Genomics Data Protection and Privacy Policy

Section A: Overview

Purpose:

Lifera Omics is committed to protecting the privacy and security of all personal and genomic data it collects and processes. This policy outlines Lifera's Omics framework for the collection, use, processing, and safeguarding of genomic data in compliance with Saudi Arabia's Personal Data Protection Law (PDPL) and international regulations such as the General Data Protection Regulation (GDPR). It applies to all employees, contractors, third-party service providers, and partners handling sensitive genomic data within Lifera Omics' operations. This policy ensures that genomic data collection and privacy management align with the highest ethical standards and are conducted in a transparent, lawful, and secure manner.

Scope:

This policy applies to all types of personal and genomic data collected, processed, or handled by Lifera Omics. The policy covers data collected from individuals, including whole genome sequences, exome data, clinical data, variant information, and any associated demographic or lifestyle data. It applies to employees, contractors, third-party collaborators, and external partners, ensuring compliance with all relevant regulations in Saudi Arabia and abroad.

Section B: Definition

Term	Definition
Genomic Data	Information obtained from whole genome sequences, exome data, and any genetic variants that are linked to health conditions or biological traits.
Personal Data	Any data that relates to an identifiable individual, including name, identification numbers, contact details, and health data.
Sensitive Data	Personal Data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual's parents are unknown.
Controller	The entity that determines the purposes and means of processing personal and genomic data.
Processor	Any party that processes personal and genomic data on behalf of the controller.
Processing	Any operation performed on personal or genomic data, including collection, storage, retrieval, or destruction.
Data Subject	The individual to whom the data relates.
Collection	The collection of Personal Data by Controller in accordance with the provisions of this Law, either from the Data Subject directly, a representative of the Data Subject, any legal guardian over the Data Subject or any other party.
Destruction	Any action taken on Personal Data that makes it unreadable and irretrievable, or impossible to identify the related Data Subject.
Disclosure	Enabling any person - other than the Controller or the Processor, as the case may be - to access, collect or use personal data by any means and for any purpose.
Transfer	The transfer of Personal Data from one place to another for Processing.
Publishing	Transmitting or making available any Personal Data using any written, audio or visual means.
PDPL	Personal Data Protection Law.
GDPR or General Data Protection Regulation	means the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Pseudonymise or Pseudonymisation	means replacing a person's name and other identifiers with a particular code. The pseudonymised data can only be connected to the natural person with the code. The access to the code is restricted. Pseudonymisation protects against direct identification of a person. Pseudonymised data is still considered Personal Data.

Section C: Legal Basis for Processing

Lifera Omics processes genomic and personal data based on one or more of the following legal bases:

Consent: Explicit, informed, and voluntary consent is obtained from the data subject for the processing of their genomic data for specific purposes.
Contractual Necessity: Processing is required for fulfilling contractual obligations, such as participation in research studies or clinical trials.
Legal Obligation: Lifera Omics may process genomic data when required by law, ensuring compliance with Saudi Arabian PDPL and other applicable regulations.
Legitimate Interests: Processing is based on the organization's legitimate interests, provided that these do not override the rights and freedoms of data subjects.

Section D: Types of Data Collected

Lifera Omics collects a variety of data types for genomic research and healthcare purposes, including:

Genomic Data: Whole genome sequences and exome sequences, including the complete DNA sequence of participants. This provides detailed insights into an individual's genetic code and helps identify variations that may be linked to health conditions.
Variant Data: Information about specific variations in the genome, such as single nucleotide polymorphisms (SNPs), insertions and deletions (indels), structural variants, and copy number variations (CNVs), that are associated with certain traits or diseases.
Clinical Data: This includes participants' medical records, phenotypic information (physical characteristics), pathology reports, diagnostic outcomes, and treatment histories. Clinical data is essential for correlating genomic variations with medical conditions.
Personal and Demographic Data: Information such as age, sex, ethnicity, and contact information that may be necessary for understanding the genetic diversity within populations. This data will be de-identified for research purposes to protect participants' privacy.
Family History Data: Information about participants' family health history, which can provide insights into heritable conditions and the genetic background of diseases.
Lifestyle and Environmental Data: Where relevant, data about participants' lifestyle choices, such as smoking habits, diet, and environmental exposures, is collected to study their influence on health outcomes.
Gene Expression Data: Transcriptomic data, including information on how genes are expressed in different tissues, which can help identify how genetic variations affect biological functions.
Somatic vs. Germline Mutations: Somatic mutations, particularly in cancer patients, as well as germline mutations that are inherited and present in all cells, are collected to understand the genetic basis of diseases and treatment responses.
Pharmacogenomics Data: Information about how a participant's genomic profile influences their response to medications, enabling personalized treatments.

Section E: Data Use and Processing

Genomic data will be processed for specific, legitimate purposes, including research, clinical care, and public health initiatives. Lifera Omics will ensure that all data is handled in compliance with legal obligations and ethical standards.

Key Processing Principles:

Lawfulness, Fairness, and Transparency: Genomic data will only be processed in a transparent manner and for purposes that align with legal requirements.
Data Minimization: Only the minimum amount of data necessary for specific purposes will be collected.
Purpose Limitation: Data will only be used for the purposes for which it was collected, with additional consent required for any further use.

Section F: Informed Consent and Transparency

Before genomic data is collected, Lifera Omics will provide participants with comprehensive information on how their data will be used, stored, and shared. Consent must be freely given, specific, informed, and revocable at any time. Participants will be informed of their rights to withdraw consent and how their data will be handled in the event of withdrawal.

Section G: Data Security

Lifera Omics is committed to safeguarding all personal and genomic data through a combination of technical and organizational measures. These include:

Encryption: Genomic and personal data will be encrypted both at rest and during transmission.
Access Controls: Access to genomic data is restricted to authorized personnel only, following a strict role-based access control model.
Anonymization and Pseudonymization: Whenever possible, data will be anonymized to prevent it from being linked to an identifiable individual. Pseudonymization will be used when anonymization is not feasible.
Regular Audits: Lifera Omics will conduct regular security audits to ensure compliance with best practices and legal obligations.

Section H: Data Sharing and Transfers

Lifera Omics may share genomic data with external researchers, healthcare providers, or third parties, but only under strict data-sharing agreements. Any third-party handling Lifera Omics' genomic data must adhere to the same privacy and security standards.

International Transfers:

Cross-border data transfers will be restricted to countries with adequate data protection regulations, in compliance with Saudi PDPL for the following cases:

A. If this is related to performing an obligation under an agreement, to which the Kingdom is a party.
B. If it is to serve the interests of the Kingdom.
C. If this is to the performance of an obligation to which the Data Subject is a party.
D. If this is to fulfill other purposes as set out in the Regulations.

The conditions that must be met when there is a Transfer or Disclosure of Personal Data, according to what is stated in the above Paragraph, are as follows:

A. The Transfer or Disclosure shall not cause any prejudice to national security or the vital interests of the Kingdom.
B. There is an adequate level of protection for Personal Data outside the Kingdom. Such level of protection shall be at least equivalent to the level of protection guaranteed by the Law and Regulations, according to the results of an assessment conducted by the Competent Authority in coordination with whomever it deems appropriate from the other relevant authorities.
C. The Transfer or Disclosure shall be limited to the minimum amount of Personal Data needed. This shall not apply to cases of extreme necessity to preserve the life or vital interests of the Data Subject or to prevent, examine or treat disease.

Section I: Participant Rights

Participants have specific rights regarding their genomic data, including:

Right to Access: Participants can request access to their genomic data and details of how it has been processed.
Right to Rectification: Participants can request corrections to any inaccurate genomic data.
Right to Erasure: Participants have the right to request that their data be deleted when it is no longer necessary for its original purpose.
Right to Data Portability: Participants can request that their data be transferred to another service provider in a readable format.

Section J: Data Retention and Destruction

Genomic data will be retained only for as long as necessary for the purposes outlined at the time of collection, or as required by law. Data no longer needed will be securely destroyed to ensure that it cannot be reconstructed.

Section K: Ethical Oversight and Governance

An independent ethics committee will oversee Lifera Omics' data handling practices to ensure compliance with ethical standards and Saudi Arabian laws. The committee will review all data collection and sharing procedures, and ensure that participants' privacy and rights are protected at all times.

Section L: Compliance with Laws and Regulations

Lifera Omics will comply with Saudi Arabia's Personal Data Protection Law (PDPL), as well as other relevant international regulations such as GDPR and HIPAA. Regular reviews of data protection practices will be conducted to ensure ongoing compliance.

Section M: Training and Awareness

All employees and contractors involved in the collection, processing, or storage of genomic data will undergo regular training on data protection, ethical handling, and compliance with this policy. Awareness campaigns will be implemented to keep staff informed of legal changes and updates to the policy.

Section N: Incident Management

In the event of a data breach, Lifera Omics will activate its incident response plan to assess the risk, contain the breach, and notify affected individuals and relevant authorities, in compliance with Saudi PDPL requirements.

Section O: Policy Review and Amendments

This policy will be reviewed and updated at least annually, or more frequently if required by changes in the legal or regulatory environment. All amendments will be communicated to employees, partners, and relevant stakeholders.

Section P: Conclusion

This policy ensures that Lifera Omics handles genomic data with the highest standards of security, transparency, and ethical responsibility. Lifera Omics is committed to protecting the privacy and rights of individuals, while advancing scientific research and innovation in healthcare.