Bioethical Policy

This statement was last updated on 11.2025

This policy upholds our core values by ensuring the ongoing protection of donor integrity, autonomy, and privacy. Ancestria Bio, a RINI Group LLC company, is certified with The Collaborative Institutional Training Initiative Program on the below compliance curriculum:

Revised Common Rule
Responsible Conduct of Research for Administrators
Researchers - Information Privacy & Security (IPS)
Institutional/Signatory Official: Human Subject Research
HIPAA Privacy and Security Rules
GCP for Clinical Trials with Investigational Drugs and Biologics (ICH Focus)
Ethics and Code of Conduct in Healthcare
Conflicts of Interest
Biomedical Responsible Conduct of Research
Biomedical (Biomed) Comprehensive

Ancestria Bio international sites follow a strict internal bioethical Biospecimen Procurement and Handling Policy, summarized as follows:

1) Specimen acquisition follows established standard-of-care protocols, ensuring full compliance with the legal requirements of the host country and U.S. federal laws regarding human biological specimens.

2) GCP/HIPAA compliant:

2.1) PHI – We ensure that all HBS and clinical datasets are completely anonymized, meeting all requirements for commercial R&D use.
2.2) HQ trained personnel will serve as Honest Broker(s)
2.3 ) Informed consent and appropriate IEC/IRB approvals will be secured prior to the initiation of all prospective collection activities.
2.4) Participation is voluntary, and donors will not receive any form of payment or remuneration for their donation.

Compliance

* Ancestria Bio conducts and manages collection of the biospecimens in compliance with all applicable laws, statutes and regulations (GCP, FDA, ISBER best practices).
* Ancestria Bio is compliant with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations (45CFR Part 46 et seq., and Parts 160 and 164).
* Collection sites must follow GCP rules and comply with all ethical regulations of the country in which the samples are collected. All collection sites are accredited medical facilities that are subject to internal hospital regulations as well as regulations of the country of procurement.
* Site Coordinators and Principal Investigator must ensure that the study is conducted in accordance with the principles of Good Clinical Practice.
* Ancestria Bio’s sites operate in accordance with the Declaration of Helsinki and the principles of ICH GCP:

Before initiating, weigh risks against benefits (participant and society).
Rights, safety, and well-being of subjects prevail over interests of science and society.
Adequate nonclinical and clinical information on investigational product to support proposed trial.
Scientifically sound, clear, detailed protocol.
IRB-approved protocol
Medical decisions are the responsibility of a qualified physician.
Each team member should be qualified by education, training, and experience for his/her trial tasks.
Freely given informed consent from every subject prior to participation.
Storage, recording and handling of all clinical info such that it is accurately reported, interpreted and verified.
Protect confidentiality of records; respect applicable privacy and confidentiality rules.
GMP manufacturing, handling and storage of IP. Use in accordance with approved protocol.
Implement quality systems and procedures to assure the quality of every aspect of the trial.

Ancestria Bio Site Coordinators & Site Management

Principal Investigators (PIs) recover material of interest and temporarily store it at the hospital/medical center storage facility. They communicate with Site Coordinators who organize the logistics following collection in collaboration with the Project Manager. Site Coordinators responsibilities include:

Reviewing SOPs with PIs and other hospital staff involved in the biospecimen collection, and ensuring that each project is well understood by all involved staff.
Conducting spot audits of facilities, tissue samples storage facilities and storage files of medical documentation.
Managing project timelines, conducting regular checks and providing regular reports to Miami Executive Team on project progress.
Ensuring proper chain of custody; documentation of the chronological movement of samples from the time of collection through shipment, receipt, possession, handling, processing, analysis and final storage.
Ensuring safe and well documented shipment of all biomaterials to the Ancestria Bio Sorting Facility in Miami, FL, USA or directly to a Partner Biobank for Storage.

Honest Brokers

Honest Brokers are Principal Investigators or HIPAA-certified research project managers located at HQ in Miami, FL, USA who are responsible for subject PHI data preparation, which includes anonymization of all PHI, utilization of HIPAA compliant Optical Character Recognition (OCR) agents to digitalize non-digital data where applicable, securing professional translation of all EHR data and relevant reports into medical english. The Honest Broker cannot be a Site Coordinator at an international local site.

Informed Consent

* Informed consent is obtained from the donor or legally authorized next-of-kin prior to the initiation of any specimen collection or protocol specific procedures.
* Information must be conveyed in understandable language.
* Subjects must be given sufficient opportunity to consider whether they want to participate.
* Consent must be given without coercion or undue influence.
* Subjects will not give up legal rights or be given the impression that they are being asked to do so.
* Information provided to donors from whom samples are acquired must make it clear that the donation is voluntary.
* Samples of surplus surgical tissue and/or biofluids (such as blood, urine, etc.) will be collected for research purposes only. As well as that:

- Personal information associated with these samples will be coded.
- The samples will be used for various tests for research purposes, and may be stored for an unspecified period of time for future studies.
- The samples and data may be used by commercial companies and third parties.
- Prospective donors have the right to withdraw consent without any consequences.
- The samples are a donation and donors shall have no intellectual property rights or financial gain from any inventions or products derived from use of their specimens.
- Steps will be taken to protect their personal identity.
- Specific types and quantities of samples and data to be collected will be itemized.
- Collection procedures may include possible risks and inconveniences for the donor. These risks will be explained to the donor prior to consent.

Protected Health Information (PHI)

Donor demographic and clinical data undergo a multi-tiered process to ensure adherence to inclusion/exclusion criteria and de-identification measures before the dataset is transferred to the Sponsor.

Site Coordinator: Is a clinician who supports with the initial recruitment communication including consenting the patient, drawing blood (or coordinating its arrangement) and coordinating the subsequent biospecimen laboratory procedures for inclusion in the study. [data is not de-identified]
Principal Investigator on site: Since the PI is the physician who is personally involved in treating the patient. [data is not de-identified]
1. Upon ensuring consent, the site coordinator extracts and stores a snapshot of the PHI in a secured, SSO-login, platform that only trained and approved project personnel have access to. They assign a unique subject ID and redact all digital documents. [data is partially de-identified]
Ancestria Bio Project Manager: is a technically savvy professional who transforms scanned documents into digital form, transmits the redacted EHR data & Reports for English translation, and does the final revision for complete de-identification. [The data completing this stage is fully de-identified]
Ancestria Bio Sponsor: is the end user. At this point it is virtually impossible for the data to be traced back to the donor independently, without support from the site coordinator and project manager’s input. [The data at this level is fully de-identified]

De-identification Standard - The following identifiers must be removed:

Names
Geographical identifiers of residence at a more granular level beyond Country/Region. (note: country/region of origin is of more relevance for a study)
Full birthdate of subject. (note: age at the time of consent is captured for inclusion purposes)
Direct Contact Details: Phone numbers, Fax numbers, Email addresses
Social Security numbers, federal identification numbers
Patient/Medical record numbers
Health insurance beneficiary numbers
Account numbers
Certificate/license numbers
Vehicle identifiers and serial numbers, including license plate numbers
Device identifiers and serial numbers
Web Uniform Resource Locators (URLs)
Internet Protocol (IP) address numbers
Biometric identifiers, including finger, retinal and voice prints
Full face photographic images
Any other unique identifying number, characteristic, or code except the unique code assigned by the investigator to code the data

Monitoring

Ancestria Bio manages the end-to-end study lifecycle, including site initiation, routine monitoring, and formal close-out, ensuring comprehensive documentation throughout. As a core component of the monitoring oversight, Ancestria Bio reserves the right to audit Case Report Forms (CRFs) against de-identified source records. Principal Investigators are required to facilitate access for these reviews, which are conducted on-site by Site Coordinators.

Data Breach Protocol

Should a data breach event occur, the project team will adhere to the following procedures:

1) Immediate Notification: Staff must notify the local Compliance Officer and Miami Executive Team within 24 hours of discovering unauthorized access to PHI.
2) Containment & Isolation: Affected accounts on the secured SSO-login platform are suspended immediately to prevent further exposure.
3) Risk Assessment: The Honest Broker evaluates whether the breached data was original PHI, partially de-identified, or fully de-identified data.
4) Impact Analysis: The team determines if the 16 HIPAA-standard identifiers were compromised, assessing the technical likelihood of donor re-identification .
5) Regulatory Notification: Ancestria Bio reports the incident to the relevant IRB/IEC and regulatory bodies (e.g., HHS) as required by 45 CFR Parts 160 and 164.
6) Donor Coordination: Since Site Coordinators and PIs maintain the direct patient relationship, they facilitate any necessary donor notifications.
7) Corrective Action: Post-investigation, quality systems are updated and staff undergo mandatory re-training in Information Privacy & Security (IPS)