Privacy Policy

The TIGER Study is fully compliant with the General Data Protection Regulation (EU) 2016/679 (GDPR). All personal data processing is conducted under lawful bases including legitimate interest in medical research (Article 6(1)(f)) and explicit consent where required.

Participating institutions in the European Economic Area act as data controllers for patient data collected at their sites. The TIGER Study coordinating center acts as a data processor for pooled, de-identified data used in consortium analyses.

Data subjects retain all rights afforded by GDPR, including the right of access, rectification, erasure, restriction of processing, data portability, and the right to object. Requests should be directed to the local participating institution or the TIGER Study Data Protection Officer.

For participating institutions in the United States, the TIGER Study complies with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and Security Rule.

All data transmitted from US institutions is de-identified in accordance with the HIPAA Safe Harbor method (45 CFR 164.514(b)(2)) or under an approved Limited Data Set agreement with appropriate data use agreements in place.

Business Associate Agreements (BAAs) are maintained with all vendors and service providers who may access protected health information in the course of platform operations.

Patient data is entered at the institution level by authorized research personnel. Each record is assigned a study-specific pseudonymous identifier; no directly identifiable information (names, medical record numbers, dates of birth) is transmitted to the central database.

All data entered into the TIGER Study platform undergoes automated validation at the point of entry. Data queries are generated for inconsistencies and resolved by the originating institution.

Access to patient-level data is restricted on a role-based basis. Investigators can access only their own institution's data. Pooled analyses are conducted on fully de-identified datasets by the central statistical team.

Data exports for sub-studies require approval from the TIGER Study Publication Committee and the relevant institutional review boards.

All data in transit is encrypted using TLS 1.3 with forward secrecy. API communications between the client application and backend services are secured with HTTPS and certificate pinning.

Data at rest is encrypted using AES-256 encryption on all database volumes and backup media. Encryption keys are managed through a dedicated key management service with regular rotation.

The platform infrastructure is hosted on SOC 2 Type II certified cloud providers with multi-region redundancy. Regular penetration testing and vulnerability assessments are conducted by independent security auditors.

Multi-factor authentication (MFA) is mandatory for all investigator accounts. Session tokens have configurable expiration periods with automatic lockout after failed authentication attempts.

Research data collected through the TIGER Study is retained for the duration of the study and for a minimum of 15 years following study completion, in accordance with Good Clinical Practice (GCP) guidelines and applicable regulatory requirements.

De-identified pooled datasets used in published analyses are retained indefinitely as part of the scientific record. Individual institution data may be withdrawn upon written request, subject to the data use agreement terms.

System access logs and audit trails are retained for a minimum of 7 years. Backup data follows the same retention schedule as primary data with secure destruction upon expiration.

Upon termination of an institution's participation, their data is retained in de-identified form in the pooled dataset. Institution-level identifiable data is securely deleted within 90 days of the termination effective date, unless regulatory requirements dictate otherwise.