Privacy Notice pursuant to Art. 13 of EU Regulation 2016/679 (GDPR)

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter "GDPR"), and in compliance with Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, we inform you that the personal data provided will be processed in compliance with the confidentiality obligations provided for by the aforementioned legislation to which the project is bound.

1. Data Controller

The Data Controller is the project, located at Via Roma 123, 00100 Rome, email: privacy@saluteora.it.

2. Purpose of Processing

The personal data you provide is necessary for:

• Provision of requested healthcare services
• Management of bookings and appointments
• Compliance with legal and fiscal obligations
• Communications related to subscribed services
• Improvement of services offered
• With prior consent, sending newsletters and promotional communications

3. Legal Basis for Processing

The processing of your personal data is based on consent (Art. 6 par. 1 lett. a GDPR), performance of a contract (Art. 6 par. 1 lett. b GDPR) and compliance with legal obligations (Art. 6 par. 1 lett. c GDPR).

4. Categories of Data Processed

The data processed includes:

• Personal details (name, surname, date of birth, tax identification number)
• Contact information (address, email, phone)
• Health data (medical history, diagnoses, treatments)
• Administrative and fiscal data

5. Processing Methods and Retention

Processing will be carried out in automated and/or manual form, in compliance with the provisions of art. 32 of the GDPR regarding security. Data will be retained for the time necessary to provide the requested services and for legal compliance, and in any case not beyond 10 years from the termination of the relationship for service purposes, and not beyond 2 years from collection for marketing purposes, unless consent is withdrawn.

6. Data Subject Rights

At any time, you may exercise, pursuant to articles 15 to 22 of the GDPR, the right to:

• Access to personal data
• Rectification or erasure of the same
• Restriction of processing
• Data portability
• Object to processing
• Withdraw consent

To exercise these rights, you can contact the Data Controller at the email address: privacy@saluteora.it

Last updated: April 30, 2025