Personal Data Processing Notice
and Cookie Policy
Website: www.clinicaunica.it — Pursuant to the GDPR (EU) 2016/679, Legislative Decree 196/2003 as amended, and the Italian Data Protection Authority's Guidelines on cookies of 10 June 2021.
PERSONAL DATA PROCESSING NOTICE AND COOKIE POLICY
Website: www.clinicaunica.it
| Legislation | Document / Relevant articles |
|---|---|
| Regulation (EU) 2016/679 – GDPR | Arts. 5, 6, 7, 9, 12, 13, 15-22, 25, 28, 32, 44-49 |
| Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018 | Arts. 2-bis, 2-quinquies, 122, 123 |
| Garante Guidelines – Cookies and tracking tools | Provision no. 231 of 10 June 2021 – Italian Official Gazette no. 163 of 9 July 2021 |
| Garante Guidelines – Tracking pixels in e-mails | Provision no. 284 of 17 April 2026 – Italian Official Gazette no. 98 of 29 April 2026 |
| Garante Compendium – Online healthcare platforms | Garante Privacy, March 2024 |
| EU-US Data Privacy Framework | European Commission adequacy decision, 10 July 2023 |
| Data Act | Reg. (EU) 2023/2854 – in force from 12 September 2025 |
Data Controller
| Name | Unica Medical Center S.r.l. |
| Registered office | Strada Provinciale Sant'Angelo 117/6, 60019 Senigallia (AN), Italy |
| VAT no. | 03030670420 |
| Legal representative | Dr. Niccolò Rossi, Sole Director |
| DPO / Privacy e-mail | dpo@clinicaunica.it |
| Certified e-mail (PEC) | clinicaunica@pec.it |
| Website | www.clinicaunica.it |
Cookie Policy
In accordance with the Guidelines of the Italian Data Protection Authority (Garante) of 10 June 2021 (Provision no. 231) and with Article 122 of Legislative Decree 196/2003, this section fully governs the use of cookies and other tracking tools on the Website.
| Category | Description | Consent | Retention |
|---|---|---|---|
| Technical Necessary | Essential for the operation of the Website: session management, security, load balancing. Disabling them may compromise the usability of the Website. | Not required Art. 122(1), Legislative Decree 196/2003 |
Session or max 12 months |
| Aggregate analytics Anonymous | Collection of Website usage statistics in anonymous and aggregate form, with no possibility of tracing the data back to the individual user. | Not required if data are aggregate and anonymous |
Max 13 months |
| Individual analytics | Audience measurement with data attributable to the individual user or with the possibility of cross-referencing with other identifying datasets. | Opt-in consent | Max 13 months |
| Profiling Third parties | Tracking to create behavioural profiles and to display personalised advertising (e.g. Google Ads, Meta Pixel). Active only upon explicit consent. | Opt-in consent | Max 12 months |
| Social widgets Third parties | Social sharing buttons (Facebook, Instagram, etc.). In the absence of consent they are shown as static images, without activating any tracking. | Opt-in consent | According to the provider's policy |
On first access to the Website, the user is presented with a cookie banner compliant with the Garante Guidelines of 10 July 2021. The banner allows the user to: accept all cookies through an explicit positive action (opt-in); reject all non-technical cookies via the "X" or the "Reject" button, with the same graphic prominence as the acceptance button; customise preferences by individual category; change choices at any time via the "Cookie Settings" link in the footer.
| Service | Provider | Purpose | Privacy Policy |
|---|---|---|---|
| Google Analytics | Google LLC | Browsing statistics (analytics) | policies.google.com/privacy |
| Google Maps | Google LLC | Display of the facility's location map | policies.google.com/privacy |
| Meta Pixel | Meta Platforms | Advertising profiling (only with explicit consent) | facebook.com/privacy/policy |
| Google Fonts / CDN | Google LLC | Font loading (technical, no tracking) | policies.google.com/privacy |
Regardless of the choices made via the banner, the user can manage or delete cookies directly from their browser settings.
| Browser | Settings path |
|---|---|
| Google Chrome | Settings → Privacy and security → Cookies and other site data |
| Mozilla Firefox | Settings → Privacy & Security → Cookies and Site Data |
| Microsoft Edge | Settings → Cookies and site permissions → Cookies and data stored |
| Apple Safari | Preferences → Privacy → Manage Website Data |
| Opera | Settings → Advanced → Privacy & security → Site settings |
Data Processing for the Website's Interactive Services
The Website provides users with three interactive services that involve the collection of personal data. For each of them a specific notice is provided pursuant to Article 13 GDPR.
The Website allows the user to access the online booking function, which redirects to the portal of the facility's management software (a third-party provider appointed as Data Processor pursuant to Article 28 GDPR). No health data is collected at this stage.
| Legal basis | Art. 6(1)(b) GDPR: performance of pre-contractual measures at the data subject's request. Consent is not required. |
| Purpose | Managing the booking; confirming the appointment; service communications (reminders, changes, cancellations). |
| Data processed | Ordinary data: first name, last name, phone number. No health data is collected during online booking. |
| Data Processor | The management software provider, appointed pursuant to Article 28 GDPR under a specific written agreement. |
| Retention | 5 years from the last service, in accordance with the data minimisation principle (Art. 5 GDPR). |
| Obligation to provide data | Providing the data is necessary to proceed with online booking. If refused, booking by phone remains available. |
The Website provides a contact form that allows the user to send requests for general information or to ask to be called back by the facility.
| Legal basis | Art. 6(1)(a) GDPR: the data subject's consent, given by actively ticking the box accepting this notice before sending. |
| Purpose | Replying to the request for information; calling the user back to assist with booking a visit. |
| Consent method | Sending the form is conditional on actively ticking a box (NOT pre-ticked). The send button remains disabled until the box is ticked. |
| Data processed | Ordinary data: first name, last name, phone, e-mail. The user is asked not to enter health data in the free-text field. |
| Recipients | Authorised administrative staff; the e-mail management system provider (Data Processor under Article 28 GDPR). |
| Retention | Maximum 24 months from collection, subject to further legal obligations. |
| Withdrawal of consent | May be exercised at any time by writing to dpo@clinicaunica.it. |
The Website offers the possibility to subscribe to the newsletter to receive informational and/or promotional communications. Consent for commercial communications is separate and distinct from that for the informational newsletter.
| Legal basis | Art. 6(1)(a) GDPR: explicit, free, specific and informed consent of the data subject, pursuant to Article 7 GDPR. |
| Purpose | (a) Informational newsletter: updates on services, new doctors, opening hours, health articles. (b) Commercial communications: offers, promotions, prevention campaigns and events. |
| Consent method | The user must actively and separately tick the boxes for each purpose. The boxes are NOT pre-ticked. The button is disabled in the absence of at least one tick. |
| Tracking pixel | Pursuant to Provision no. 284 of 17 April 2026, where the e-mails contain tracking pixels, the user is informed of this at the time of subscription. Granular withdrawal of consent to tracking is provided, separate from unsubscribing. Compliance deadline: 29 October 2026. |
| Data processed | E-mail address; optionally name and topics of interest. |
| Retention | Until consent is withdrawn and, in any case, a maximum of 24 months from the last interaction. |
| E-mail platform | Sending is carried out via an e-mail marketing platform with which a specific agreement under Article 28 GDPR has been signed. Any transfers to third countries take place in compliance with the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs). |
| Withdrawal and unsubscription | Via: (1) the unsubscribe link present in every e-mail sent; (2) a written request to dpo@clinicaunica.it. |
Recipients of Personal Data
The personal data collected via the Website may be disclosed, only to the extent strictly necessary for the stated purposes, to the following categories of recipients. The data is not transferred, sold or disseminated to unspecified parties, nor to third parties for marketing purposes without the data subject's explicit consent.
| Category | GDPR role | Purpose of the disclosure |
|---|---|---|
| Management / booking software provider | Processor under Art. 28 | Management of online bookings and clinical-administrative data |
| E-mail marketing platform | Processor under Art. 28 | Sending newsletters and commercial communications |
| Hosting / web server provider | Processor under Art. 28 | Retention of browsing data and system logs |
| IT consultants and web agency | Processor under Art. 28 | Technical maintenance and development of the Website |
| Google LLC (Analytics, Maps, Fonts) | Independent controller | Browsing statistics; location map (only with consent for individual analytics) |
| Meta Platforms Inc. (Pixel) | Independent controller | Advertising profiling, only with the user's explicit consent |
| Judicial and administrative authorities | Independent controller | In the cases provided for by law, upon a reasoned request from the competent Authorities |
Transfer of Data to Third Countries
The Website may use third-party services with offices in the United States or in other countries outside the European Economic Area (EEA). In such cases, the transfer of personal data takes place in compliance with Chapter V of the GDPR (Arts. 44-49), subject to one of the following safeguards:
(a) Adequacy decision of the European Commission — in particular, the EU-US Data Privacy Framework adopted on 10 July 2023;
(b) Standard Contractual Clauses (SCCs) adopted by the European Commission by Decision of 4 June 2021;
(c) further appropriate safeguards pursuant to Article 46 GDPR.
Security Measures (Arts. 25 and 32 GDPR)
Unica Medical Center S.r.l. adopts appropriate technical and organisational measures pursuant to Articles 25 and 32 GDPR (privacy by design and by default) to protect users' personal data from unauthorised access, loss, disclosure, alteration or accidental or unlawful destruction. In particular:
The Website uses the HTTPS protocol with an SSL/TLS certificate to encrypt communications between browser and server; the contact and subscription forms are protected by anti-spam systems (CAPTCHA or equivalent); access logs and user data are stored on secure servers with access restricted to authorised staff; third-party providers (Data Processors) are selected also on the basis of the security safeguards they offer and are contractually bound to confidentiality.
Data Subject Rights (Arts. 15-22 GDPR)
Website users may exercise, at any time, the following rights vis-à-vis the Controller by sending a request to dpo@clinicaunica.it or PEC clinicaunica@pec.it. The Controller responds within 30 days of receiving the request, extendable by a further 60 days in cases of particular complexity (Art. 12(3) GDPR).
| Article | Right | Content |
|---|---|---|
| Art. 15 | Access | Obtain confirmation of the processing, a copy of the data, and information on purposes, recipients and retention period. |
| Art. 16 | Rectification | Correct inaccurate data or complete incomplete data concerning the data subject. |
| Art. 17 | Erasure | Obtain the erasure of the data ("right to be forgotten") in the cases provided for by law, subject to statutory retention obligations. |
| Art. 18 | Restriction | Obtain the restriction of processing in specific circumstances, for example where the accuracy of the data is contested. |
| Art. 20 | Portability | Receive one's own data in a structured, machine-readable format, where the processing is based on consent or contract. |
| Art. 21 | Objection | Object to processing based on legitimate interest or for direct marketing purposes, including profiling, at any time and without justification. |
| Art. 7(3) | Withdrawal of consent | Withdraw consent at any time, without prejudice to the lawfulness of processing carried out before withdrawal. |
| Art. 22 | No automated decisions | Not be subject to decisions based solely on automated processing that produce significant legal effects. |
Right to Object to Direct Marketing — Art. 21 GDPR
Links to External Sites and Data of Minors
The Website may contain links to third-party websites (e.g. the regional portal, social platforms, service provider sites). The Controller is not responsible for the content or the privacy practices of such sites. Users are invited to read the privacy notices of third-party sites before providing any personal data.
The Website is not intended for minors under 14 years of age. Pursuant to Article 8 GDPR and Article 2-quinquies of Legislative Decree 196/2003, the processing of the data of minors under 14 years of age for information society services based on consent requires the authorisation of the holder of parental responsibility. The Controller does not knowingly collect the data of minors under 14 years of age via the Website. Should the inadvertent collection of such data be ascertained, it will be immediately deleted.
Right to Lodge a Complaint with the Supervisory Authority
Without prejudice to the right to contact the Controller on any matter relating to the processing of their personal data, the data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), as the competent supervisory authority pursuant to Article 77 GDPR, where they believe that the processing infringes Regulation (EU) 2016/679.
Italian Data Protection Authority (Garante per la protezione dei dati personali)
Piazza Venezia 11, 00187 Rome, Italy · Tel. +39 06.69677.1 · Fax +39 06.69677.785
E-mail: garante@gpdp.it · PEC: protocollo@pec.gpdp.it · Website: www.garanteprivacy.it
Updates to This Notice
This notice may be subject to updates in relation to legislative changes, the evolution of the Website's services or changes in processing practices. The date of the last revision is indicated at the foot of the document and in the Website footer.
For material changes, the Controller will provide notice via a prominent banner on the Website and/or notification by e-mail to newsletter subscribers, with reasonable advance notice before the changes take effect. The always up-to-date version is available on the Website's Privacy page: www.clinicaunica.it/en/privacy.