This deliverable outlines the ethical, legal, and data protection framework adopted within the HEREDITARY project, with particular attention to the management of sensitive health and genetic data. The project uses retrospective, pseudonymised clinical data collected over the past two decades from over 6,000 patients affected by complex neurological and psychiatric conditions. These include neurodegenerative diseases (e.g. Parkinson’s disease, ALS), cerebrovascular and autoimmune disorders, neuropathies, gliomas, and psychiatric conditions such as anorexia nervosa. In accordance with Article 9(2)(j) of the GDPR, Article 89 of the GDPR, and Article 110 of the Italian Privacy Code, informed consent is not required for the use of such data at the University of Padova, due to the large number of subjects, the retrospective nature of the data, and the fact that many of the patients are deceased or no longer contactable. This is justified by the disproportionate effort required and the risk of compromising the scientific goals of the project. These criteria are further supported by provision no.146/2019 of Italian Data Protection Authority (DPA), along with the related General Authorisations no. 8/2016 and 9/2016. To ensure robust data protection, HEREDITARY implements a federated learning architecture. All raw data remain on secure servers at each clinical site; no identifying or raw data are transferred between centres. Each site performs local analysis and shares only aggregated outputs or features. This approach guarantees full compliance with data minimization and privacy-by-design principles, while enabling advanced multimodal analysis across institutions.