“Development Data” shall mean: (i) CMC Development data (including records of Manufactured batches); (ii) any non-clinical or clinical findings, results and other research data relating to the COVID Products, in any format; and (iii) the formal reports of preclinical toxicology studies and Clinical Studies, such data in each case of (i), (ii) and (iii) required for the Development, Manufacture or Commercialization of the COVID Products, including but not limited to, INDs and other regulatory filings and registration dossiers.
12. Compliance Quality Integrity
12.3 Data Integrity. GSK and CureVac shall carry out their respective Development activities under this Agreement, and collect and record any data generated therefrom, in a manner consistent with the following good data management practices: (i) Development Data shall be generated using sound scientific techniques and processes; (ii) Development Data shall be analyzed appropriately, without bias and in accordance with good scientific practices; and (iii) Development Data shall be accurately recorded in accordance with good scientific practices by the individuals performing the research and in accordance with the ALCOA CCEA data integrity principles: (A) Attributable: data are traceable to the originator, (person and/or a computerized system, a device, an instrument), including any changes made to data, i.e. who performed an action and when, so that key decisions made during the conduct of the research, presentations made about the research and conclusions reached in respect of the research can be easily demonstrated and reconstructed; (B) Legible: data are readable and understandable; (C) Contemporaneous: data are recorded at the time they are generated or observed as per regulatory requirements; or in absence of regulatory requirements, local business practices; (D) Original (true copy): data as the file or format in which it was first generated, e.g. first paper record of manual observation, or electronic raw data file from a computerized system as per regulatory requirements; or in absence of regulatory requirements, local business practices; (E) Accurate: data, including error corrections and edits, are correct, truthful and to the appropriate precision; (F) Complete: all expected elements of the data are present (i.e., no unexplained gaps in the data) and the full meaning and context is preserved with the data; (G) Consistent: all elements of the record follow in the expected sequence; (H) Enduring: data are recorded in a permanent medium (paper or electronic) and continue to be retained in a human readable format for as long as specified in applicable record retention requirements; and (I) Available: data are maintained securely in such a way that they are accessible and retrievable in reasonable times (“Good Data Management Practices”). Each Party shall maintain written policies and standards related to Good Data Management Practices and shall ensure appropriate, documented training of its relevant personnel with respect to Good Data Management Practice.
12.4 Human Biological Samples. If the Parties wish to source Human Biologicals Samples on each other’s behalf or exchange Human Biological Samples between them, such exchange shall be recorded in separate addendums to this Agreement setting forth further terms and conditions for the specific purpose. GSK and CureVac undertake that the Human Biological Samples used or collected in connection with the Development have been obtained and will be stored, transferred, used and disposed of in accordance with all Applicable Laws and any generally accepted ethical guidelines regarding the collection, use, transport and disposal of human tissue, including with regard to consents from patients, volunteers and other donors.
12.5 Privacy; Information Security. The Parties shall comply with Data Protection Laws (as defined in Exhibit 12.5), including those concerning medical confidentiality and privacy in relation to human subjects of the Development activities regarding the COVID Products. The Parties acknowledge that they do not intend that one Party processes personal information for and on behalf of the other Party. If personal information is transferred between the Parties (as between controllers) pursuant to the performance of this Agreement or any Ancillary Agreement, the Parties shall comply with Exhibit 12.5, which may be amended from time to time by the Parties as is required by Applicable Laws. The Parties will enter into further data protection agreements if required by Applicable Laws.