We use technical cookies required for the website to work and, only with your consent, statistical measurement tools. You can accept, reject or choose category by category: your choice can be changed at any time.
This information notice describes the methods of processing personal data of users who visit the site malatestanovello.it and is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
Note. This information notice concerns the website only. The processing of personal and health data of patients, within the scope of hospitalization and outpatient services, is governed by the Patient Privacy Notice pursuant to Article 13 GDPR, delivered and signed on site.
1. Data Controller
The Data Controller is Casa di Cura Malatesta Novello S.r.l., represented by the Legal Representative pro tempore.
The computer systems and software procedures used to operate the site acquire, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols: IP addresses, browser type and operating system, date and time of the request, pages visited, server response outcome. These data are used to obtain anonymous statistical information on the use of the site and to ensure its proper functioning and security; they are stored in system logs for the strictly necessary time and may be used to ascertain responsibility in case of computer crimes against the site.
3.2 Data voluntarily provided by the user
Some functions of the site require the provision of personal data. Each form indicates the mandatory fields: failure to provide these prevents the provision of the requested service.
Servizio
Dati trattati
Contact form and information requests
First name, last name, email, phone, message content
Online booking for the Analysis Laboratory
First name, last name, tax code, date of birth, email, phone, requested tests, any prescription, payment data managed by the payment provider
Applications “Work with us”
Personal and contact details, curriculum vitae and information contained therein, professional area of interest
Satisfaction surveys
Survey responses, department or service of reference, proof of consent given
Account registration, where activated
First name, last name, email, encrypted access credentials
3.3 Special categories of data
The booking of healthcare services and the uploading of a prescription involve the processing of health-related data (Article 9 GDPR). Such data are processed exclusively for the provision of the requested service, by healthcare personnel or personnel subject to an equivalent obligation of confidentiality, pursuant to Article 9, paragraph 2, letter h) GDPR. Users are advised not to enter health-related data in the free fields of contact forms, which are not intended to receive them.
4. Purposes and Legal Bases
Finalità
Base Giuridica
Fornitura
Respond to information requests
Art. 6.1.b (pre-contractual measures) and 6.1.f (legitimate interest to respond)
Necessario
Manage bookings and provide healthcare services
Art. 6.1.b and art. 9.2.h (healthcare purposes)
Necessario
Manage online payment of services
Art. 6.1.b (contract execution) and 6.1.c (tax obligations)
Necessario
Evaluate job applications
Art. 6.1.b (misure precontrattuali)
Necessario
Measure user satisfaction
Art. 6.1.a (consenso)
Opzionale
Ensure security, integrity, and continuity of the site
Art. 6.1.f (interesse legittimo)
Necessario
Measure site usage statistically
Art. 6.1.a (consenso espresso tramite banner)
Opzionale
Comply with legal, accounting, and healthcare documentation retention obligations
Art. 6.1.c
Mandatory by law
Ascertain, exercise, or defend a right in court
Art. 6.1.f and art. 9.2.f
–
5. Processing Methods and Security Measures
Processing is carried out using IT and telematic tools and, where necessary, on paper, with logic strictly related to the purposes indicated and in a way that ensures the security and confidentiality of the data. The site is fully served in HTTPS with a valid certificate; account passwords are stored in an irreversible encrypted form; access to management tools is nominative and tracked; proof of collected consents is recorded in an append-only archive, protected by a hash chain and automatic integrity checks.
6. Data Recipients
The personal data provided are not disseminated nor transferred to third parties for marketing purposes. They are communicated to recipient entities in their capacity as data processors (art. 28 GDPR) and/or as individuals acting under the authority of the Controller and the Processor (art. 29 GDPR), solely for the purposes indicated above.
In particular, data are communicated to:
employees and collaborators of the Controller, expressly authorized and instructed in processing;
entities providing IT system and communication network management services, including email and website;
entities providing electronic payment services, for online paid bookings only;
professionals and companies providing assistance and consultancy services, including accounting, tax, and legal matters;
Competent Authorities, for compliance with legal obligations.
The updated list of external Data Processors is available at the Controller and can be requested at any time at the contacts indicated in point 1.
7. External Resources Loaded by the Site
For technical reasons, some site resources (fonts, display libraries, maps) are loaded from third-party providers. These services do not install profiling cookies but, by merely serving a file, may receive the visitor's IP address.
Risorsa
Fornitore
Finalità
Bunny Fonts
BunnyWay d.o.o. (Slovenia, EU)
Site fonts, alternative to Google Fonts that does not track users
cdnjs / jsDelivr / Tailwind CDN
Cloudflare Inc., jsDelivr
Graphic and interface libraries
OpenStreetMap
OpenStreetMap Foundation
Map to reach the facility on the Contacts page
The site does not use Google Fonts, Google Maps, Facebook's "Like" button, or other social widgets.
8. Site Virtual Assistant (Clara)
The site provides a virtual assistant, called Clara, which answers questions about the facility's services using only the content published on the site itself. Clara is not a person and does not provide diagnoses, clinical opinions, or prescriptions.
When you write a message in the chat, only the text you typed – along with excerpts from the site's pages relevant to the question – is sent to the provider OpenAI Ireland Ltd., which processes the response on behalf of the Controller as the data processor. Your name, email, IP address, or any data derived from your browsing are not transmitted.
We invite you not to write personal data, health data, or information related to other people in the chat. They are not needed to get a response, and the chat is not the appropriate channel to receive them: for those requests, use the contact form, phone, or the facility's counters.
Messages are not used to train artificial intelligence models and are not stored by the Controller in a form associated with an identifiable user; the provider retains them for the technical time necessary to provide the service and for its own anti-abuse checks, according to its policy. Legal basis: art. 6.1 letter f) GDPR, legitimate interest of the Controller to provide informational assistance to visitors. The use of the chat is always optional: the same information is available by browsing the site, by phone, or via email.
9. Data Transfer Outside the European Union
Data is generally processed within the European Union. If a provider involves a transfer to third countries, this occurs exclusively in the presence of an adequacy decision by the European Commission or based on the Standard Contractual Clauses adopted pursuant to art. 46 GDPR, accompanied by the necessary supplementary measures. The user can obtain a copy of the adopted safeguards by writing to the Controller.
10. Retention Period
Dati
Conservazione
Information requests via form
24 months from the last contact
Bookings and related health documentation
According to the internal procedure adopted by the Nursing Home in application of the Selection Guide for the Archives of Local Health Authorities and Hospital Companies of the Ministry of Cultural Heritage, and in any case within the terms established ex lege
Accounting and tax documents
10 years (art. 2220 c.c.)
Job applications
24 months from receipt, unless revoked earlier
Responses to satisfaction questionnaires
In aggregated and non-identifying form for statistics; identifying data is deleted at the end of the survey
Proof of cookie consents
Up to 24 months, as required by the regulations on proof of consent
System logs
Maximum 12 months, unless needed for crime investigation
At the end of the retention period, the data is deleted or made permanently anonymous.
11. Cookies and Tracking Tools
The site uses technical cookies necessary for its operation and, with consent, statistical measurement tools. All detailed information, the list of cookies, and instructions for modifying or revoking consent are provided in the Cookie Policy.
12. Processi Decisionali Automatizzati
The Controller does not adopt automated decision-making processes, including profiling, that produce legal effects on the user or similarly significantly affect their person. The virtual assistant described in point 8 only provides information already published on the site and does not make any decisions regarding the user.
13. Data Subject's Rights
At any time, the user can exercise, within the limits provided by law, the following rights:
Access (art. 15): obtain confirmation of the existence of processing, the information concerning it, and a copy of the data.
Rectification (art. 16): correct or complete inaccurate or incomplete data.
Erasure (art. 17): obtain the removal of data when there are no retention obligations.
Restriction (art. 18): request that the data be only stored and not otherwise processed.
Portability (art. 20): receive the data in a structured, commonly used, and machine-readable format, or request its transmission to another controller.
Objection (art. 21): object to processing based on legitimate interest for reasons related to one's particular situation.
Withdrawal of consent (art. 7.3): withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
14. How to exercise rights and complaints
Requests should be addressed to the Controller at info@malatestanovello.it or to the Data Protection Officer (DPO) at dpo@malatestanovello.it. Exercising rights is free of charge, and the Controller responds without undue delay and in any case within one month of receiving the request.
The user who believes that the processing of their data is in violation of the GDPR has the right to lodge a complaint with the Data Protection Authority (Piazza Venezia 11, 00187 Rome – garanteprivacy.it) or to take legal action with the competent judicial authority.
15. Changes to this notice
The Controller reserves the right to update this notice to adapt it to regulatory, organizational, or technical changes. Changes are published on this page with an indication of the date of the last update, and when they concern processing based on consent, the user is consulted again. Each version of the notice is kept by the Controller in an unalterable historical archive.
Automatically generated responses: they may be incomplete or outdated and do not replace a doctor's opinion. The text you write is processed by an external provider to compose the response: do not enter personal or health data, yours or others. For emergencies call 118 · Privacy policy
Reading Preferences
They apply only to you and remain saved on this device. The site works with screen readers, keyboard, and browser zoom even without changing them.
