Privacy & Policy

This policy concerns the processing of data carried out by AD CARE S.r.l., with its registered office in Milan, Via Mazzini 12, VAT number 10792300963, email address: info@ad-care.it, (hereinafter the "Data Controller"), also in compliance with EU Regulation 2016/679 (hereinafter the "GDPR").

The Data Controller may process personal data concerning customers, suppliers, agents, consultants, whether they are interested parties and/or contractors, as defined by the current regulations on personal data.

1. Identity and contact details of the data controller

The Data Controller is AD CARE S.r.l. Since the Data Controller is established in Italian territory, no representative has been appointed.

2. Contact details of the data protection officer

The Data Controller has appointed Attorney Simone Bonavita as the data protection officer and can be contacted at the following address: privacy@ad-care.it

3. Data of third-party subjects

If the customer should communicate personal data of third parties for the purpose of executing the contract, the customer must inform the third party of this circumstance and provide the third party with this policy.

4. Processing purposes and legal basis for processing

Personal data will be processed for the following purposes:

a) For contractual purposes and/or related to the execution of pre-contractual measures (such as, for example, preparing quotes, communicating data to insurance companies) adopted at your specific request. In this case, the legal basis is the necessity of processing for the performance of the contract and/or for the management of pre-contractual relationships;

b) For purposes related to legal obligations if processing has been carried out for the purposes referred to in letter a). In this case, the legal basis is the legal obligation of the Data Controller to process such personal data in accordance with applicable national law;

c) To send non-commercial communications, such as appointment reminders set by the data subject, information about the status of the patient's appointment, information relevant to the patient's health status, such as preventing diseases or providing information related to the progress of the data subject's health, even if not related to the purposes mentioned in point a). In this case, the legal basis is the legitimate interest of the Data Controller;

d) For sending non-commercial communications aimed at updating the data subject on the discovery of new products and/or medical techniques capable of addressing any diseases. In this case, the legal basis is consent, given in accordance with this policy;

e) For activities involving the determination of habits and preferences through profiling of non-special categories of data. In this case, the legal basis is the data subject's consent, given in accordance with this policy;

f) For sending marketing communications, through automated computer systems, including commercial or promotional communications via email or SMS, or for market research and analysis. In this case, the legal basis is consent, given in accordance with this policy.

5. Consent expression methods

Consent, where required, can be given:

• By signing a digital document, including specific checkboxes;
• By signing a paper document.

6. Processing methods and logic

With regard to personal data processed and stored for the purposes referred to in points a), c), number 4, processing will be carried out using paper-based tools, automated logic, and the use of CRM-type management software that will optimize the performance of contractual obligations;

With regard to personal data processed and stored for the purposes referred to in point b), number 4 of this policy, processing will be carried out using paper-based tools, automated logic, and the use of CRM-type management software;

With regard to personal data processed for the purposes referred to in points d) and f), number 4 of this policy, processing will be carried out using automated software for sending information;

With regard to personal data processed for the purposes referred to in point e), number 4 of this policy, processing will be carried out using CRM that allows defining tastes and preferences in order to offer personalized services and communications. For further details, see the next section.

7. Automated decision-making and profiling

In the event that you provide your consent for the processing of personal data for the purpose of enjoying personalized services through profiling, such data may be subject to automated decision-making through a specific algorithm that will decide which communications are most suitable for your profile or which may be of greater interest.

The processing carried out in this way may include, as envisaged consequences, highly profiled commercial communications, the sending of discounts, invitations to events considered of interest, etc. The data subject has the right, in any case, to obtain human intervention in the decision-making process by the Data Controller, to express their opinion, to obtain an explanation of the decision reached, and to contest the decision itself. Special categories of data will never be profiled in any case.

8. Source of personal data

Only data provided in accordance with this policy will be processed, collected at our premises, or by sending emails. With regard to processing carried out for the purpose of making personalized services available through profiling, such data may be correlated in order to obtain further profiled information. Personal data from other sources may also be processed: such as tests and X-rays. Personal data from publicly accessible sources will not be processed.

9. Recipients and any categories of recipients of personal data

Recipients of personal data may include:

• Communication companies that carry out commercial communication and profiling activities on behalf of the Data Controller, if consent has been given, which qualify as data processors;
• Companies offering information society services, including, in particular, those offering hosting services;
• Companies conducting statistical and market research, if consent has been given;
• Insurance companies, including those of the data subject;
• Accounting audit companies.

10. Categories of data

Personal data as well as special categories of data revealing your state of health will be processed.

11. Data transfer

The Data Controller intends to transfer personal data to a third country or international organization. These entities may be represented, for example, by:

• Communication companies that carry out communication activities on behalf of the Data Controller;
• Providers of communication society services.

The transfer of personal data to such entities, whether established in a third country or an international organization, is carried out in the presence of an adequacy decision by the European Commission, which has verified that the third country, the territory or one or more specific sectors within the third country, or the international organization in question, ensures an adequate level of protection of rights.

In any case, the Data Controller, if deemed appropriate, reserves the right to conclude specific separate agreements obliging such entities to adopt adequate security measures, including organizational measures, to provide appropriate guarantees regarding rights. Data may thus be transferred to the United States of America. To obtain a copy of such data or the location where they have been made available, simply send a request to the Data Controller at the addresses in the header.

12. Personal data retention period

Personal data processed and stored for the purposes referred to in point a), number 4 of this policy (contractual purposes and/or related to the execution of pre-contractual measures) will be processed for a period of no more than 10 years from the date the contract expires, in case of termination, and, in the case of mere pre-contractual negotiations, for a period not exceeding 10 years from the date negotiations cease;

Personal data processed and stored for the purposes referred to in point b), number 4 (compliance with legal obligations) of this policy will be processed and stored for a period not exceeding 10 years from the date the contract expires, in case of termination, and, in the case of mere pre-contractual negotiations, for a period not exceeding 10 years from the date negotiations cease, without prejudice to any different legal provisions;

Personal data processed for the purposes referred to in point c), number 4 of this policy (non-commercial communication purposes possibly related to the purposes referred to in point a)) will be processed and stored until the data subject requests their deletion;

Personal data processed for the purposes referred to in point d), number 4 of this policy (sending non-commercial communications aimed at updating the data subject on the discovery of new products) will be processed and stored until the data subject requests their deletion and/or revocation;

Personal data processed for the purposes referred to in point e), number 4 of this policy (purposes of determining preferences) will be processed and stored for a period not exceeding 12 months from the date of collection;

Personal data processed for the purposes referred to in point f), number 4 of this policy (marketing purposes) will be processed and stored until the data subject requests their deletion and/or revocation.

13. Optional consent and consequences of non-consent

Regarding personal data processed and stored for the purposes referred to in point a), number 4 of this policy (contractual purposes and/or related to the execution of pre-contractual measures), the communication of personal data is a contractual obligation and a necessary requirement for the performance of pre-contractual negotiations and the conclusion of the contract.

The data subject has the option to provide personal data; however, in the absence of communication of such data, it will not be possible to conclude any contract or carry out any contractual negotiation;

Regarding personal data processed for the purposes referred to in point b), number 4 of this policy (legal obligations), the communication of personal data is a legal obligation. There is an obligation, in this case, to provide personal data; in case of failure to communicate such data, it will not be possible to conclude the contract;

Regarding personal data processed for the purposes referred to in point c), number 4 of this policy (purposes of non-commercial communication possibly related to the purposes referred to in point a)), the communication of personal data is not a contractual obligation. There is the option to provide personal data; in case of non-consent to the communication of such data, it will not be possible to send communications;

Regarding personal data processed for the purposes referred to in point d), number 4 of this policy (sending non-commercial communications aimed at updating the data subject on the discovery of new products), there is the option to give consent; however, in the absence of communication of such data, it will not be possible to send any communication;

Regarding personal data processed for the purposes referred to in point e), number 4 of this policy (purposes of determining preferences), there is the option to provide personal data; however, in case of non-consent, it will not be possible to carry out any personalization activity;

Regarding personal data processed for the purposes referred to in point f), number 4 of this policy (marketing purposes), the communication of personal data is not a contractual obligation. There is the option to provide personal data; in case of non-consent to the communication of such data, it will not be possible to send communications.

14. Right to object

The data subject has the right to object as follows:

• The right to object at any time, for reasons related to their particular situation, to the processing of personal data concerning them pursuant to Article 6, paragraphs 1(e) or (f) of the GDPR, including profiling based on these provisions. The Data Controller refrains from further processing personal data unless they demonstrate compelling legitimate reasons for processing that override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of a legal claim;
• If personal data are processed for direct marketing purposes, the right to object at any time to the processing of personal data concerning them for such purposes, including profiling to the extent that it is related to such direct marketing;
• In the event of opposition to processing for direct marketing purposes, personal data will no longer be processed for such purposes. It is specified that the data subject's right to object to the processing of their personal data for the aforementioned purposes may also be exercised in part, i.e., by objecting, for example, only to the sending of promotional communications carried out through automated methods or to traditional methods, or to profiling only through automated methods or to traditional methods. The data subject can also make use of the right to object, in whole or in part, in the event of profiling carried out for purposes related to direct marketing;
• The right to withdraw the consent given at any time, without prejudice to the lawfulness of the processing based on the consent given before the revocation.

15. Rights of the data subject

The data subject may exercise the rights referred to in Articles 15 to 22 of the GDPR, including the following:

• The right to obtain from the Data Controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and information related to the processing;
• The right to obtain from the Data Controller the rectification of inaccurate personal data concerning them without undue delay;
• The right to obtain from the Data Controller the erasure of personal data concerning them without undue delay;
• The right to obtain from the Data Controller restriction of processing;
• The right to receive the personal data concerning them in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Data Controller;
• The right to lodge a complaint with a supervisory authority;
• The right to receive without undue delay from the Data Controller information about the appropriate safeguards referred to in Article 46 of the GDPR in relation to the transfer of personal data to a third country or international organization;
• The right to be informed of the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

16. How to exercise rights

The data subject may exercise their rights at any time by sending a registered letter with return receipt to the address of the Data Controller, or by sending an email to the following address: privacy@ad-care.it.

17. Changes to this policy

The Data Controller reserves the right to modify this policy at any time by giving notice to users on this page. Therefore, it is recommended to consult this page often, referring to the date of the last modification indicated at the bottom. In the event of non-acceptance of the changes made to this policy, the data subject is required to cease using this application and may request the Data Controller to remove their personal data.

18. Legal references

This privacy policy is drawn up on the basis of multiple legislative systems, including Articles 13 and 14 of Regulation (EU) 2016/679.