Privacy Notice
This notice describes how personal data is processed for users who browse the website cellwellness.it and for those who contact the practice to request information or book an assessment. Processing follows the principles of lawfulness, fairness, transparency, data minimisation and storage limitation set out in Article 5 GDPR.
1Data controller
The data controller is Prof. Maurizio Maggiorotti, physician practising his medical profession at Studio Medico Parioli, with the following contact details:
- Address: Via G. Antonelli, 47 — 00197 Rome (RM), Italy
- Phone: +39 347 7859068 · 06 802454
- Email: maggiorotti@gmail.com
- VAT / Tax number: [TO BE COMPLETED BEFORE PUBLICATION]
2Data protection officer (DPO)
The controller has not appointed a Data Protection Officer, as the conditions for mandatory appointment under Article 37 GDPR do not currently apply to this practice. Should the processing of health data become «large scale» within the meaning of Article 37(1)(c) GDPR, the controller will proceed with the appointment and update this notice accordingly.
3Categories of data processed
| Category | Examples |
|---|---|
| Identification and contact data | Name, surname, phone number, email address, provided voluntarily to book or request information. |
| Health data (Article 9 GDPR) | Symptoms, clinical conditions and any health information voluntarily provided by the data subject or collected during the medical service. |
| Navigation data | IP address, browser and device type, server technical logs, processed in aggregate form for the operation and security of the site. |
4Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to information requests and managing appointment bookings | Article 6(1)(b) GDPR — pre-contractual measures requested by the data subject. |
| Providing the medical service and managing clinical data | Article 9(2)(h) GDPR — preventive medicine, diagnosis and care, provided by a professional bound by professional secrecy under Article 9(3) GDPR and Article 75 of Legislative Decree 196/2003. |
| Legal obligations (tax, accounting, healthcare) | Article 6(1)(c) GDPR — legal obligation. |
| Technical operation and security of the website | Article 6(1)(f) GDPR — the controller's legitimate interest in providing a secure service. |
| Informational communications and educational content (any, in the future) | Article 6(1)(a) GDPR — free, specific and revocable consent. Not active as of today. |
5Contact channels and nature of provision
The website hosts no data-collection forms. Contact takes place solely through the indicated channels (WhatsApp, phone, email, in-person). Providing identification and contact data is optional but necessary to receive a reply or book: failure to provide it makes it impossible to act on the request.
6Recipients and processors
Data may be processed, on behalf of the controller and within the limits of their respective purposes, by the following parties, appointed as processors under Article 28 GDPR where applicable:
- The website hosting provider, for the publication and security of the web pages.
- Communication service providers (telephone operator, email provider, Meta Platforms for WhatsApp) chosen by the data subject to contact the practice.
- Advisors and professionals (accountant, labour consultant, lawyer) for administrative and tax obligations.
The site is designed to make no calls to third-party services: the typographic fonts and the 3D-viewer library are hosted directly on the site's servers (self-hosting), with no communication of data to Google, content delivery networks (CDNs) or other external providers. Data is neither disseminated nor communicated to third parties for purposes other than those indicated.
7Transfers to third countries
Browsing the site involves no transfers of data to third countries: all technical resources (fonts, scripts, 3D model) are served locally, and no data is transmitted to non-EU providers merely by visiting the pages.
A transfer to a third country may occur only at the data subject's own initiative, should they choose to contact the practice via WhatsApp (Meta Platforms, with infrastructure also in the United States). In that case the transfer takes place, where applicable, on the basis of the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) and the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023), pursuant to Articles 44-49 GDPR. Those who prefer to avoid such a transfer may use the phone, email or contact the practice in person.
8Retention period
- Contact data for requests not followed by a service: retained for the time needed to handle the request and in any case no longer than 24 months.
- Clinical data and health records: retained for the periods required by sector legislation on the keeping of health records and, in any event, for the time useful to protect the rights of the controller and the data subject.
- Administrative and tax data: retained for 10 years pursuant to Article 2220 of the Italian Civil Code.
9Rights of the data subject
As a data subject, under Articles 15-22 GDPR, you have the right to obtain access to your data, its rectification, erasure, restriction of processing, portability, as well as to object to processing and to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise these rights you may write to maggiorotti@gmail.com or contact the practice directly. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it) pursuant to Article 77 GDPR.
10Automated decision-making
The controller does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR. Any three-dimensional animations on the site are for illustrative purposes only and do not process personal data.
11Cookies and tracking technologies
The site uses no profiling cookies and no third-party analytics or tracking tools. It uses only a local storage technology (localStorage) to remember the user's preferences — the light/dark theme and whether the initial privacy notice has been seen — functions that are technical in nature and require no consent. For details see the Cookie Policy.
12Changes to this notice
The controller reserves the right to update this notice to reflect regulatory or organisational changes. The current version is always published on this page, with the date of the latest update.