- Document No.:
- CMTFOI/REG/DSP/001
- Version:
- 1.0
- Effective Date:
- September 2026
- Status:
- Published — authorised by the CMTFOI Board
- Owner:
- CMTFOI Registry — Privacy & Data Protection Contact
- Approval authority:
- CMTFOI Board
- Next scheduled review:
- September 2027
- Review frequency:
- At least annually, and earlier where required by law, technology, governance requirements, or material changes to the Registry.
The scheduled review date is a governance review point. It does not mean the document ceases to apply after that date.
This Policy establishes how CMTFOI reviews and governs access to Registry information for research and other legitimate purposes, so that the Registry can support CMT science while protecting participants.
1. Purpose
To set the conditions under which Registry information may be accessed, shared or analysed outside routine Registry administration.
2. Eligible collaborators
- Universities and academic research groups.
- Hospitals and clinical services.
- Research institutes.
- Patient organisations and non-profit organisations.
- Biotechnology and pharmaceutical companies.
- Contract research organisations.
- Other organisations approved through this Policy.
3. Research request process
- Research purpose and question.
- Requesting institution and responsible investigator.
- Data requested, at field level.
- Participant population and inclusion criteria.
- Proposed analysis.
- Data-security arrangements.
- Publication plans.
- Retention period for the shared data.
- Country and location of processing.
- Ethics or institutional review approval where applicable.
4. Governance review
Requests are reviewed by the CMTFOI Registry governance structure against scientific merit, participant benefit, privacy risk, consent scope and legal requirements. No external request is approved automatically.
The composition of the review body, including patient representation and independent members: As determined by the CMTFOI Board under its governance procedures.
5. Data minimisation
Only the fields and records necessary for the approved purpose are shared.
6. De-identification
The order of preference is anonymous or de-identified data first, then pseudonymised data, and only then identifiable data.
Identifiable sharing requires a substantially higher governance threshold and an appropriate consent or legal basis.
7. Commercial organisations
Legitimate CMT research collaborations may involve commercial organisations, including biotechnology and pharmaceutical companies. This is stated openly to participants in the Registry consent and Privacy Notice, and such requests are reviewed under this Policy like any other.
8. International sharing
Sharing across countries requires that applicable transfer rules are met, that the recipient can meet the required safeguards, and that the processing location is disclosed in the request.
9. Data-use agreements
- Permitted purpose and prohibited uses, including no re-identification attempts.
- Security requirements and access limits.
- Onward-sharing restrictions.
- Breach notification obligations.
- Retention, return and destruction terms.
- Publication and acknowledgement terms.
10. Publication
Research outputs must not unnecessarily identify participants; small-cell and rare-combination results are reviewed for re-identification risk before release.
11. Return or destruction
At the end of the approved period, recipients return, delete or destroy the shared data as set out in the agreement and confirm that they have done so.
12. Participant withdrawal
After withdrawal, the participant's information is not included in new data releases, and future use based on consent stops.
Where information has already been irreversibly anonymised or incorporated into aggregate research outputs, it may not be possible to identify or remove it.