#  General

In the PAPA-ARTiS trial, the Clinical Trial Centre (CTC-L) at the University
of Leipzig will be responsible, on behalf of the legal trial sponsor
University of Leipzig, for implementation of procedures for data collection,
storage, protection, retention and destruction. The CTC-L has implemented a
data safety and security concept according to the requirements of the German
Federal Office for Information Security (  _www.bsi.bund.de_ )  . All PAPA-
ARTiS-related procedures will be developed in cooperation with the data
security engineer of the CTC-L and have to be approved by the official data
protection officer of the University of Leipzig prior to implementation.

Chapter 14 of the trial protocol lists all aspects of data collection, storage
and protection.

#  Data Collection

Two types of data will be collected in the PAPA-ARTiS trial: a) _clinical
data_ and

b) _imaging data_

Investigators in the recruiting trial centers will initially collect all data.
Together with information on the trial, eligible patients will be informed
about data capture, transmission and analysis processes. Once a patient is
eligible, and has given his/her informed consent to trial participation and
data collection, the investigator will assign the patient a unique patient
identification code. Patient identification code lists will be generated in
advance by the CTC-L and forwarded to the recruiting centers. These lists are
part of the investigator site file and remain at the recruiting site.
Furthermore, these lists are the only documents that allow for
reidentification of the patients.

The CTC-L will design CRFs and develop validated eCRFs (electronic case report
forms) for data capture directly at the trial sites. Additionally, CTC-L is
responsible for the eCRF training to staff of all sites and all monitors. The
investigators (or their designated staff) will enter all clinical data into
these eCRFs. Patient data will be recorded in pseudonymised form (i.e. without
reference to the patient’s name) using exclusively the patient’s
identification code.

#  Data Storage

The EDC Tool secuTrial® by InterActiveSystems GmbH will be used for data base
programming. SecuTrial® uses an underlying Oracle database. The study database
will be developed and validated according to the Standard Operating Procedures
(SOPs) of the CTCL prior to data capture. All information entered into the
eCRF by the investigator or an authorized member of the local study team will
be systematically checked for completeness, consistency and plausibility by
routines implemented in the database, running every night. Data management
staff of the CTC-L will check error messages generated by these routines. In
addition, the query management tool of secuTrial® will show discrepancies,
errors or omissions to the investigator/data entry staff based on the pre-
programmed checks. The CTCL will supervise and aid in the resolution of
queries, should the site have questions. Corrected data will be re-checked by
automatic routines during the night after entry.

If a query cannot be resolved, the Data Management staff of the CTC-L will ask
the coordinating investigator and/or the biometrician, if they may close the
query (e.g. if it is clear that this data cannot/ was not collected).

#  Data Protection

##  Access, Changes and Monitoring

During the whole course of the study, all data undergo a daily backup. An
access concept for the trial database will be implemented, based on a strict
hierarchy and role model. Thus, data access is limited to authorized persons
only, and unauthorized access to pseudonymised patient data is prevented. Any
change of data (e.g. error correction during query management) is recorded
automatically via an audit trail within the database. At the end of the study,
once the database has been declared complete and accurate, the database will
be locked. Thereafter, any changes to the database are possible only by joint
written agreement between coordinating investigator, biometrician and data
manager.

Clinical monitors appointed by the CTC-L (for Germany) or ECRIN (for all other
involved countries) will regularly visit the recruiting centres and verify the
informed consent forms. Only after monitors confirmed that a patient has
unambiguously given his or her consent for trial participation as well as for
data capture, transmission and analysis, the data will be used for analyses.

##  Pseudonymisation

Local investigators will be trained by the CTC-L prior to study start on the
pertinent procedures for pseudonymisation. There is no risk for
pseudonymisation failure as far as the eCRFs are concerned, because no
identifying data will be entered in the eCRF. However, pseudonymisation
failures may arise with the imaging data. It may happen that investigators
upload images labelled with the patient’s name. A SOP will be developed by the
CTC-L together with the imaging reference centres on how to deal with this
situation (e.g. ask the responsible investigator to delete the non-
pseudonymised record and upload a pseudonymised record instead, retrain
investigators at the site concerned, inform the trial sponsor on the problem).

Additionally, human cells/tissue will be collected in a sub-group of patients
for a scientific subproject. Labelling of the samples will be exclusively with
the trial identification number of the trial participant. Samples will be
processed, stored and analyzed only by using the trial identification number.
Any scientific research making use of the data beyond what is spelled out in
the protocol of the clinical trial will be conducted in accordance with the
applicable law on data protection and the patient will be asked explicitly to
provide consent on participation in the scientific projects and pseudonymised
storage and use of his/her samples.

Since in the course of the trial contact between the trial centre and the
patients might be necessary, the patients’ full name, address and telephone
number will be ascertained and stored at the treating trial site after
obtaining written permission to do so. This information will be stored
separately from the trial data.

##  Withdrawal of Consent

Patients may withdraw their consent to participate at any time without giving
reasons. Nevertheless, the patient should be asked for the reason of the
premature termination after being informed that he/she does not need to do so.
Information as to when and why a patient was registered/randomized and when
he/she withdrew consent must be retained in the documentation.

In the event of withdrawal of consent, the necessity for storing data and/or
samples will be evaluated. While Regulation (EC) No 45/2001 of the European
Parliament and of the Council [1] strengthen personal data protection rights,
encompassing the right to access, rectification and withdrawal of data, it
also specifies the situations when restriction on those rights may be imposed.
The withdrawal of informed consent should not affect the results of activities
already carried out, such as the storage and use of data obtained on the basis
of informed consent before. Data not needed will be deleted as requested, with
full documentation of the reasons for deletion. Similarly, samples will be
discarded as wished.

##  Data Exchange

An “ownCloud” service will be used as a file-sharing platform in the PAPA-
ARTiS trial. Hosting and maintenance of the “ownCloud” service takes place at
the University of Leipzig, behind the firewall of the institution.

The “ownCloud” file-hosting system will be used for exchange of central trial
documents as well as for imaging data for reference evaluation of the CT/MRIs.
Access to the “ownCloud” service follows the same hierarchical role concept as
the trial database. Data will be uploaded without personal information, using
exclusively the trial identification number. Trial centers will only be able
to upload data and see data concerning their own patients, while the reference
organization may exclusively download data essential for their evaluation.

Using an eCRF as well as the “ownCloud” file-hosting system, both located on
servers of the CTC-L and thus behind the firewall of the University of
Leipzig, reduces the risk of unauthorized or unlawful access, disclosure,
dissemination, alteration, destruction or accidental loss in comparison to
data transmission over a network. Access to the servers is secured via https
protocol, and requires user-specific login and password.

##  Transfer of Personal Data

The coordinating investigator certifies herewith that the transfer of
pseudonymized personal data will take place according to the documentation and
communication regulations of the GCP-guidelines (E6; 2.11) [2]. Moreover, the
coordinating investigator certifies that trial participants who do not permit
the transfer of data will not be admitted to the trial.

#  Data Retention and Destruction

After reaching the study aim/after finishing of all concomitant scientific
projects, personal data will be stored in an anonymous manner for 30 years.

The data sets made available to the scientific community (for dissemination
purposes) will be raw and anonymized and will be released one year after the
completion of the trial, when registration is completed.

#  Adherence to National and EU Legislation

We hereby confirm that all clinical trial information will be recorded,
processed, handled, and stored by CTC-L on behalf of the coordinating
investigator in such a way that it can be accurately reported, interpreted and
verified while the confidentiality of records and the personal data of the
subjects remain protected. This is done in accordance with the applicable law
on personal data protection, with Directive 95/46/EEC [3] and regulation (EC)
No 45/2001 of the European parliament and of the council [1]. This also
accounts for the reference centers and the investigators at the trial sites.
The clinical site contracts will also ensure that the clinical sites comply
with national data protection laws.