage in the use of the device and in the research activities of the
project are seen as major aspects causing risks. This is why data safety has
to be an integrated part of the project. Users’ recordings (of clinical,
physical and physiological data) will be collected in the validation of the
A-Patch technology and applications. Information about user needs is gathered
through questionnaires, observations and interviews.

Technological development and globalization have raised new challenges
concerning privacy and data security. To answer this fast digital change the
new General Data Protection Regulation No 2016/679 is under the period of
transition and starts to apply from 25 May 2018. According to the new Data
Protection Regulation, the new rules will improve the protection of the EU
citizens' fundamental rights to personal data protection especially in digital
services.

The studies ( _i.e_ . data collection, analysis and management) will be
conducted according to the relevant Laws and Directives including:

_Directive 95/46/EC: Protection of individuals with regard to the processing
of personal data and on the free movement of such data._

_Directive 2002/58/EC: Processing of personal data and the protection of
privacy in the electronic communications sector._

_Charter of Fundamental Rights of the EU, 2000._

_The new General Data Protection Regulation No 2016/679 will apply from 25 May
2018._

_Medical device Directive (MDD 93/42/EEC)_

_EU Regulation No 536/2014 on clinical trials on medicinal products for human
use_

_EU Directive 2006/24/EC of 15 March 2006 on the retention of data generated
or processed in connection with the provision of publicly available electronic
communications services or of public communications networks_

_Directive 98/44/EC: Legal protection of biotechnological inventions_

_Directive 2001/20/EC or Clinical Trials Directive of Implementation of good
clinical practice in the conduct of clinical trials on medicinal products for
human use._

_Art. 29 - Data Protection Working Party: Working Document on Privacy on the
Internet_

_CIOMS: International Ethical Guidelines for Biomedical Research Involving
Human Subjects (2016)_

_WMA: Declaration of Helsinki of June 1964 and subsequent amendments; UNESCO:
Universal Declaration on Bioethics and Human Rights (2005);_