Privacy Policy

1. Data Controller

2. Personal data collected

2.1 Data provided directly by the user

• Registration data: first name, last name, email address, phone number, date of birth, gender, residential address, password (stored in encrypted form).
• User profile data: general health information voluntarily entered (e.g. chronic conditions, allergies) for service delivery purposes.
• Booking data: type of visit, selected specialist or facility, date and time, optional clinical notes.
• Pet profile data: name, species, breed, date of birth, vaccination history and vet visits.
• Payment data: managed through a PCI-DSS certified payment gateway. We do not store credit card or bank account data.
• Communications: content of messages sent through the portal to professionals or customer support.

2.2 Automatically collected data

• Browsing data: IP address, browser type, operating system, pages visited, access time, session duration.
• Cookies: see our Cookie Policy for full details.
• System logs: records of operations performed for IT security purposes.

2.3 Health data — special category (Art. 9 GDPR)

Some portal features involve the processing of health data, considered special category data under Art. 9 GDPR. This data is processed exclusively:

• with the explicit consent of the data subject;
• for healthcare assistance purposes under Art. 9(2)(h) GDPR;
• with enhanced security measures (encryption, restricted access, access logs).

3. Purposes of processing

4. Legal basis for processing

• Consent (Art. 6(1)(a)): for marketing, newsletter, non-essential cookies. Consent can be withdrawn at any time.
• Contract performance (Art. 6(1)(b)): to deliver requested services, manage bookings and accounts.
• Legal obligation (Art. 6(1)(c)): to comply with tax, accounting and regulatory obligations.
• Legitimate interest (Art. 6(1)(f)): for IT security, fraud prevention, service improvement.

5. Data retention

• Active account data: for the duration of the contractual relationship.
• Deleted account data: 30 days from deletion request, unless legal obligations apply.
• Tax and accounting data: 10 years under Italian tax law.
• Health data: 10 years from service delivery, as required by healthcare regulations.
• System and security logs: 12 months.
• Marketing data (with consent): until consent is withdrawn or 24 months from last contact.

6. Your rights

To exercise your rights write to privacy@saluteinsieme.it. We will respond within 30 days.

7. Third parties and data transfers

• Healthcare professionals on the portal: limited to data strictly necessary to provide the booked service.
• Payment service providers: PCI-DSS certified, only for transaction processing.
• Cloud and hosting providers: servers located in the EU or with adequate safeguards (Standard Contractual Clauses).
• Analytics services: only in anonymised/aggregated form and only with your consent.
• Public authorities: only where required by law.

We do not sell personal data to third parties.

8. Minors

The portal is not intended for users under 16. Registration of a minor requires parental or guardian consent. If we become aware that we have collected data from a minor under 16 without parental consent, we will delete that data promptly.

9. Contacts