Participant information

Who runs the registry

The registry is run by Stichting Alpha1 MZ Foundation (Dutch Chamber of Commerce no. 94402930), Tjiftjaf 2, 3435 BL Nieuwegein, the Netherlands. The Foundation is responsible for your data (the “controller”). Questions and requests: privacy@alpha1mz.org.

What the registry is for

The registry brings together health information from adults with alpha-1 antitrypsin deficiency, especially the MZ genotype, to support research into the condition and better care.

Taking part is voluntary and has no effect on your medical care. The registry is not a medical service: it gives no diagnosis or advice and nobody monitors your results.

What we collect

For your account: your email address and, if you give one, a name.

For research: your survey answers, the lab values read from reports you upload, and a few general details such as year of birth, sex, country and genotype.

How your data is kept

Your account details and your health data are kept in two separate databases on a server in the Netherlands. Health data is filed under a random code instead of your name.

This is called pseudonymised data. It is not anonymous: the Foundation can still connect the code to your account, which is what lets you view, correct or delete your data.

Lab reports you upload

Uploaded files are stored encrypted. The text is read automatically by Mistral AI (France), on servers in the EU.

Names, dates of birth and ID numbers are removed before the values are stored for research. The original file is deleted after 30 days. Please upload only reports about yourself.

Who can see your data

A small number of authorised people at the Foundation manage the registry. Their access is logged.

Researchers outside the Foundation receive data only if you gave the optional sharing consent, and only after the Foundation’s Data Access Committee has approved their request. They can be universities, hospitals, or pharmaceutical and biotech companies, also outside the EU.

They sign an agreement that forbids any attempt to identify you, receive only the data their study needs, and get new codes for every delivery. Your name and contact details are never shared. For recipients outside the EU the Foundation uses the safeguards the GDPR requires, such as standard contractual clauses.

Legal basis

We use your health data on the basis of your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR). You can withdraw it at any time; that does not undo what was lawfully done before.

How long we keep it

Your data stays in the registry until you withdraw, delete your account, or the registry ends. Unfinished survey drafts are removed after 90 days without activity.

If you delete your account, your registry data is erased with it.

Data already delivered to researchers cannot always be recalled; the Foundation tells the recipients which codes to delete.

Your rights

Under Account and consent you can download your data, change each consent, withdraw from the registry or delete your account. Under My data you can remove a result or report a value that looks wrong.

You can also ask us for access, correction, restriction or erasure at privacy@alpha1mz.org, and you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Emails

We send the emails your account needs, such as verification and password reset. Reminders and news are sent only if you switched them on. Our emails never contain health details.

Who can take part

Adults aged 18 or older, answering about themselves.

Translations

Translations of this page and of the surveys were made with machine assistance and are still being checked. If anything is unclear, the English text is leading.