Privacy Policy

1. Data controller

The data controller is:

For any request concerning the protection of personal data, the data controller may be contacted using the details provided above.

Should a Data Protection Officer (DPO) be appointed, their contact details will be published in this section.

2. Categories of data processed

The following categories of data may be processed through the website.

Browsing data

During normal operation, the IT systems and software procedures used to run the website may collect certain technical data whose transmission is inherent in the use of Internet communication protocols.

This category may include:

• IP address;
• browser type;
• operating system;
• device used;
• date and time of the request;
• pages visited;
• technical information relating to browsing;
• logs relating to the security and operation of the website.

These data are used mainly to ensure the proper functioning and security of the website and, where applicable, to obtain aggregated statistical information on its use.

Data voluntarily provided by the user

Voluntarily sending communications by email, WhatsApp or any contact forms available on the website entails the processing of the data provided by the user.

These may include:

• first name and surname;
• telephone number;
• email address;
• content of the request;
• any additional information spontaneously provided by the user.

Health data

Given the healthcare nature of the professional activity, users may spontaneously disclose information about their health, such as symptoms, diagnoses, previous surgery, tests, medical reports or other clinical information.

Health data constitute special categories of personal data under Article 9 GDPR and are processed with particular safeguards.

Users are asked not to include unnecessary health information or clinical documentation in general contact forms, unless this is expressly requested through an appropriate channel.

Where health data are necessary to respond to a request for assessment or to provide healthcare services, they are processed exclusively for purposes related to prevention, diagnosis, care or treatment, by or under the responsibility of professionals bound by professional secrecy.

3. Purposes and legal bases of processing

Personal data may be processed for the following purposes.

Handling requests for information and contact

The data provided by the user are used to:

• respond to requests for information;
• handle contact requests;
• provide information about consultations and services;
• arrange appointments, where applicable;
• follow up on pre-contractual requests made by the user.

Legal basis: performance of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR.

Healthcare services

Where the contact develops into a request for care, assessment or healthcare services, personal data and any health data are processed exclusively for the purposes necessary for care and for managing the healthcare relationship.

Legal basis: Article 6 GDPR and Article 9(2)(h) GDPR, for the purposes of preventive medicine, diagnosis, care or treatment, as well as for any further obligations laid down by applicable law.

Health data are not used for advertising or profiling purposes.

Compliance with legal obligations

Data may be processed where necessary to comply with obligations laid down by laws, regulations, tax, accounting or healthcare rules, or requests from the competent authorities.

Legal basis: Article 6(1)(c) GDPR.

Website security and abuse prevention

Certain technical data may be processed in order to:

• ensure IT security;
• prevent unauthorised access;
• detect anomalies or attempted attacks;
• protect the website and its systems.

Legal basis: the data controller's legitimate interest in the security of its systems and services, pursuant to Article 6(1)(f) GDPR.

Statistics and analysis of website use

The website may use statistical analysis tools to understand how users interact with its pages and to improve content, performance and usability.

Where such tools use cookies or tracking technologies that require consent, they are activated only after the user has given positive consent through the cookie management system.

Legal basis: consent of the data subject, Article 6(1)(a) GDPR, where required.

Where analytics tools are configured in such a way that they can be treated as technical tools under applicable law, they will be used within the permitted limits without the need for consent.

Details of the tools actually used are provided in the Cookie Policy.

4. Nature of the provision of data

Providing data through the website is generally optional.

However, certain data may be necessary to enable the data controller to:

• respond to a request;
• arrange a consultation;
• provide a service;
• comply with legal obligations.

Failure to provide strictly necessary data may make it impossible to follow up on the user's request.

5. Processing methods and security

Processing is carried out using IT and electronic communication tools and, where necessary, paper records.

The data controller adopts appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• loss;
• destruction;
• alteration;
• unauthorised disclosure;
• unlawful or improper use.

Access to data is restricted to persons who need it for the purposes set out in this notice.

6. Data retention

Personal data are retained only for as long as necessary to achieve the purposes for which they were collected and in compliance with any time limits established by law.

In particular:

• requests for information and contacts that do not develop into a professional relationship: for the time needed to handle the request and subsequently for a limited period, indicatively not exceeding 12 months, unless further retention is necessary;
• data relating to professional relationships or healthcare services: for the periods required by applicable healthcare, tax, civil and professional regulations;
• technical data and security logs: for the period strictly necessary for the security and proper functioning of the systems;
• data collected through cookies or analytics tools: for the periods indicated in the Cookie Policy and in the settings of the relevant tool.

Once the retention periods have expired, data are deleted or anonymised, unless further retention is necessary to comply with a legal obligation or to protect a right.

7. Recipients of the data

Personal data may be processed, to the extent strictly necessary, by:

• staff and collaborators authorised by the data controller;
• healthcare professionals involved in providing the service, where necessary;
• administrative, tax, accounting or legal advisers;
• hosting and IT infrastructure providers;
• email and communication service providers;
• providers of technical services necessary for the operation of the website;
• providers of statistical or analytics tools, where used;
• public authorities or other parties to whom disclosure is required by law.

Where required by the GDPR, providers that process personal data on behalf of the data controller are appointed as data processors pursuant to Article 28 GDPR.

Personal data are not sold to third parties.

8. WhatsApp and third-party services

The website may allow users to contact the practitioner via WhatsApp or other external services.

When users choose to use a third-party service, the relevant provider may process data in accordance with its own terms and privacy notices.

Users are therefore encouraged to also read the privacy notice of the service they use.

It is advisable to avoid sending unnecessary medical documentation or particularly sensitive data via messaging tools when a more appropriate channel is available.

9. Transfers of data outside the European Economic Area

Some technology providers used to operate the website, for communications or for statistical services may belong to international groups or may involve the processing of data outside the European Economic Area.

Where this occurs, the transfer will be carried out in compliance with Articles 44 et seq. GDPR and on the basis of one of the instruments provided for by applicable law, such as:

• adequacy decisions of the European Commission;
• standard contractual clauses;
• other safeguards provided for by the GDPR.

Details of individual providers and any transfers will be kept up to date according to the services actually used.

10. Cookies and other tracking tools

The website may use cookies and similar technologies.

Technical cookies, which are necessary for the operation of the website or for providing services requested by the user, may be used without consent, without prejudice to the obligation to provide information.

Any cookies or tracking tools used for statistical purposes that cannot be treated as technical, or for profiling or marketing purposes, are used only in the cases and in the manner provided for by law, with prior consent obtained where necessary.

Users may consult the Cookie Policy at any time and, where available, change their preferences using the “Manage cookie preferences” option.

11. Links to external websites and platforms

The website may contain links to websites, social networks, video platforms, messaging systems or other external services.

A simple link to such services does not necessarily involve the transmission of data.

When users voluntarily access an external service, the processing carried out by that party is governed by its own privacy notice.

The data controller is not responsible for the processing methods independently adopted by third-party websites or platforms.

12. Rights of the data subject

In the cases provided for by the GDPR, data subjects may exercise the rights granted by Articles 15–22 of the Regulation.

In particular, they may request:

• confirmation as to whether or not personal data concerning them are being processed;
• access to their data;
• rectification of inaccurate data;
• completion of incomplete data;
• erasure of data, where the conditions are met;
• restriction of processing;
• data portability, where applicable;
• objection to processing in the cases provided for;
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

The exercise of certain rights may be limited where the retention or processing of data is necessary to comply with legal obligations or to establish, exercise or defend a legal claim.

Requests may be sent to the data controller using the contact details provided in this notice.

13. Complaint to the supervisory authority

Data subjects who believe that the processing of their personal data infringes the applicable rules may lodge a complaint with the:

Italian Data Protection Authority (Garante per la protezione dei dati personali)

or contact the competent supervisory authority as provided for by the GDPR.

The right to seek judicial remedy remains unaffected.

14. Automated decision-making and profiling

Unless explicitly stated otherwise, the website does not use users' personal data to take decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.

Any profiling or marketing activities based on tracking tools may be carried out only within the limits permitted by law and, where necessary, after obtaining consent.

15. Minors

The website is intended mainly for adult users.

Where data relating to minors are submitted in the context of healthcare requests, such data must be provided exclusively by a person holding parental responsibility or by another legally authorised person.

16. Changes to this Privacy Policy

This Privacy Policy may be amended or updated in order to reflect:

• regulatory changes;
• changes to the services offered;
• the introduction or removal of providers or technology tools;
• changes to processing methods.

The updated version will be published on this page together with the date of the last update.

17. Contact

For questions concerning the processing of personal data or to exercise your rights: