Skip to content

Commit d71a5d4

Browse files
Joe-Heffer-ShefJoe-Heffer-Shef
authored
Merge pull request #327 from RSE-Sheffield/feat/eula
Add EULA static page
2 parents 88c97b9 + 0eb9a73 commit d71a5d4

File tree

3 files changed

+210
-0
lines changed

3 files changed

+210
-0
lines changed

‎home/templates/end_user_license_agreement.html‎

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
{% extends "base_manager.html" %}
2+
{% block content %}
3+
<div class="container mx-auto px-4 py-8" id="eula">
4+
<h1>End User License Agreement (EULA)</h1>
5+
<h2>1. Acceptance of terms</h2>
6+
<p>By accessing or using the Self-Assessment of Organisational Research Readiness Tool (SORT) Online survey
7+
platform ("Platform"), you ("User," "you," or "your") agree to be bound by this End User License Agreement
8+
("EULA"). If you do not agree to these terms, you must not use the Platform.</p>
9+
<p>This EULA governs your use of the Platform designed to collect data from healthcare practitioners about
10+
organizational preparedness to participate in research studies, in compliance with applicable data
11+
protection laws including the UK Data Protection Act 2018, which incorporates the UK General Data Protection
12+
Regulation (UK GDPR).
13+
</p>
14+
<h2>2. Data protection obligations</h2>
15+
<h3>2.1 Fundamental Data Protection Principles</h3>
16+
<p>You acknowledge that the Platform processes personal data, including special category data (ethnic origin),
17+
and agree to:</p>
18+
<ul>
19+
<li>Respect participant privacy at all times</li>
20+
<li>Minimize data collection to what is strictly necessary for research purposes</li>
21+
<li>Implement appropriate security measures to protect participant data</li>
22+
<li>Maintain confidentiality of all survey responses and participant information</li>
23+
</ul>
24+
<h3>2.2 Prohibited activities&mdash;Data protection</h3>
25+
<p>You expressly agree NOT to:</p>
26+
<ul>
27+
<li>Attempt to identify or re-identify survey respondents through any means, including cross-referencing
28+
responses with other data sources
29+
</li>
30+
<li>Combine survey data with other datasets that could enable participant identification</li>
31+
<li>Use demographic combinations in ways that could identify individuals or small groups</li>
32+
<li>Share individual-level data with employers, managers, or other third parties without explicit consent
33+
</li>
34+
<li>Conduct additional data collection beyond the approved survey questions</li>
35+
<li>Ask probing or follow-up questions that could identify specific respondents</li>
36+
<li>Screenshot, photograph, or record any survey responses or participant information</li>
37+
<li>Access data outside your authorised role or research purposes</li>
38+
</ul>
39+
<h3>2.3 Data minimization requirements</h3>
40+
<p>You agree to:</p>
41+
<ul>
42+
<li>Only collect data that is necessary and proportionate to the research objectives</li>
43+
<li>Limit demographic questions to essential categories only</li>
44+
<li>Aggregate data appropriately to prevent identification risks</li>
45+
<li>Apply minimum cell sizes (minimum 5 respondents) for any demographic breakdowns</li>
46+
<li>Remove or generalize any data elements that could enable identification</li>
47+
</ul>
48+
<h2 id='3-security-and-access-controls'>3. Security and access controls</h2>
49+
<h3 id='31-account-security'>3.1 Account security</h3>
50+
<p>You agree to:</p>
51+
<ul>
52+
<li>Maintain secure login credentials and not share account access with unauthorised
53+
persons
54+
</li>
55+
<li>Use strong passwords</li>
56+
<li>Log out securely after each session</li>
57+
<li>Report any suspected security breaches immediately</li>
58+
<li>Only access the Platform from secure, authorised devices</li>
59+
60+
</ul>
61+
<h3 id='32-data-handling-requirements'>3.2 Data handling requirements</h3>
62+
<p>You must:</p>
63+
<ul>
64+
<li>Access data only for legitimate research purposes as specified in the research protocol
65+
</li>
66+
<li>Not download or export data outside the UK without explicit authorization and
67+
appropriate data
68+
transfer safeguards
69+
</li>
70+
<li>Implement appropriate technical and organizational measures to protect data security
71+
</li>
72+
<li>Ensure secure data transmission when sharing authorised outputs</li>
73+
<li>Maintain audit trails of data access and use</li>
74+
</ul>
75+
76+
<h2 id='42-legal-compliance'>4. Legal compliance</h2>
77+
<p>You warrant that your use of the Platform will:</p>
78+
<ul>
79+
<li>Comply with all applicable data protection laws including UK Data Protection Act 2018
80+
and UK
81+
GDPR
82+
</li>
83+
<li>Meet professional regulatory requirements for healthcare research (including NHS
84+
Research
85+
Ethics Committee approval where applicable)
86+
</li>
87+
<li>Adhere to institutional policies and procedures</li>
88+
<li>Comply with Health Research Authority (HRA) requirements where applicable</li>
89+
<li>Respect international data transfer restrictions under the UK&#39;s data transfer
90+
regime
91+
</li>
92+
93+
</ul>
94+
95+
<h2 id='5-data-sharing-and-publication'>5. Data sharing and publication</h2>
96+
<h3 id='51-authorised-data-sharing'>5.1 Authorized data sharing</h3>
97+
<p>You may only share data:</p>
98+
<ul>
99+
<li>In aggregate form that cannot identify individuals or small groups</li>
100+
<li>With appropriate statistical disclosure controls applied</li>
101+
<li>To authorised research collaborators under equivalent data protection obligations</li>
102+
<li>Through approved data repositories with appropriate access controls</li>
103+
104+
</ul>
105+
106+
<h2 id='6-incident-reporting-and-breach-response'>6. Incident reporting and breach response</h2>
107+
<h3 id='61-mandatory-incident-reporting'>6.1 Mandatory incident reporting</h3>
108+
<p>You must immediately report:</p>
109+
<ul>
110+
<li>Any suspected data breaches or security incidents</li>
111+
<li>Unauthorised access attempts to survey data</li>
112+
<li>Technical vulnerabilities that could compromise data security</li>
113+
<li>Potential identification risks discovered during analysis</li>
114+
<li>Any misuse of the Platform by authorised users</li>
115+
116+
</ul>
117+
<h3 id='62-breach-response-obligations'>6.2 Breach response obligations</h3>
118+
<p>In the event of a data protection incident, you agree to:</p>
119+
<ul>
120+
<li>Notify the Platform administrators within 24 hours</li>
121+
<li>Cooperate fully with incident investigation and response</li>
122+
<li>Implement immediate containment measures to prevent further harm</li>
123+
<li>Maintain detailed records of the incident and response actions</li>
124+
<li>Support regulatory notifications to the Information Commissioner&#39;s Office (ICO) as
125+
required
126+
by law
127+
</li>
128+
<li>Notify relevant NHS authorities where healthcare data is involved</li>
129+
130+
</ul>
131+
132+
<h2 id='7-data-retention-and-deletion'>7. Data retention and deletion</h2>
133+
<h3 id='71-data-retention-limits'>7.1 Data retention limits</h3>
134+
<p>You agree to:</p>
135+
<ul>
136+
<li>Retain data only as long as necessary for the specified research purposes</li>
137+
<li>Comply with institutional retention policies and legal requirements</li>
138+
<li>Securely delete data when no longer needed</li>
139+
<li>Maintain records of data deletion activities</li>
140+
141+
</ul>
142+
<h2 id='8-monitoring-and-compliance'>8. Monitoring and compliance</h2>
143+
<h3 id='81-platform-monitoring'>8.1 Platform monitoring</h3>
144+
<p>You acknowledge that:</p>
145+
<ul>
146+
<li>Platform usage is monitored for security and compliance purposes</li>
147+
<li>Access logs are maintained and may be reviewed</li>
148+
<li>Automated tools may detect potential policy violations</li>
149+
<li>Regular audits may be conducted to ensure compliance</li>
150+
151+
</ul>
152+
<h2 id='9-consequences-of-violations'>9. Consequences of violations</h2>
153+
<h3 id='91-suspension-and-termination'>9.1 Suspension and Termination</h3>
154+
<p>Violations of this EULA may result in:</p>
155+
<ul>
156+
<li>Immediate suspension of Platform access</li>
157+
<li>Permanent termination of user account</li>
158+
<li>Notification to institutional authorities (including NHS Trusts, universities, and
159+
professional
160+
bodies)
161+
</li>
162+
<li>Notification to the Information Commissioner&#39;s Office (ICO) where appropriate</li>
163+
<li>Legal action for damages and compliance enforcement under UK law</li>
164+
165+
</ul>
166+
<h3 id='92-liability-and-indemnification'>9.2 Liability and Indemnification</h3>
167+
<p>You agree to:</p>
168+
<ul>
169+
<li>Indemnify the Platform operators against claims arising from your violations</li>
170+
<li>Accept full responsibility for compliance with data protection laws</li>
171+
<li>Compensate for damages caused by your negligent or willful violations</li>
172+
173+
</ul>
174+
175+
<h2 id='10-updates-and-modifications'>10. Updates and modifications</h2>
176+
<h3 id='101-eula-updates'>10.1 EULA Updates</h3>
177+
<ul>
178+
<li>This EULA may be updated to reflect changes in law, technology, or best practices</li>
179+
<li>Users will be notified of material changes with reasonable notice</li>
180+
<li>Continued use of the Platform constitutes acceptance of updated terms</li>
181+
182+
</ul>
183+
<h2 id='11-final-provisions'>11. Final provisions</h2>
184+
<h3 id='111-governing-law'>11.1 Governing Law</h3>
185+
<p>This EULA is governed by the laws of England and Wales. Any disputes arising from this agreement shall be
186+
subject to
187+
the exclusive jurisdiction of the courts of England and Wales.</p>
188+
<h3 id='112-severability'>11.2 Severability</h3>
189+
<p>If any provision of this EULA is found to be unenforceable, the remaining provisions will continue in full
190+
force.</p>
191+
<h3 id='113-entire-agreement'>11.3 Entire Agreement</h3>
192+
<p>This EULA constitutes the entire agreement between you and the Platform operators regarding your use of the
193+
Platform.</p>
194+
195+
<p>By using the Platform, you acknowledge that you have read,
196+
understood, and agree to be bound by this End User License Agreement.</p>
197+
198+
<p><em>Users are responsible for reviewing updates and ensuring
199+
continued compliance.</em></p>
200+
</div>
201+
{% endblock %}

‎home/urls.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,4 +95,5 @@
9595
views.HelpView.as_view(),
9696
name="help",
9797
),
98+
path("eula/", views.LicenseAgreementView.as_view(), name="eula"),
9899
]

‎home/views.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -507,3 +507,11 @@ def form_valid(self, form):
507507

508508
class HelpView(LoginRequiredMixin, TemplateView):
509509
template_name = "help.html"
510+
511+
512+
class LicenseAgreementView(LoginRequiredMixin, TemplateView):
513+
"""
514+
End user license agreement
515+
"""
516+
517+
template_name = "end_user_license_agreement.html"

0 commit comments

Comments
 (0)