Registry Privacy Policy

www.cfri.ie is the website address for the national Cystic Fibrosis Registry of Ireland. There are more than 1,000 people with cystic fibrosis living in Ireland and it is intended that their relevant medical data will be available to their medical consultants through the internet. The doctors will be able to manage their patients records and compare their patients with other cf groups of patients from other hospitals in the country on an anonymous basis.

The Cystic Fibrosis Registry of Ireland publishes this Privacy Policy to state our commitment to maintaining the privacy of the patients and doctors in the electronic environment and inform the Enrolees of our practices concerning the collection and use of information provided us.

In this Privacy Policy you will find a description of the policies and procedures created to ensure privacy for the patients. We have included in this Privacy Policy an explanation of our information practices, such as:

• Definition of terms used in this policy;
• Privacy Pledge;
• Authorisation for Registry database use;
• Limitations to the use and disclosure of information;
• Information confidentiality and security.

Privacy issues represent a growing concern for all Web users. The Cystic Fibrosis Registry of Ireland is continuously working to improve this Privacy Policy. If it is decided to revise this Privacy Policy, any and all changes will be posted here, so that Users are aware of the Cystic Fibrosis Registry's policies. To continue to stay informed about this important issue, please check this Privacy Policy frequently.

The Cystic Fibrosis Registry Management Committee of Ireland reserves the right to make changes to any part of this Privacy Policy in its sole discretion, at any time and without prior notice. Continued use of any information from the website following any such change will constitute acceptance of those changes.

This Privacy Policy applies to all those people whose information is stored in the database (collectively referred to as "Enrolees") and to those who use the information stored on the database (collectively referred to as "Users").

To make this Privacy Policy as easy to read as possible, the Cystic Fibrosis Registry of Ireland has simplified certain sentences by substituting defined terms for certain concepts. Accordingly, some terms used throughout this Privacy Policy shall have the meanings assigned to such terms in Section 8 ("Definitions") of this Privacy Policy.

The Cystic Fibrosis Registry of Ireland makes the following pledge:

• The Cystic Fibrosis Registry of Ireland is committed to protecting the privacy of Enrolees and Users at all times.
• The Cystic Fibrosis Registry of Ireland maintains security standards and procedures designed to protect Patient Information. The Cystic Fibrosis Registry of Ireland will continue to test and update available technology to improve the protection of Patient Information.

Persons enrolled in the Cystic Fibrosis Registry of Ireland have given informed consent to that enrolment at their participating hospital. A copy of the signed Consent Form is kept at the Registry offices.

Each participating hospital has given approval to the Registry through their Ethics Committee for a person from the Registry to attend the participating hospital and transcribe relevant information from an enrolee's hospital chart into the Registry database.

It is the aim of the Cystic Fibrosis Registry of Ireland to provide Users with quality information and summary reports. The Cystic Fibrosis Registry of Ireland is also committed to providing Users with responsive, personalised service, and keeping Users informed about new information that may be of immediate interest to Users or that can help Users derive the greatest value from the data and summary reports.

A visitor who browses the Cystic Fibrosis Registry of Ireland 'public' Web site is not required to reveal any Personally Identifiable Information, such as name, address, or telephone number, unless they wish to contact the Registry. Such information is not collected passively by electronic means.

Authorisation for the Registry Database use:

The primary reason that User Information is collected is to verify that the User has been approved by the Registry Management Committee:

• Registration Process:
  In order to use the Irish Cystic Fibrosis Registry, each User will be asked to complete a registration process, which requires providing certain registration information to the Cystic Fibrosis Registry of Ireland.
• Log Files:
  The Cystic Fibrosis Registry of Ireland will track information about each User's usage of the database in log files. This information will be used as follows:
  • To analyze trends in demand for database information
  • To administer the database
  • To track statistical information about how Users use the database
  • To gather broad demographic information for aggregate use
• Tracking Users:
  • Each time a user interacts with the Registry database, a session is created on the application server.
  • A session is a record that contains information about the user such as: username, time of last interaction and time of log in.
  • This information is used to disable the application to any user if the time lapsed between interactions exceeds a limit.
• Surveys:
  From time to time the Cystic Fibrosis Registry of Ireland may request information from Users via voluntary participation in research activities.
  The information that is requested may include contact information (such as name and organisation address), and demographic information (such as country and professional classification of users).
  This information may be collected to provide the Users with better service.

The Cystic Fibrosis Registry of Ireland is committed to upholding all statutory regulations as laid down by the Data Protection Commission of Ireland (www.dataprivacy.ie).

1. Information Use. The Cystic Fibrosis Registry of Ireland will use only anonymised medical information in the preparation of reports that contribute to medical research. Personal (contact) information is collected (stored as encrypted text) from both Enrolees and Users for two reasons:
1. To protect Enrolees. The Cystic Fibrosis Registry of Ireland will use Patient Registration Information as follows:
1. To identify enrolees.
2. To prevent unauthorized persons from accessing Patient Registration and to ensure that that information is only available to the patient's own doctor.
2. To tell approved Users about new or enhanced services.
1. E-mail Updates:
   Once a User completes the registration process, Cystic Fibrosis Registry of Ireland may keep the User updated by e-mail on important news and events concerning the Cystic Fibrosis Registry of Ireland.
   By accepting this Privacy Policy and by using the data, each User agrees that Cystic Fibrosis Registry of Ireland may contact the User by e-mail with respect to the Cystic Fibrosis Registry of Ireland and any aspect of the database whatsoever.

The Cystic Fibrosis Registry of Ireland is committed to prevent any unauthorized access to each Patient's Registration Information and any other Personally Identifiable Information. There are specific processes maintained and the software technology is designed to prevent such unauthorized access.

All personal information is handled securely within the Cystic Fibrosis Registry of Ireland and is not disclosed to third parties.

• User IDs and Passwords. Each User is responsible for maintaining the confidentiality of his or her User ID and password, and is responsible for all database activities that occur under his or her User ID and password, including, without limitation, all related patient information and other Personally Identifiable Information. Each User agrees to immediately notify Cystic Fibrosis Registry of Ireland of any unauthorised use of his or her User ID or password or of any other Personally Identifiable Information or any other breach of security regarding the database. Cystic Fibrosis Registry of Ireland will not be liable for any Loss whatsoever arising from a User's failure to comply with these security requirements and each User agrees to hold Cystic Fibrosis Registry of Ireland harmless from any and all Losses that arise from that failure to so comply.

If any User suspects that someone has had unauthorised access to his or her Cystic Fibrosis Registry of Ireland account, or access to his or her User ID or password, the User should send an email to info@cfairegistry.org immediately so that appropriate action can be taken to protect the User and his or her patients.

If you have any questions or concerns regarding Cystic Fibrosis Registry of Ireland data protection practices, please send an e-mail message to Cystic Fibrosis Registry of Ireland's Web site administrator at info@cfairegistry.org

For all purposes of this Privacy Policy, the terms used throughout this Privacy Policy shall have the meanings set forth below:

"Enrolees" are persons with cystic fibrosis whose medical data is entered onto the database. Their Personal Registration Information is encrypted on the database and only two people have access to it: the Registry Director and the person's own doctor.

"Users" are defined as those healthcare professionals who have been approved by the Registry Management Committee and have been issued with User names and Passwords. If a User is a consultant, he/she may have access to Personal Registration Information for his/her patients only. He/she may have access to "anonymised" information of other patients, but may not have access to Personal Registration Information for other patients.

"Patient Registration Information" means any personal information about a patient that the Cystic Fibrosis Registry of Ireland has an obligation to keep confidential.

"Anonymised Information" means information that, taken alone, cannot be used to identify or locate an Enrolee including, without limitation, age or gender, types of and treatments for infections, genotype, occupation, education, county or health board of residence (with no address). "Anonymised Information" refers to this type of information, regardless of whether such information is collected along with, "Patient Registration Information".

"Patient Registration Information" means information that can be used to identify or locate a Person, including, but not limited to, e-mail address, name, date of birth, street address, and phone number.

"Privacy Policy" means this "Privacy Policy" as it may be amended from time to time.