CMTFOI Patient Registry — Privacy Notice

1. About this Notice

This Notice applies to information held in the CMTFOI Patient Registry, including information entered through CMT Veda AI and information linked from an existing CMTFOI record.

It does not describe a specific research study. A specific study may have its own participant information and consent.

2. Who operates the Registry

The Registry is operated by the Charcot-Marie-Tooth Foundation of India (CMTFOI).

Privacy and data protection contact: privacy@cmtfoi.org. General contact: Charcot-Marie-Tooth Foundation of India (CMTFOI), cmtfoi.org. Complaints about privacy or the Registry may be sent to the same privacy contact.

Contact for privacy requests: privacy@cmtfoi.org.

CMTFOI has not stated that a formal Data Protection Officer has been appointed; this Notice therefore names a privacy contact rather than a DPO.

3. Information collected

• Identity and contact information, such as name, email address or phone number.
• Demographic information, such as year of birth, sex, country and region.
• Health and clinical information, such as symptoms, clinical history, diagnosis, treatment and management.
• Functional information from CMT Veda assessments.
• Family history relating to CMT.
• Genetic and diagnostic findings that the participant chooses to share.
• Documents and reports uploaded by the participant.
• Registry and assessment information generated within CMT Veda.
• Technical and security information, such as access and audit records, where relevant to operating the Registry safely.

4. Purposes

• Registry administration and participant support.
• Maintaining and improving data quality.
• Communicating with participants about the Registry.
• Patient advocacy and improving access to CMT information and care.
• Understanding CMT across populations and regions to support healthcare improvement.
• Appropriately governed research and scientific collaboration.
• Security, fraud prevention and protection of the Registry.
• Meeting legal, regulatory and compliance requirements.

5. Legal basis

The legal basis for handling Registry information may differ depending on where the participant lives.

For participants in India, CMTFOI applies the Digital Personal Data Protection framework, under which processing is generally based on the participant's consent, together with any other lawful ground that applies.

For participants in other jurisdictions with additional privacy requirements, CMTFOI applies the requirements that are applicable there. This Notice does not claim that a single law applies identically to every participant worldwide.

6. Data sharing

Registry information may be shared for approved purposes subject to applicable law and appropriate safeguards. Recipients may include researchers, universities, hospitals and research institutes, non-profit and patient organisations, contract research organisations, biotechnology and pharmaceutical organisations where appropriate, and service providers who process information on CMTFOI's behalf under contract.

Sharing follows the CMTFOI Registry Data Sharing & Research Governance Policy (CMTFOI/REG/DSP/001). Anonymised or de-identified information is preferred; pseudonymised information is used where anonymisation would defeat the approved purpose; identifiable information requires a substantially higher governance threshold and an appropriate consent or legal basis.

7. International processing

Because the Registry is global, information may be processed, stored or accessed in countries other than the participant's own, including by approved collaborators and service providers.

Where information moves across borders, CMTFOI applies the safeguards required by applicable law, such as contractual protections, access controls and de-identification where reasonably possible.

8. Retention

Identifiable information in the CMTFOI Patient Registry will ordinarily be retained for up to 15 years from the participant's last meaningful interaction with or update to the Registry, unless a different period is required or permitted by applicable law, an approved research or governance requirement, or another documented legitimate purpose. 15 years is CMTFOI's default retention period for inactive identifiable Registry data, subject to applicable law, documented governance requirements and periodic review. It is not a global standard and is not a legally required period.

A 'last meaningful interaction or update' means a documented participant interaction or material update relevant to continued Registry participation — for example updating Registry information, completing or updating a Registry assessment, confirming or updating clinical information, submitting a meaningful Registry update, or explicitly confirming continued participation. Background system processing, automated emails, security logs, analytics and automatic backups are not meaningful interactions.

Participants who remain actively involved in the Registry are not deleted simply because 15 years have passed since they registered. Where the relationship remains active and legitimate, identifiable information may continue to be held, subject to continuing consent or another lawful basis, the Registry's stated purposes, periodic governance review and applicable law.

For participants who are no longer meaningfully active, reaching 15 years from the last meaningful interaction or update triggers a retention review rather than automatic deletion. The review decides whether continued identifiable retention is still necessary, whether the information should be securely deleted, whether it can and should be irreversibly anonymised, or whether another documented legal or governance basis justifies keeping it. Where continued retention is approved, the reason and the next review date are recorded.

Withdrawal of consent is separate from the 15-year period and does not wait for it. When consent is withdrawn, the withdrawal is recorded, processing that relies on that consent stops subject to applicable law, and the deletion or anonymisation workflow is started so that identifiable Registry information is deleted or irreversibly anonymised within a reasonable period, unless specific information must or may be kept under applicable law or a documented governance requirement. Only the minimum information needed to evidence the withdrawal and to meet security, legal, audit and accountability obligations is preserved.

Data that has been de-identified or pseudonymised but can still reasonably be linked to an individual remains subject to appropriate personal-data safeguards, and is not treated as anonymous merely because direct identifiers have been removed. Its retention follows the approved research purpose, the applicable consent or legal basis, the relevant research governance approval, the applicable data-sharing agreement and a documented retention and review period — not the general Registry period.

Research datasets that have been irreversibly anonymised so that individuals are no longer reasonably identifiable may be retained for as long as they continue to have legitimate scientific, statistical, public-health, educational or historical research value, subject to periodic governance review, and are securely destroyed when that value or purpose ends.

Deleted Registry information may remain temporarily in secure backup systems until those backups expire or are securely overwritten in accordance with the applicable backup lifecycle. Backup copies must not be used to restore withdrawn information into active Registry processing except where necessary for disaster recovery, security, legal or operational purposes.

Consent and withdrawal records are not deleted simply because Registry data is deleted; the minimum record needed for legitimate audit, legal, governance and accountability purposes is preserved.

Retention reviews are carried out under CMTFOI's internal governance process. Reviews are conducted and documented by the Head, Registry & Data Governance, and the CMTFOI Board is the final approval authority for retention decisions and governance exceptions. Decisions are recorded in CMTFOI's secure governance record, which preserves the history of each decision. This process is described in the Registry Data Governance & Retention Policy.

9. Security

CMTFOI uses appropriate technical and organisational safeguards, including authenticated access, role-based permissions, row-level access rules on Registry data, encryption in transit, and logging of privileged actions.

This Notice deliberately does not publish detailed infrastructure, configuration or security-control information.

10. Participant rights

Depending on the laws applicable to the participant, rights may include access to information about how data is processed, correction of inaccurate or incomplete information, deletion or anonymisation where applicable, withdrawal of consent, and the right to complain.

Requests can be made to the privacy contact above. CMTFOI may need to verify identity before acting on a request.

11. Withdrawal

Consent can be withdrawn at any time in CMT Veda under Registry Settings ('Withdraw Registry Consent'), or by contacting CMTFOI.

Withdrawal stops further Registry processing based on consent and starts the applicable deletion or anonymisation workflow. Required consent and audit history is preserved, and the participant's CMT Veda account and unrelated records are not deleted.

12. Children

Where the participant is a child, or is otherwise not able to give their own consent under the rules that apply where they live, a parent or legal guardian provides consent and is recorded as the consent provider, with their relationship to the participant.

Where the participant is old enough to understand, age-appropriate information should be given to them as well. When a participant later becomes eligible to consent for themselves, the current Registry consent is presented to them and their own decision is recorded as a new consent event; the earlier guardian consent is preserved as history.

13. Complaints

Privacy questions and complaints: privacy@cmtfoi.org. Participants may also have a right to complain to the data protection authority in their own country.

14. Updates to this Notice

This Notice may be updated as the Registry develops. Each version carries a document number, version number and effective date, and previous versions are retained as history.