Patient privacy notice

1. Data controller

Francesco Palvarini, Osteopath D.O., VAT no. IT02665340200, email info@francescopalvarini.com, phone +39 340 182 1684.

Practice locations: Milan, OMNIA LAB CityLife, Via Lorenzo Mascheroni 25; Mantua, U NEAT Health Club, Via Franklin Vivenza 2; online.

2. What data I process

• identification and contact data: name, date of birth, tax code, address, email, phone; for minors, the data of those with parental responsibility;
• health data: history, symptoms, reports and tests you bring, assessments, tests, treatments, exercises and advice, informed consents, any photos or videos taken for assessment;
• administrative and tax data: appointments, invoices, payments;
• once the patient area is live: login details, access logs and notification preferences.

You provide the data yourself or, with your consent, the professionals who look after you do.

3. Why I process it and on what basis

• Assessment, osteopathic treatment, exercise programmes, video consultations and record keeping: necessary to provide the service (Art. 6(1)(b) and Art. 9(2)(h) GDPR, health professional bound by professional secrecy). No privacy consent is needed, but informed consent to the service is (Italian Law 219/2017).
• Bookings, invoicing and tax obligations, including reporting to the Italian Health Card System where required: legal obligation and contract (Art. 6(1)(b) and (c) GDPR).
• Sharing with your doctor or other professionals who look after you or referred you: only with your explicit consent (Art. 9(2)(a) GDPR).
• Reminders and notifications by email, WhatsApp or app: optional, with your consent.
• Newsletter and informative content: optional, with your consent, which you can withdraw at any time.
• Protecting my rights in case of disputes: legitimate interest (Art. 6(1)(f) and 9(2)(f) GDPR).

Refusing the optional consents does not change your care in any way.

4. Video consultations

Video calls take place on Whereby (Whereby AS, Norway, servers in the European Economic Area), with an encrypted connection and a private room. Sessions are not recorded. Photos or videos useful for assessment are taken only with your agreement and kept in your records.

5. How I protect your data

I use electronic and, where needed, paper tools with appropriate security measures: protected access, encryption, backups, and separation of health data from administrative data. There is no profiling or automated decision-making.

Reminders and notifications contain no clinical data: only the date and place of the appointment or the presence of a document to read.

6. Who it may be shared with

• providers working on my behalf, appointed as processors: hosting and patient area, video platform (Whereby), email service (Brevo), online payments (Stripe), accountant;
• the facilities that host me (OMNIA LAB, U NEAT Health Club), only to manage appointments and rooms, with no access to clinical data;
• doctors and other health professionals, only with your consent or at your request;
• the Italian tax authorities, Health Card System, public authorities and professional insurer, where required by law.

Data is never published or sold.

7. Transfers outside the EU

I keep data in Europe. If a provider processes it outside the European Economic Area, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses (Art. 46 GDPR). If you ask me to send documents to a professional in a country without adequacy, I do so only with your explicit consent (Art. 49(1)(a) GDPR).

8. How long

• clinical records, history, consents and test results: 10 years from the last service, for care and legal protection;
• tax and accounting data: 10 years, as required by law;
• optional consents (notifications, newsletter): until withdrawn.

9. Minors

For patients under 18, the notice is given to and consents are provided by both parents or those with parental responsibility. I never publish images or testimonials of minors.

10. Your rights

You can ask for access to and a copy of your records, rectification, erasure within the limits of retention obligations, restriction, portability, object to processing and withdraw your consents at any time (Arts. 15-22 and 7(3) GDPR), by writing to info@francescopalvarini.com. I reply within 30 days.

You can lodge a complaint with the Italian data protection authority (www.garanteprivacy.it) or the authority of the European country where you live.