Additional consent: external scientific research

1. What this is

This is an additional, optional consent on top of the arrangements in our privacy notice. With this consent you give an external research institution assessed by Pacely (for example a university or an academic hospital) access to a specific part of your Pacely data, for one specific scientific study to which you have been invited.

In the ordinary R&D consent we explicitly promised that we do not use your data for research outside Pacely itself without asking you again. This is that further request. It only takes effect if you are invited for a specific study, and only for that study.

This consent is voluntary. If you do not give it, Pacely works exactly the same for you, no features are removed, no extra costs, no different service level. Saying "no" once to one study has no consequence for a possible invitation to another study later.

2. How a study reaches you

An external research institution cannot reach Pacely data by itself. The route always runs through Pacely:

• A research institution submits a research proposal to Pacely, with the research question, target group, ethical review and what they are going to do with the data.
• Pacely assesses that proposal on its merits. We reject proposals that do not fit the Pacely community, that ask for a disproportionate amount of data, or where the information provided to you is not clear enough.
• If we accept the proposal, Pacely and the institution sign a data transfer agreement in which we record who is responsible for what.
• Pacely identifies the subgroup of users for whom the study is relevant, and sends you an invitation if you are part of that group.
• In that invitation we ask you for consent, under the terms of this document plus the study-specific information.

Only after you give that consent does the research account of that specific institution get access to your data, and solely for this one study.

3. What you consent to

If you give this additional consent for a specific study, you agree to the following:

• A research institution assessed by Pacely may use your data from Pacely for this specific study. Which institution, which study, which data and which period, that is set out in the study-specific information you see with the invitation, before you agree.
• The institution can view your data via Pacely and, where needed for the study, export it. The export goes through a button in Pacely's own environment, not through a direct connection to the institution's systems. Which data exactly, pacing data, moment check-ins, day summaries, observations, baselines, notes, settings, or a specific subset, is set out in the study-specific information.
• Pacely does not share any data of yours for which you have not given consent. This does not affect other studies, earlier or later consents, or Pacely's own R&D consent.
• Every view and every export is recorded. Pacely logs who it was, when and with which action, in the same overview described in privacy notice §6. You can identify research access by its own label and the name of the study.

4. What the institution does with the data

From the moment the institution retrieves the data via Pacely, that institution is itself the controller for what it does with it. Pacely remains responsible for the data as it stands in Pacely.

In the study-specific information with the invitation you see at least:

• name of the institution and the lead researcher;
• purpose of the study in understandable language;
• whether the data goes under a direct identifier (email, name) or under a study pseudonym assigned by Pacely;
• how long the institution keeps the data and what happens to it afterwards (destruction, anonymisation, archiving);
• whether results are published, and at what aggregation level;
• contact details of the institution and of its Data Protection Officer.

Results that are published may under no condition be traceable to you personally. That is an arrangement Pacely records with the institution before the study begins.

5. What the institution may not do

• Combine your data with other sources in a way that makes you identifiable again, unless that was explicitly stated in the study-specific information and you were informed about it when giving your consent.
• Share your data with parties outside the study (consortium, third parties, repositories, journals) other than in anonymised or aggregated form where re-identification is reasonably excluded.
• Use your data for a purpose other than what is stated in the study-specific information. If the institution wants something new, Pacely and you must be asked again.

6. Legal basis

This additional consent is your express consent within the meaning of article 9(2)(a) GDPR for the processing of special-category data (health data) for the purposes of a specific scientific study. The consent is fully voluntary and revocable.

The legal basis for the processing by the research institution itself, after it has received the data from Pacely, is set out in the study-specific information of that institution.

7. Withdrawal

You can withdraw this consent at any time:

• In the app, via the same button with which you gave it (in your profile settings, the "Studies I take part in" section).
• By email, via mail@pacely.nl.

From the moment you withdraw:

• Pacely immediately switches off the research account's access to your data. Further export is no longer possible;
• data that the institution received before the withdrawal remains lawfully processed (article 7(3) GDPR works forward, not backward);
• you can in addition ask the institution to delete or anonymise the data received from you. The institution has committed to this in its agreement with Pacely and will confirm it within 30 days. For scientific research a limited exception applies under article 17(3)(d) GDPR, which is explained in the study-specific information.

Withdrawal has no effect on your use of Pacely and no effect on your possible participation in other studies.

8. Who to turn to for which question

Between you, Pacely and the research institution it has been agreed who handles which question:

• At Pacely you can turn for: questions about your data as it stands in Pacely, withdrawal of your consent to participate, deletion of your Pacely account, insight into what a research account has done with your data.
• At the research institution you can turn for: questions about your data as it is stored at that institution, access to or correction of that copy, questions about the study itself, or a general complaint about the institution.

If you bring a question to the wrong party, we forward it to the right one for you, and let you know that this has happened.

You can in addition always lodge a complaint with the Dutch Data Protection Authority.

9. Retention period of your consent

The fact that you gave or withdrew consent we keep linked to your account, with date, version number of these terms, and the identification of the specific study. We keep this administrative data for as long as the retention period for account data in privacy notice §9 prescribes, so we can always demonstrate what you chose and when.

10. Changes to these terms

If we change these additional terms substantively, we ask you again explicitly for the invitations sent after the change. Studies you already take part in under an older version continue under that older version.

11. Questions or complaints

Questions or remarks? Email mail@pacely.nl. If you feel that we or the research institution are not handling your data carefully, you can in addition always lodge a complaint with the Dutch Data Protection Authority.