Notice on the processing of personal data

1. Data controller

The Data Controller is Dr Giulio Maria Maggi, Lungo Dora Pietro Colletta 67, 10153 Torino — VAT no. 01253320095 — Tax code MGGGLI68E12A166M — registered with the Turin Medical Council (Ordine dei Medici di Torino) no. 20595.

For any request concerning privacy and the protection of personal data: certified email (PEC) giulio.maggi@to.omceo.it [ordinary email address to be added, if any].

2. What data we process

• "Request a consultation" form: identification and contact details (first name, surname, telephone and/or email), preferred location, preferred time slot for being called back, topic of interest, any notes you choose to enter, declaration of being of legal age, page of origin. The topic and notes may contain data concerning health, which the GDPR regards as "special categories of data" (Art. 9).
• Information assistant (chat): the text of the messages written in the chat. We expressly ask you not to enter names, contact details or information about your state of health in the chat: the assistant provides only general information drawn from the content of the site.
• Browsing data: technical data collected automatically by the hosting systems (for example IP address, date and time of the request, browser type), necessary for the operation and security of the site.
• Statistical data (only with your consent): information on the use of the site collected by Google Analytics, such as pages visited, time spent, type of device and approximate geographical origin.

3. Purposes and legal bases

• Handling consultation requests and call-backs: performance of pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).
• Processing of data concerning health that may be entered in the form: solely to contact the data subject and organise the consultation, on the basis of their explicit consent (Art. 9(2)(a) GDPR), given by means of a dedicated optional, non-pre-ticked box, separate from acknowledging this notice. Anyone who does not give this consent can still ask to be called back, without entering information about their health in the form.
• Replies from the information assistant: providing the general information requested by the user (Art. 6(1)(b) GDPR).
• Security and operation of the site: legitimate interest of the Controller in protecting and ensuring the proper functioning of its systems (Art. 6(1)(f) GDPR).
• Site usage statistics (Google Analytics), to understand which content is most useful and to improve it: the data subject's consent (Art. 6(1)(a) GDPR), given through the cookie banner and revocable at any time.

Providing data in the form is optional, but without contact details it is not possible to follow up your request. The form is reserved for adults. No decisions are made based solely on automated processing (Art. 22 GDPR).

4. Who receives the data

The data may be processed by the following parties, appointed as Data Processors pursuant to Art. 28 GDPR:

• Netlify, Inc. — hosting of the site and collection of requests sent through the form. [Verify acceptance of Netlify's Data Processing Agreement.]
• Google Ireland Limited — Google Analytics statistics service, active only if the visitor gives consent. The service is configured without Google Signals, without ad personalisation and without links to advertising services.
• Anthropic PBC — provider of the artificial intelligence model that generates the assistant's replies. It receives only the text of the messages written in the chat, in order to produce the reply. The relationship is governed by Anthropic's Data Processing Addendum, incorporated into its commercial terms. Under those terms, messages and replies are automatically deleted from the provider's systems within 30 days.

Within the practice, data are processed only by authorised staff. Consultation requests are handled by the staff of the location indicated as preferred (Turin, Asti or Alessandria).

Transfers to non-EU countries

Netlify and Anthropic are based in the United States, and Google Analytics data may also be processed by Google LLC in the United States. Transfers take place in compliance with Chapter V of the GDPR: for Google, on the basis of Google LLC's participation in the EU-U.S. Data Privacy Framework; for Anthropic, on the basis of the Standard Contractual Clauses approved by the European Commission and included in its Data Processing Addendum; for Netlify, on the basis [of participation in the EU-U.S. Data Privacy Framework or of the Standard Contractual Clauses — to be verified].

5. How long data are kept

• Consultation requests: kept for the time necessary to contact the data subject and in any case for no more than 12 months from receipt. If a doctor–patient relationship follows, the data become part of the medical records, which are kept for the periods required by law.
• Conversations with the assistant: the site does not save them on its own servers. They remain in the temporary memory of the user's browser (sessionStorage) and are deleted when the tab is closed. At Anthropic they are deleted within 30 days, as indicated in section 4.
• Google Analytics statistical data: kept for 2 months, then deleted automatically.
• Browsing data: kept by the hosting provider for the period set out in its terms of service, for security purposes. [Verify the period indicated by Netlify.]

6. Cookies and third-party content

The site does not use profiling cookies or advertising tracking tools.

• Technical tools (no consent required): the chat uses the browser's temporary memory (sessionStorage) to keep the conversation going while you browse; the site saves in the browser (localStorage) the choice made in the cookie banner, so as not to show it again on every page. The choice is remembered for 6 months.
• Google Analytics (only with consent): on your first visit a banner lets you accept or refuse, with two equally prominent buttons. Closing the banner with the X is the same as refusing. Until you accept, Google Analytics is not loaded and no statistical cookies are installed. If you accept, Google Analytics may install the cookies _ga and _ga_*, which are used to distinguish visits in statistical form. You can change or withdraw your consent at any time from the Cookie preferences link at the bottom of every page.
• Fonts: the fonts are hosted directly on the site's server, with no connections to third-party services.
• YouTube video ("About us" page): the video is not loaded automatically. The YouTube player, in enhanced privacy mode (youtube-nocookie.com), is activated only when the visitor chooses to start the video with a click; from that moment Google's privacy policy applies. [Technical note: the video's preview image is currently loaded from YouTube's servers; it must be replaced with an image hosted on the site for this sentence to be entirely accurate.]

7. Your rights

At any time you may ask the Controller, by writing to the certified email (PEC) giulio.maggi@to.omceo.it, for:

• access to your data, rectification, erasure or restriction of processing (Arts. 15–18 GDPR);
• portability of the data you have provided to us (Art. 20 GDPR);
• withdrawal of consent, at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).

Last updated: [date].