Terms and Conditions

1. General

1.1 These terms and conditions apply to the entire content of the Health-RI website, as well as to all offers and agreements, advice, information, recommendations and services. General terms and conditions of a counterparty do not apply, unless they have been explicitly accepted in writing by Health-RI. By using this website, you confirm that you accept these terms and that you agree to comply with them. To avoid misunderstandings, we may declare the general terms and conditions applicable again later, which does not alter the fact that they already apply through your use of the website. 

1.2 The Health-RI Foundation is a non-profit organization, located at Jaarbeursplein 6, 3521 AL Utrecht, the Netherlands, registered with the Dutch Chamber of Commerce under no. 77193415. The fact that this is a foundation with a societal purpose, and the fact that many of our information and services are made available free of charge, means that we cannot do otherwise than to exclude our liability to a large extent.

1.3 Quotations from Health-RI are in principle only valid for one month. After that, an agreement will come into existence only if Health-RI either explicitly confirms, or proceeds to implement.

1.4 Health-RI has the right to unilaterally change these conditions. Only in the event of a substantial change to the terms and conditions regarding a paid service, you have the right to terminate the agreement within a reasonable time because of this change. The amended conditions will be sent to you. If you do not explicitly reject these within one month, your silence will legally constitute acceptance of the new conditions.

2. Information, advice and liability

2.1 Our website and advice are aimed at people living in Europe. Certain information specifically addresses the situation or laws in the Netherlands. Health-RI makes no representation that the content available on or through our website, or the content of the advice, is applicable to (use in) other countries. The information on our website or in the advice, is for general information purposes only and does not constitute advice comparable to what you can obtain from, for example, lawyers. You must obtain professional or specialist advice yourself before taking or refraining from any action based on the content of the website or the advice.

2.2 While we make reasonable efforts to update the information on the website, Health-RI makes no representations, warranties, express or implied, that the information or any other content on the website is accurate, complete, up-to date or continuously available. Health-RI is therefore not liable for any loss, damage or fines arising from the use of (or the inability to use) the website or the information on it.

2.3 The Health-RI ELSI Service Desk helps you find answers to questions about health research. It is a non-profit service to you. By submitting a question to us, you accept these terms of use. As such, you accept that Health-RI makes no representations, warranties or guarantees that the answers are accurate, complete, up to date, provided or provided on time. No right to an answer arises from asking a question, partly because we independently determine the scope of our services, and we ourselves determine whether our expertise regarding your question is sufficient. Referring to an external expert also does not mean that we bear any responsibility for the final advice of that third party.

3. Intellectual Property and Linked Sites

3.1 All rights in this website and the information on it are owned by Health-RI or licensed to us. Users may read the website information to further inform themselves, but you may not use our website information for any other purpose without our permission. If you wish to use this information more broadly, please contact us.

3.2 If you send us unsolicited information, ideas or materials, Health-RI has the right to use them free of charge. Health-RI is not bound by any confidentiality obligation with respect to such materials. You hereby release Health-RI from claims arising out of the use of the unsolicited materials.

3.3 Our website contains links to external internet sites and resources provided by third parties. These links are provided for your information, but Health-RI has no control over their accuracy and makes no representations or warranties regarding these sites. Our privacy policy does not apply to the collection and processing of your personal data on or through such other external websites.

3.4 You may link to pages from our website, provided you do so in a way that is fair and legal and does not damage or take advantage of Health-RI's reputation. You must not establish a link in such a way as to suggest any form of association or endorsement of Health-RI where none exists. You must not establish a link to our site from any website that is not owned by you. Health-RI reserves the right to withdraw linking permission without notice. Health-RI may also prohibit you from using our logo.

3.5 The intellectual property of the services and software offered by or through Health-RI are and remain the property of Health-RI or its suppliers. All right, title and interest in and to the website, services, software and all components thereof, including but not limited to all user interface designs, processes, software and source code, and any future improvements or modifications thereto, howsoever made, shall remain property of Health-RI or its suppliers, and the IP cannot be transferred to customers unless very explicitly agreed to in writing.

3.6 The data that you process with or through Health-RI services or software, as well as the data resulting from this, do not become the property of Health-RI. Health-RI however takes the position that healthcare data, because they are created with public funds, should be available to the public for better individual care or for general public health purposes. Health-RI therefore, in matters concerning data ownership, takes the stand as far as legally possible based on the limited definitions of the EU Database Act, and on the European Union's vision on open data, that the processed data are not property of Health-RI, but not property of our counterparts either. 

3.7 Health-RI furthermore emphasizes that research is solely scientific when it is reproducible, which requires that data and results to be shared publicly as much as possible. Health-RI therefore supports the principle that scientific data should be FAIR: Findable, Accessible, Interoperable and Reusable. Within the possibilities offered by law and agreements, and therefore without violating any database rights, Health-RI will adhere as much as possible to the FAIR principle and encourage its counterparties to do the same.

3.8 Health-RI may use statistical data relating to the use of its services or website, or to improve its services, and may also disclose such data for public affairs purposes, provided that neither data subjects nor service recipients can be identified.

4. Data, Cookies & Confidentiality

4.1 Health-RI will only use your personal data as set out in our privacy policy. We also have a data breach protocol. Health-RI does not intend to obtain or process any personal data from customers with its services. However, a processing agreement is usually concluded with a service agreement for the sporadic processing of personal data (for example if data is moved to another server or we assist in solving a bug in certain ICT).

4.2 Our website uses cookies to optimize the user experience according to the cookie policy.

4.3 The ELSI Service Desk uses Topdesk Software. By asking a question (via e-mail or the questionnaire) you agree that the data you provide will be stored in Topdesk. This processing of your data is done in accordance with our own Privacy Policy, Topdesk's terms and conditions and the (U)AVG.

4.4 If, in any form of interaction with Health-RI, you are provided with information that should reasonably be understood to be confidential information, you are obliged to treat it as such and to keep it confidential. Conversely, Health-RI will maintain the confidentiality of your information. However, this does not apply to information that (i) was previously known, (ii) is or becomes publicly known without any breach of confidentiality between you and Health-RI, (iii) is necessary to pursue the legitimate interests of you or to defend Health-RI in legal proceedings, or (iv) must be disclosed on the basis of any legal obligation. You ensure that third parties who obtain confidential information through you will also adhere to what is stated here.

5. Cybersecurity, updates, programming errors and error messages

5.1 Health-RI does its utmost to keep its websites and services fully secure and continuously available. However, we cannot guarantee in any way that the website or the services are or will remain available continuously. We cannot guarantee that no data will be lost. Account hacking is the fault of the hacker, we are not liable for it. You must take care of back-ups yourself.

5.2 During the term of any service agreement, Health-RI may make standard updates and upgrades of software available from time to time. Updates and upgrades will be released by Health-RI at its sole discretion; Health-RI is not obliged to release or not release updates or upgrades according to a fixed schedule. Health-RI also has no obligation to create or develop custom updates or upgrades for a specific customer.

5.3 The services are provided "as is" and "as available" without warranty of any kind. Health-RI does not warrant that the services will be uninterrupted, error-free or available at all times, nor does Health-RI warrant the compatibility or operation of the services with all hardware and software configurations. Health-RI disclaims to the fullest extent permitted by law, any implied warranties of merchantability, effectiveness, fitness for a particular purpose or similar warranties. 

5.4 Health-RI is not responsible for any unavailability, suspension or termination of the software, or performance issues (i) resulting from a suspension due to planned downtime or emergency maintenance; (ii) caused by an event beyond Health-RI's reasonable control (including force majeure) or internet access or related issues outside Health-RI's scope; (iii) caused by actions or omissions of the client or a third party; (iv) resulting from (independently or in combination) client equipment, software or other technology or third party equipment, software or other technology (other than third party equipment under client's direct control); or (v) arising from the suspension or termination by the client of the client's right to use the software in accordance with the agreement entered into by it.

5.5 Health-RI is not responsible for the combined use or integration of the software with any hardware or software, regardless of whether it belongs to the client or another third party, unless explicitly agreed otherwise in writing.

5.6 Client agrees to immediately and accurately report to Health-RI any actual or apparent errors, problems, non-conformities or other difficulties in the services or the operation of the website, together with any other information reasonably required by Health-RI is requested to assist in resolving any such errors, problems, non-conformities or other difficulties. You consent to the collection, processing, transmission and disclosure of such information by Health-RI to improve the services and the functioning of the website.

6. Services, products & payments

6.1 Health-RI offers services. Some services are provided free of charge, for some services we ask you for payment. Prior to purchasing the service, we will ask for your consent to that payment, if any. We do this either through (tailor-made) quotations, or by asking you to confirm that you have seen and accepted the pricing on the website.

6.2 The amounts to be invoiced may be adjusted once a year, in line with inflation developments or changes in our purchase prices. In the event of unusual changes in our purchasing costs, we are also entitled to make price changes in the meantime. In the event of unusually high storage use or high use of computing capacity, we also have the right to invoice extra for this. We are not a commercial company, but a service providing foundation and you must bear any unexpected additional costs we face due to your use of services. You do have the right to cancel the agreement within a reasonable period after payment of the extra invoice.

6.3 Invoices must be paid within one month. After this, the statutory commercial interest of Section 6:119a of the Dutch Civil Code is due. If you have not paid after three months, in addition to the invoice and interest, you also owe a fine of 500 euros for our collection efforts. If it proves necessary to take legal action for collection, you will also owe a fine of 1000 euros for the time involved, in addition to the right to payment of the costs as stipulated in Article 6:96 paragraph 2c. Waiving any of these rights will not affect our other rights in this regard.

6.4 If you have canceled (the agreement regarding) a paid service, you must independently ensure the deletion of the data from the services, tools, programs or storage space purchased by or through Health-RI. If you do not agree to delete the data, Health-RI has the right to resume billing.

6.5 Our services may only be used for scientific research, statistical purposes, policy evaluations and quality controls.

6.6 When purchasing services, you will be provided with user IDs, passwords and other means of access. You may share this with third parties with whom you work, provided that you ensure that these third parties fully comply with the agreements between Health-RI and you. You are responsible for these third parties. If you wish to share data with parties outside the GDPR area, you have to do so directly, and not through the Health-RI services, as we have no way of verifying whether you have concluded the correct agreements with the relevant parties.

6.7 It is not allowed to process personal data, as defined under the GDPR, when using our services. All data must be anonymised in accordance with the guidelines of the GDPR. The conditions for the data to be considered anonymous are as follows; no direct identifiers may be present; there must be no reasonable way to re-identify individuals; the hash key must not be stored within reach of Health-RI; all metadata must be scrubbed. 

It is strictly prohibited to attempt to de-anonymise the data used within the services, or to otherwise try to re-identify natural persons. If any of the conditions for anonymity are not met, it is strictly forbidden to grant access to the services (to people that work for you as well as to third parties you work with as referred to in Article 6.6) if they are located in countries where the GDPR does not apply. This prohibition also applies to people in countries currently covered by an adequacy decision, as such decisions could be revoked. If you wish to share data with parties outside the GDPR area, you must do so independently of Health-RI, as we cannot verify whether the appropriate agreements have been established with those parties. 

7. Dissolution of services agreements

7.1 If you do not comply with your obligations, we have the right to deny you further services or advice. We also have the right to deny you further services, or advice if your usage results in these services or advice being (unreasonably) unavailable or less available to other customers.

7.2 If we have to terminate a (partial) agreement on the basis of Article 7.1, Health-RI is not liable for any damage resulting from this.

7.3 If you no longer actively use our services, but only use our storage facilities, then we have the right (at our choice) to either resume billing (in accordance with clause 6.4), or to urge you to store your data elsewhere or delete the data yourself. Health-RI is not liable for the consequences of this.

8. Data requests

8.1 Data requests must be submitted via the forms made available for this purpose on the website or by e-mail, depending on how this has been made known regarding a particular dataset. Health-RI is in no way obligated to process data requests submitted in any other way. We have the right not to process data requests that seem incorrect or incomplete or otherwise doubtful to us. We also do not process data requests that seem to us to be unfulfillable or in violation of the law.

8.2 Costs may be charged for granting a data request, either by Health-RI or by the data holder. These costs will be clearly communicated prior to the conclusion of an agreement in this regard. However, additional amounts may be charged for (subsequent) additional services, assistance with data processing or large-scale use of storage. The provisions of Article 6 regarding payments apply mutatis mutandis.

8.3 Health-RI itself is not (or barely) a data controller as defined in the GDPR concerning health data. Health-RI makes it clear via its website which data sets are available from third party data controllers. We do not decide whether or not to honor such a data request. As a result, Health-RI is not liable for the (possibly unlawful) making available of the data, or for the (possibly unlawful) refusal of data.

8.4 Health-RI is not liable if data is promised and ultimately not made available by the data holder, if the data proves to be incorrect, proves to be unsuitable for the stated purpose, or whatever the case may be. Health-RI functions exclusively as an intermediary between the data applicant and the data holder and is legally no party in the legal relationship established between the applicant and the data controller.

8.5 Data applicants indemnify Health-RI against any form of liability, or damage, or fines resulting from an incorrect or incomplete or unlawful act or omission of the data controller.

8.6 If the data applicant has a well-secured IT environment, it is possible that the data holder decides that the data will be transferred to the data applicant, whereby the applicant will subsequently become an independent data holder. In that case, the data applicant also undertakes contractually to Health-RI to handle and secure the data fully in accordance with the (U)GDPR and to take appropriate technical and organizational security measures for the processing and/or storage of the data. If the data requester does not have a properly secured IT environment or if the data holder decides to do so for other reasons, the data requester becomes solely a data processor. In that case, the data requester also undertakes contractually towards Health-RI to handle the data fully in accordance with the (U)GDPR and the processing agreement to be concluded with the data holder. Data requesters (whether they become holder or processor) have the obligation to provide Health-RI with all options reasonably necessary to exercise controls with regard to the provisions of this article. If this is refused, the data requester owes Health-RI a fine of 500 Euro per day.

8.7 The data applicant immediately deletes all data to which he has been given access via Health-RI, when the applicant is declared bankrupt, is granted a suspension of payments, is liquidated in whole or in part or ceases its activities or as an applicant or its parent company, if any, makes a decision to that effect. In the event of such deletion of the data, Health-RI (or the data holder) always retains the right to the agreed compensation.8.8 The data requester is obliged to communicate back to Health-RI and the data holder what the results are of the data made available, including the obligation to inform healthcare providers (directly or via Health-RI) as soon as possible about any facts regarding data subjects that may have emerged, which care providers should be aware of to provide better care to the data subject concerned.

8.8 The data requester is obliged to communicate back to Health-RI and the data holder the results of the data made available, for the purpose of scientific progress and better healthcare, unless this would conflict with intellectual property rights.

8.9 The data requester is in all cases obliged to inform the data holder as soon as possible about any discovered facts regarding data subjects, of which the healthcare providers of the data subjects concerned should be aware in order to provide better care.

8.10 Data requesters do not have the right to process data within the Health-RI services that can be fairly easily traced to specific natural persons (such as names or address details). If you do this, Health-RI has the right to immediately delete the data and keep it deleted. Health-RI is then not liable for any damage.

9. Data Sharing

9.1 Health-RI does its utmost (for the benefit of the data holder) to check whether the data requester provides us with correct and complete information regarding his identity and purposes. However, we are not liable for the (in)accuracy or (in)completeness of the information provided by the data applicant.

9.2 Health-RI does its utmost to guarantee with application forms that all laws and regulations are complied with. Given the speed at which these regulations develop, we cannot guarantee that the system is fully compliant by design. This applies all the more, if the data holder uses its own data request forms or procedures. The data holder decides on the availability of datasets and therefore remains responsible for compliance with the relevant laws and regulations; the data holder is the controller within the meaning of the GDPR and therefore the party that must legally guarantee compliance with the GDPR.

9.3 For processing a data request, costs may be charged to the data holder by Health-RI. These costs will be clearly communicated prior to the conclusion of an agreement in this regard. Furthermore, additional amounts may be charged for additional services, assistance with data processing or large-scale use of storage. The provisions of Article 6 regarding payments apply mutatis mutandis.

9.4 Data holders indemnify Health-RI against any form of liability, damage or fines resulting from incorrect actions or omissions by the data holder. Data holders explicitly indemnify Health-RI against claims from data subjects or data and privacy authorities.

9.5 Data holders are obliged to keep the meta-data that Health-RI has regarding data (metadata on the data that can be requested from the data holder) complete, correct and up to date. Data holders indemnify Health-RI against any damage resulting from incorrect or incomplete information supplied by the data holder. Health-RI has the right to terminate agreements if the information provided by data holders proves to be incomplete, incorrect or not up to date.

9.6 Health-RI has the right to use logos and names of the data holder to make the metadata regarding the data sets available at the data holder, recognizable and requestable. Health-RI also invokes the right to quote, based on Article 15a of the Dutch Copyright Law; the right to (insofar as this is functional - the Fair Use principle) display metadata, summaries of data sets, or sets of question sets, to make the underlying data recognizable and requestable.

9.7 Health-RI consults data holders on the best design of the system within which meta-datasets are catalogued. Health-RI listens to the preferences of data holders when designing this, but partly because of the aim of also serving data applicants, Health-RI ultimately has the decisive vote in this matter.

10. Miscellaneous

10.1 Health-RI is solely liable in the event of intent or gross negligence on our own part. Health-RI is not liable for consequential damage and liability is always limited to the amount the liability insurance pays out in this regard.

10.2 These general terms and conditions and all our agreements are exclusively governed by Dutch law. If additional products are supplied, the Vienna Sales Convention does not apply.

10.3 In the event of a conflict (concerning agreements or these terms and conditions), the parties will attempt to resolve this mutually, if necessary with the help of a mediator. Only if this fails for three months, or in clearly urgent cases, the court in Utrecht will have jurisdiction.