Data Protection Notice
LIH Sonar Application

🇬🇧 English version

🇫🇷 Version française

🇩🇪 Deutsche Fassung

🇵🇹 Versão em português

Information for participants on the processing of personal data

Document version: Version 1.2
Version date: 26.FEB.2026

1. Confidentiality and protection of personal data

As part of the SONAR research study (the study), we will need to collect and process some of your personal data to enable us to achieve the scientific objectives of the study.

The LIH is responsible for the collection, analysis and, more generally, the processing of personal data and ensures its protection in accordance with the General Data Protection Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and any subsequent text replacing or supplementing this text, in particular the Luxembourg law of 1 August 2018 on the organisation of the National Commission for Data Protection and the implementation of the GDPR (together, the Data Protection Law).

2. What types of data do we collect?

If you agree to participate in the study, we will only collect the personal data we need to achieve the objectives of our study.

We will collect the following data from you through the study application :

  • Personal data (surname, first name, email address and telephone number – may be processed in the context of email exchanges with the clinical team for the purpose of organising study visits)
  • Demographic data (month and year of birth, gender, weight, height, level of education, country of birth)
  • Health data (information about your illnesses, treatments, symptoms, overall health, tobacco and alcohol consumption, level of physical activity, responses to questionnaires, events reported in your diary)
  • Technical data (dates and times when the various questionnaires were completed)
  • Voice recordings (standardised recordings and free recordings)

In addition, if you enable pairing with one of the Apple Health, Google Health or Withings health applications, we will indirectly collect the following data for the purposes of the study: number of hours of sleep, number of steps taken per day, type and duration of activity performed, and your heart rate (average, minimum and maximum heart rate). However, we remind you that you can disable this pairing at any time.

Your data will be analysed using artificial intelligence methods to identify vocal signs corresponding to different subgroups of people with different pathologies and symptoms. This artificial intelligence analysis will not be used in any way to make decisions about you or to analyse or predict your personal preferences, behaviours and attitudes.

No additional data will be collected regarding the type of device or server you use when accessing the application.

3. On what legal basis do we process your data?

The use of your personal data is based on your explicit consent (Art. 6.1a and Art. 9.2a of the GDPR).

You may accept or refuse the use of your personal data, collected as part of this study, for other purposes by ticking the corresponding box on the consent form.

If you decide to withdraw from the study, your personal data will be deleted and the LIH will not collect any new data about you as part of this study. There will be no link between your name and the study data. At the time of withdrawal, the clinical team will ask you whether you agree to the continued processing of the data collected for scientific research purposes by the LIH.

4. Who has access to your data?

Only the following categories of people will be able to access your data as part of their respective duties:

Names or data that directly identify you (first name, surname, email address, telephone number): A limited number of CIEC staff trained in the study will have access to this information in order to organise study visits, as well as a few dedicated members of the LIH IT department, solely in the event that maintenance work is required on this database. Vyte, a French company that enables appointment scheduling and whose data is stored in France, will process this data for the organisation of study visits in the booths via its appointment scheduling service.

Coded data:

  • The Principal Investigator of the Study at the LIH and the team working under his responsibility.
  • If you agree to secondary use, other LIH researchers or partners, public or private, for future research and development in the field of vocal biomarkers (under no circumstances will we provide them with data revealing your identity).

Aggregated or anonymised data: We will share your data with the Luxembourg National Health Observatory only if requested to do so by that entity and only in coded or aggregated/anonymised form (in accordance with the requirements of the National Health Observatory) for the purposes of complying with legal and regulatory obligations relating to public health (Article 6.1c GDPR), namely: the law of 2 March 2021 establishing a National Health Observatory.

We may also be required to give access to your data to service providers acting on our behalf, such as the company Vyte. These organisations are subject to strict security and confidentiality obligations in accordance with the legislation in force, and the services they provide are subject to contracts governing these obligations.

Finally, in cases where specific monitoring, inspections or audits need to be carried out, the study monitoring manager and the competent authorities may have access to your personal data.

5. What are your rights?

You have the right to access and rectify your personal data. Under the conditions provided for by law*, you also have the right to object to the way your data is used, to request that your data be deleted, to request that certain aspects of the processing of your data be restricted, and to retrieve your data so that you can send it to a third party (right to data portability) and/or withdraw your consent to the processing of your personal data. If you wish to exercise your rights, please contact the research team.

Finally, you have the right to lodge a complaint with the Luxembourg National Data Protection Commission (CNPD) regarding the processing of your personal data (https://cnpd.public.lu/fr/particuliers/faire-valoir/formulaire-plainte.html).

For information on how the LIH processes your personal data, please contact the LIH Data Protection Officer by email at dpo@lih.lu or by post at the following address:

LUXEMBOURG INSTITUTE OF HEALTH
Data Protection
1A-B, rue Thomas Edison
L-1445 Strassen
LUXEMBOURG

*The LIH examines all your requests to exercise your rights in accordance with the GDPR and the Luxembourg law of 1 August 2018 on the organisation of its National Commission for Data Protection and the implementation of the GDPR.

6. How do we protect your personal data?

The LIH implements appropriate security measures, depending on the sensitivity of the data concerned, in order to protect your data against the risk of unauthorised access, loss, fraudulent use, disclosure, alteration or destruction. Your data will be treated as strictly confidential. It will be coded, i.e. a confidential reference code will be used instead of your name. This code alone does not allow you to be directly identified and will only be used to process your data for research purposes. The correspondence table linking the reference code to your name will be kept confidentially and securely by the LIH, separately from other application data. Only a limited number of people have access to it (see below “Who has access to your data?”).

Furthermore:

  • Access to the study application is via an authentication system that ensures the separation between your identification information and other information you provide in the application.
  • Access to your user account is restricted to IT staff only.
  • Data transfers are encrypted via HTTPS (i.e. the data is made unreadable so that no one else can view it).
  • Data encryption (in transit and at rest), coding, access control and monitoring (unauthorised traffic or unauthorised access to the system) are in place to prevent unauthorised access and data loss.
  • To ensure the integrity and confidentiality of your data, credentials (provided for the purpose of creating the study application account) and voice recordings are stored separately from the information provided in the questionnaires (different databases on separate servers).
  • Data sets are backed up regularly. Backups are tested with restoration tests. Data quality management is handled outside of the study application.

7. How long do we keep your data?

For the purposes of this study, your data will be stored in a manner that allows you to be identified for five years after the end of the study, which is scheduled for March 2031.

After this period, the table linking your identity to other data will be deleted, which means that the study team will no longer be able to respond to your requests, as we will have no way of re-identifying you. You will therefore not be able to withdraw from the study after this period.

Your identifying information will be deleted, which means that the study data collected for the purposes of the study will be anonymised (with no direct link to your identity). Please note that the LIH will continue to process your anonymous data for research purposes for a period of at least 10 years after the publication of the last scientific article based on the research data collected and generated from the study.

For all research projects carried out worldwide, it is essential to organise research data properly and store it carefully. Research data refers to all factual information that has been collected or generated in order to validate or reproduce research results (including negative or inconclusive results) or to further understanding of them.

Research data remains valuable even after the project for which it was produced has ended. It is impossible to anticipate its full potential at the outset of the study.

Here are some reasons why research data should be retained:

  • Research integrity and reproducibility, in accordance with good scientific practice in research: it is important to retain research data in order to verify or reproduce findings, confirm the accuracy of results, and make research more reliable. In addition, publishing research data allows other researchers to replicate, verify, or further explore findings in order to advance science. Public sharing of data also improves research methods, ensures accuracy, and reduces the need to collect new data.
  • Protection of research data: Some research data will be unique and cannot be replaced if destroyed or lost.
  • Funding agency requirements: A growing number of funding agencies, including the Luxembourg National Research Fund, have adopted policies that require or encourage researchers to share their data and results. This practice, known as “Open Science”, avoids duplication and reduces data collection costs, ensuring better use of taxpayers’ money.
  • Requirements of scientific journal publishers: More and more scientific journal publishers are requiring researchers to make the data supporting their conclusions publicly available in open-access data repositories when they submit scientific articles. This helps to ensure the transparency and integrity of research, and allows other scientists to verify and reproduce results and build on published data to advance science.

Please note that only research data that is strictly necessary will be made available for the reasons described above, and none of it will contain any information that could identify you.

If the principal investigator of the study wishes to extend the project or retain the data in coded form beyond the end date indicated above, the opinion of the CNER and, where applicable, the agreement of the Department of Health will be sought for this extension. In the event of an extension, you will be informed and, if you do not agree, you have the right to object by contacting the team in charge of the study.

For more detailed information on the appropriate measures taken by the LIH, please send your request by email to the LIH Data Protection Officer at dpo@lih.lu.

8. Transfers of your data outside the European Union.

Your data may be transferred outside the European Union, but only if this is necessary to carry out the research or to exploit the results of the study. Only anonymous data, or data that does not directly identify you (coded data), will be transferred outside the European Union.

Some countries outside the European Union or the European Economic Area may not offer the same level of privacy protection as your own country. If this is the case, LIH will take appropriate measures to ensure the protection of your personal data (e.g. by including standard contractual clauses on data protection in its contracts, adhering to codes of conduct, complying with a specific certification mechanism or acting in accordance with your explicit consent).

Contacts

Study title: Voice biomarkers for health monitoring: open longitudinal hybrid cohort study
Acronym: SONAR
Study sponsor: Luxembourg Institute of Health (LIH)
Principal Investigator: Dr Guy Fagherazzi, PhD (LIH)
Principal Medical Investigator: Dr Alessia POCHESCI (LIH)
Clinical team: Centre for Clinical Investigation and Epidemiology (CIEC, LIH) sonar@lih.lu