Information pursuant to art. 13 of Regulation (EU) 2016/679 (“GDPR”) — version of October 26, 2025
Dear Madam, Dear Sir,
Casa di cura privata Malatesta Novello S.r.l., as the data controller of personal data, in compliance with the provisions of Regulation EU 2016/679, informs you that the personal data you provide will be processed in accordance with current legislation and as described below.
1. Data controller and contacts
| Data controller | Casa di cura privata Malatesta Novello S.r.l., in the person of its legal representative – Via R. Serra 2, Cesena (FC) – Cod. Fisc. e P. IVA 00377720404 |
| Data Protection Officer (DPO) | dpo@malatestanovello.it |
| Data processor | Dr. Gianluca Bersani – Direttore Sanitario – gilube@malatestanovello.it |
| Data processor | Dr. Valentina Valentini – Direttore Amministrativo – vvalentini@malatestanovello.it |
2. Dati personali trattati
For the purposes of this information notice, the Data Controller processes your personal data and specifically:
Dati personali comuni
By way of example: name, surname, place and date of birth, tax code, residence address, number and copy of identity document, telephone and email contacts, bank details (IBAN), photographic and video material through video surveillance system.
Special categories of personal data
Special data concerning your health status. The Data Controller may also process further special categories of personal data and in particular: data suitable to reveal racial and ethnic origin, genetic data, data relating to your sex life or sexual orientation or images related to the surgical intervention (but always for purposes of prevention, diagnosis, care, therapy, rehabilitation).
The personal data indicated above are provided to the Data Controller personally by the patient or, alternatively, by a person specifically delegated in writing who has the legal representation of the patient.
3. Purpose, legal basis and retention period
| Purpose of processing | Type of data and legal basis | Retention period |
|---|---|---|
| Execution of medical-health services and requested services, namely prevention, diagnosis, care, therapy, rehabilitation – including diagnostic tests and laboratory analyses, therapeutic services, specialist outpatient services, hospital admissions, post-discharge health services, continuous and home care assistance. | Common and special personal data. Legal basis: art. 6.1 lett. b), d), e) – art. 9.2 lett. c), h) GDPR |
Your personal data are processed for the time strictly necessary to achieve the purposes for which they were collected by the undersigned Data Controller, except in any case for the longer term established ex lege. The Clinic has adopted an internal procedure regarding the retention of personal data as provided by the Selection guide for the archives of local health authorities and hospital companies of the Ministry of Cultural Heritage. After the aforementioned retention periods, your personal data will be irreversibly and permanently deleted using secure techniques. |
| Administrative, accounting, certification, and management activities strictly connected to the aforementioned purposes and the management of relations between the Clinic and the patient. Execution of obligations required ex lege or imposed by a Public Authority. Statistical purposes and archiving in the public interest, in compliance with techniques of anonymization, pseudonymization, and encryption of personal data. |
Common and special personal data. Legal basis: art. 6.1 lett. b), c), e) – art. 9.2 lett. c), g), h), i), j) GDPR |
|
| Fulfillment and exercise of the data subject's rights. | Common and special personal data. Legal basis: art. 6.1 lett. c) in conjunction with art. 9.2 lett. h) GDPR |
For the time necessary to respond to the request and within the legal terms. |
| Communication of information regarding your health status to subjects indicated by you (including hospitalization in the Clinic). Sending documents via e-mail. |
Common and special personal data. Legal basis: art. 6.1 lett. a) and e), art. 6.2 lett. a) – art. 9.2 lett. a) GDPR Optional and revocable consent. |
Your personal data will be processed and retained until the purposes for which they were collected are achieved and in compliance with current legislation, and in any case until the consent given is revoked. |
| Provision of your health data in your Electronic Health Record (EHR). | Obbligo legale. | For the time strictly necessary to achieve the purposes for which they were collected, except for the longer term established ex lege. |
| Finalità difensive. | Common and special personal data. Legal basis: art. 6.1 lett. f), art. 9.2 lett. f) GDPR |
In the event of judicial litigation, your personal data will be retained for the entire duration of said litigation and until all means of appeal are exhausted. |
4. Obligation to provide data
The processing of your personal data is essential and necessary for the proper management of the relationship and for achieving the purposes of prevention, care, diagnosis, assistance, health therapy, and rehabilitation, as well as those administrative purposes strictly related. Therefore, the provision of the same is mandatory for the above purposes, except for processing based on your specific consent. Failure or incorrect communication of such data may prevent the processing itself.
An exception to the above is the “Communication of information regarding your health status to subjects indicated by you (including hospitalization in the Clinic)”, for which your specific consent is required: this processing is therefore optional.
5. Methods of processing
The processing of Your personal data is carried out in compliance with the provisions of the GDPR, using IT, electronic and paper tools, by subjects specifically appointed pursuant to art. 29 of Regulation (EU) 2016/679 and instructed by the Data Controller. The processing is carried out in such a way as to ensure data security, as provided for by art. 32 GDPR and Legislative Decree no. 196/2003.
6. Data Recipients
Your personal data are not subject to dissemination. Profiling is not carried out and no automated decision-making processes are envisaged.
Said data are communicated to third parties when this is provided ex lege or necessary for the performance of services related to the management of the relationship established with You, as independent data controllers or external data processors pursuant to art. 28 GDPR, specifically appointed by the Data Controller, and precisely:
Compliance with a legal obligation or order of an Authority
Public and private entities authorized to process Your personal data ex lege, by regulation or community legislation, or by virtue of an order of the Authority.
Companies and external consultants
- general practitioners;
- external companies in charge of maintaining the IT services of the facility and the management systems of the company;
- tax, administrative and legal consultants;
- esperti;
- banks and credit institutions;
- exchange system of the Revenue Agency for electronic invoicing;
- insurance companies, social security and welfare institutions, insurance broker;
- service companies (analysis laboratory, etc.) and suppliers of services specifically related to the activity carried out by the Data Controller.
7. Subjects authorized to process
Your personal data are processed by personnel and collaborators of the Data Controller specifically appointed pursuant to art. 29 GDPR and recipients of specific operational instructions, distinct by role and tasks performed.
8. Transfer of personal data to non-EU countries
Your data will not be transferred to non-EU countries or to an international organization. Should such transfer become necessary for organizational needs of the undersigned Data Controller, it will only be carried out in compliance with current legislation and by adopting legal guarantees (for example: adequate protection guarantees; adoption of standard contractual clauses approved by the European Commission; adoption of binding corporate rules authorized by the Data Protection Authority).
9. Data Subject's Rights
By contacting the undersigned Data Controller at the contact details indicated above, You may exercise the rights recognized by the GDPR:
- right to rectify inaccurate data;
- right to erasure (right to be forgotten) – art. 17 GDPR;
- right to restriction of processing in the cases provided for by art. 18 GDPR;
- right to data portability;
- right to object to automated decision-making relating to individuals, including profiling;
- right to object, at any time, to the processing of personal data concerning You based on the condition of lawfulness of legitimate interest, including profiling, without prejudice to the existence of legitimate reasons for the Data Controller to continue processing that prevail over Your interests, rights and freedoms, or for the establishment, exercise or defense of a right in court.
The undersigned Data Controller must respond to You within the term of one month, extendable up to three months in the case of particularly complex requests, from the date of receipt of the request.
In cases of processing based on art. 6, paragraph 1, letter a), or on art. 9, paragraph 2, letter a) GDPR, You can withdraw consent at any time previously given, without affecting the lawfulness of processing based on consent given before withdrawal.
With specific reference to profiling, you have the right not to be subject to a decision based solely on automated processing, unless such decision: a) is necessary for the conclusion or execution of a contract with the undersigned Data Controller; b) is authorized ex lege; c) is based on your explicit consent. In the cases referred to in letters a) and c), you have the right to express your opinion, contest the decision, and request and obtain human intervention from the Controller.
You also have the right to object, at any time, to the processing of your personal data for marketing purposes and related profiling; in case of objection, your personal data will no longer be processed for these purposes.
10. Complaint to the Supervisory Authority
If you believe that the processing of your personal data is carried out by the Controller in violation of legal regulations, you have the right to lodge a complaint with the supervisory authority, or, in Italy, with the Data Protection Authority (www.garanteprivacy.it).
The exercise of your rights is free of charge pursuant to art. 12 GDPR, except for requests that are manifestly unfounded or excessive – also due to their repetitiveness – for which the undersigned Controller may charge you a reasonable fee as a contribution to expenses, concerning the administrative costs incurred based on such request.
11. Acknowledgment and Optional Consent
The acknowledgment of this information and any optional consent to the communication of information regarding your health status to individuals you have indicated are collected in written form at the facility, by signing the appropriate form, in which it is possible to indicate the name, surname, and date of birth of the person authorized to receive the information.
Privacy Communications
Information and communications on the processing of personal data.
- Format
- Size
- 1,3 MB
