Privacy Policy
**pursuant to Article 13 of EU Regulation No. 2016/679 (GDPR)**
This document provides information to all those who, wishing to use the dental services of Studio Odontoiatrico Ass. Gracis e Capelli, provide, by completing this questionnaire, both common and special categories of personal data necessary to compile a detailed medical history. In this regard, we wish to inform users that "EU Regulation No. 2016/679 (GDPR)" provides for the protection of natural persons with regard to the processing of personal data.
The Data Controller is Stefano Gracis (hereinafter also the "Controller" or the "Dental Practice"), with registered office at Via Brera, 28/a - CAP 20121 MILAN - Tax Code and VAT No. 003900000000. IT12819590154 and VAT number IT12819590154 - PEC: studiograciscapelli@legalmail.it, represented by its legal representative pro tempore. Pursuant to Article 13 of the GDPR, users are informed that such processing will be based on the principles of fairness, lawfulness, and transparency, protecting the privacy and rights of the user. The data controller intends to process personal data for the following purposes:
Purpose of processing
The information requested through this questionnaire is instrumental in managing healthcare services between doctor and patient, tailored as much as possible to the patient's personal circumstances and is careful to avoid potential critical issues that could impact their overall state of health.
Legal basis
In compliance with the provisions of Article 6.1 and Article 13 of the GDPR, 9.2 of the GDPR, the legal basis for the lawful processing of personal data collected by the Data Controller is represented by: 1. the execution of pre-contractual measures with customers/patients, once the personal data fields have been filled in [Article 6.1 letter b) GDPR]; LEGAL BASIS relating to common personal data.
2. the express, free, specific, informed, and unambiguous consent given by the user/patient by filling in the personal data fields for the purpose of activating the questionnaire and by the adult user/patient only to publish, in addition to their personal data, a passport-sized photograph [Article 6.1 letter a) GDPR];
3. the fact that the processing is necessary for the purposes of preventive medicine [...], diagnosis, healthcare or social assistance or therapy [...]; [Article 9.2 letter h) GDPR and Articles 75, 77, and 78 of Legislative Decree no. 196/2003 and no. 101/2018];
4. the need to ascertain, exercise, or defend a right in court or out of court [...]; [Article 9.2, letter f) of the GDPR].
Processing methods
The Data Controller processes personal data through a function of the ALFRED management system, using methods strictly related to the purposes themselves and, in any case, in compliance with the general principles set forth in Article 5 of the GDPR, in particular the data minimization principle pursuant to Article 5.1, letter c), and in compliance with the provisions on the protection of minors, as vulnerable individuals [Article 8 of the GDPR].
Retention periods
All personal data processed by the Data Controller in the context of its activities are retained according to the following periods or criteria:
SCOPE OF PROCESSING |
PURPOSE OF PROCESSING |
DURATION OF RETENTION FROM COLLECTION |
Relationship with clients/patients |
Creation of potential client database |
2 years from the first introductory visit if the client does not continue with treatment |
Relationship with clients/patients |
Performance of dental services |
5 years from the last procedure medical. |
After these terms, the data in this questionnaire will be deleted or aggregated.
Mandatory nature and consequences of refusal to provide data
The personal data requested in this questionnaire and processed by the Data Controller as part of its business activities are necessary for the provision of dental services. They allow the doctor to build an important anamnesis within which to base the diagnostic work, plan a contextualized intervention that takes into account the patient's specific health condition, and minimize the risk of detrimental consequences for their health.
Parties to whom personal data may be disclosed
To comply with certain legal obligations relating to tax, fiscal, insurance, social security, and banking matters, or to protect its rights in or out of court, the Data Controller, as part of its business activities, may disclose any personal data processed to:
1. External professionals/consultants in management systems (e.g., occupational safety and privacy);
2. ICT and cybersecurity service providers;
3. Doctors/specialized professionals with whom the Data Controller collaborates.
The Data Controller processes the personal data necessary to achieve the indicated purposes through individuals within its organization authorized by a formal letter of appointment, trained, and committed to a duty of confidentiality regarding the information processed. Some of the recipients to whom the Data Controller discloses personal data act on its behalf and are therefore designated "Data Processors" pursuant to Art. 28 of the GDPR through a formal contract. A list of the main data processors is available by contacting the Data Controller at the firm's email address.
Transfer abroad (outside the EU)
The personal data processed as described in this policy is not transferred outside the EU.
Rights of the Data Subject
In relation to the processing of personal data by the Practice, users/patients always have the right, within the limits and under the conditions set forth in Articles 15-22 of the GDPR, to exercise the following rights:
1. Right of access; 2) Right to rectification and erasure; 3) Right to data portability; 4) Right to restriction of processing; 5) Right to object to direct marketing based on the data controller's legitimate interest; 6) Right not to be subject to a decision based solely on automated processing.
The Data Controller shall communicate any rectification, erasure, or restriction of processing to all recipients to whom the data subjects' personal data has been disclosed, unless this proves impossible or involves disproportionate effort.
To effectively exercise these privacy rights under the conditions set forth in the GDPR, please contact the Data Controller at the practice's email address and request the dedicated form.
7. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority if they believe their data is being used unlawfully and the processing continues despite their request to the data controller to cease processing. To lodge a complaint, please visit the dedicated webpage on the Italian Data Protection Authority's website.
