Privacy notice

1. Data controller

JUNIOR S.R.L. — Biofertility
Registered office and authorised Biofertility MAR Centre: Viale Eroi di Rodi 214, 00128 Rome (RM), Italy
Separate private gynaecology practice of Prof. Dr. Claudio Manna: Via Velletri 7, 00198 Rome (RM), Italy
VAT and tax ID: 05470161000
Email: centrimanna2@gmail.com
Certified email (PEC): juniorsrlroma@pec.it
Phone: +39 06 841 5269

2. Personal data we process

• identity, personal and contact details relating to the patient and, in couple pathways, the partner;
• tax, payment and invoicing details;
• booking details, requested services and healthcare or medically assisted reproduction documentation;
• identity documents uploaded for applicable administrative purposes;
• notices, declarations and acknowledgements, including their version, date and technical collection evidence;
• technical and security data, such as IP address, user agent, audit logs and session identifiers;
• WhatsApp number, preferences and delivery status only when the optional service is enabled;
• test results and reports you send us, and the content of messages you exchange with the Centre (email, WhatsApp replies);
• for video consultations, technical data about the virtual room (times, status); audio and video are not recorded.

Health information and the requested healthcare service are special categories of personal data under Article 9 GDPR.

3. Purposes and legal bases

• Booking and delivery of healthcare services: Article 6(1)(b) GDPR and, for health data, Article 9(2)(h) GDPR and applicable healthcare law.
• Healthcare, administrative, accounting and tax obligations: Article 6(1)(c) GDPR.
• Security, abuse prevention and legal claims: security obligations and the Controller’s legitimate interests, where applicable.
• Transactional WhatsApp messages: optional consent under Article 6(1)(a) GDPR, withdrawable at any time without affecting the main service.
• Reporting healthcare expenses to the Italian Health Card System (Sistema Tessera Sanitaria): legal obligation, Article 6(1)(c) GDPR and Legislative Decree 175/2014.
• Video consultations (telemedicine): delivery of the healthcare service, Article 9(2)(h) GDPR; you choose the remote format, and the doctor assesses whether it is clinically suitable.

Mandatory and optional data. The identity, contact and tax details and the documents requested in the forms are needed to book, deliver the service and issue the invoice, which is a legal obligation: without them the booking or the requested service cannot be completed. The WhatsApp number and its consent are optional and refusing them does not affect the service.

Acknowledgement of this notice and of the general healthcare information are collected separately. Any procedure-specific informed consent is obtained by the healthcare professional before that procedure. Processing of health data that is necessary to provide care is not presented as optional consent.

4. System operation and automation

• Google Calendar: to manage schedules, the event title shows the patient’s name, the service and the clinic or online format; the description, visible to whoever opens the event (authorised staff and the patient herself, if added as an attendee), contains contact details and booking notes. The patient’s email may be added as an attendee. Authorised staff may use these events only for operational and healthcare purposes.
• Bank reconciliation: the system may automatically match a bank transaction to a payment request; ambiguous or incomplete cases are referred to staff for review.
• Artificial intelligence: the system includes tools based on Google Cloud Vertex AI, processed in the EU, that can read reports and documents and propose data for staff to verify. These functions are currently not active on clinical data and will be enabled only after a data protection impact assessment. When active: texts are pseudonymised before they are sent, the provider does not use them for training, every proposal is checked by a healthcare professional, and clinical decisions remain with the doctor (Italian Law 132/2025, Article 7). Transcribing the doctor’s voice notes would instead send the original, non-pseudonymised audio: it requires a further specific authorisation and is also disabled. Today AI is used only on blank document templates.
• Reading your identity document: if you photograph your document, the text is read on our own server, without external services, to fill in the form. In the privacy form the image is not kept.
• We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

5. Recipients and service providers

Where necessary and under access controls, data may be processed by authorised staff and by:

• Railway for application hosting;
• Neon for the PostgreSQL database;
• Supabase for private document storage;
• Stripe for card payments or provider-managed bank transfers;
• Fatture in Cloud / TeamSystem for invoicing and connected compliance tasks;
• Enable Banking for authorised access to bank-transaction information;
• Google Workspace and Google Cloud for Calendar, Drive, Sheets, Gmail and technical template functions;
• Resend for transactional email;
• Meta Platforms / WhatsApp Business Platform only after a WhatsApp opt-in;
• Daily (Pluot Inc.) for video consultation rooms;
• the Centre’s accountant, for invoicing and tax obligations;
• the technical maintainer of the platform, acting as processor, including through technical support tools that may involve transfers outside the EEA.

Partner data: in couple pathways the partner’s identity and contact details are often provided by the patient. This notice also applies to the partner, who may contact the Controller directly to check their data and exercise their rights; in MAR pathways the partner completes and confirms their own section through a personal link. The patient does not give optional consents on the partner’s behalf.

Personal data is not sold or used for behavioural advertising.

6. Transfers outside the EEA

Some providers are established or operate infrastructure outside the European Economic Area. Where relevant, transfers must rely on an adequacy decision, the Data Privacy Framework where applicable, Standard Contractual Clauses, or another safeguard under Articles 44 and following GDPR. The Controller reviews contracts, processing regions and subprocessors as part of supplier governance. You may ask the Controller, at the contacts above, which safeguard applies to each provider and for a copy of it.

7. Retention

• Tax and accounting documents: for the statutory period, normally 10 years.
• Medical records and related reports: kept indefinitely, under the rules on healthcare documentation (Ministry of Health circular of 19 December 1986, referred to by the Italian DPA in decision no. 55/2019).
• Traceability data for MAR procedures on gametes and embryos: at least 30 years after clinical use (Legislative Decree 191/2007, Article 8).
• Other copies of healthcare documents (backups, working versions): the Controller is defining specific periods; meanwhile they are not deleted automatically.
• Identity documents and attachments sent to patients: kept with the patient’s records because staff use them for administrative and healthcare management; they are not deleted automatically. The Controller is defining a specific retention period.
• Form links (privacy, couple data, corrections, document upload): they expire (48 hours for the privacy form) and are deleted 7 days after expiry.
• Document download links: they expire after a few days (normally 72 hours) and are deleted 30 days after expiry; links to attachments sent to patients are kept together with the attachments (see above).
• WhatsApp messages: deleted 365 days after they are concluded; opt-out immediately prevents new messages.
• Video consultation technical data: deleted 365 days after the virtual room is deleted, which happens at the end of the visit; no recording exists.
• Audit logs: deleted after 7 years.

8. Security and access controls

• HTTPS/TLS and security headers;
• hashed passwords and mandatory two-step verification for staff and administrators;
• role-based access and staff access limited to assigned patients;
• private storage, short-lived signed URLs and paths that do not expose email addresses;
• application-level encryption for credentials and tokens where required;
• access auditing and minimisation or redaction of application logs;
• rate limiting, CSRF protection and uploaded-file checks.

9. Optional WhatsApp service

WhatsApp is used only after a separate, explicit opt-in. It may be used for confirmations, reminders and document-availability notices through temporary links. During a limited authorised pilot, replies may be forwarded to the doctor's or clinic's email and retained with the relevant technical audit trail. WhatsApp is not an emergency channel. You may opt out using the instructions in the message or by contacting the Controller. Completing a privacy form does not, by itself, enable WhatsApp.

10. Your rights

Where Articles 15–22 GDPR apply, you may request access, rectification, erasure, restriction, portability or object to processing, and you may withdraw optional consent. Erasure requests are recorded and reviewed; clinical or tax data subject to statutory retention is not automatically deleted.

Email centrimanna2@gmail.com or the certified address juniorsrlroma@pec.it. The Controller normally responds within one month, subject to any reasoned extension permitted by the GDPR.

10-bis. Healthcare expenses and the Health Card System

Expenses for healthcare services are reported to the Sistema Tessera Sanitaria as required by law, for the pre-filled tax return. You may object to their use for the pre-filled tax return by telling us when you pay or by writing to the addresses above. In that case the expense is still reported, but without your tax code; the data needed for invoicing and other legal obligations is kept. Your choice does not affect the healthcare service.

11. Cookies

The platform uses only technical cookies required for sessions, security and CSRF protection. It does not use profiling or advertising-tracking cookies; consent is not requested for these strictly necessary cookies.

12. DPO and complaints

For privacy matters, contact the Controller using the details above. If a Data Protection Officer is appointed, their contact details will be published in this section.

You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, using the channels published at garanteprivacy.it.

13. Changes

Material changes will be published with a new version and effective date. Technical evidence of later acknowledgements will refer to the version in force when it was collected.