Patient privacy notice

Who processes your data

The data controller is Dott. Anthony Paganin, osteopath and exercise scientist, Italian VAT number (P.IVA) 05174310234.

You can write to me at anthony.paganin@me.com or by certified email (PEC) at paganinanthony@pec.it, or call me on +39 347 398 9889.

What data I collect

Health data is a special category (art. 9 GDPR): I only process it to treat you, under professional secrecy. I collect only what I need:

• personal and contact details: name, surname, date of birth, tax code, phone, email;
• health data: why you come to see me, your medical history, the tests and reports you bring, the assessments and treatments in each session;
• the details needed for invoices.

Why I process it and on what basis

Without this data I can't treat you, so it isn't optional; I don't use it for advertising and I don't sell it. I use it for three reasons, each with its own legal basis:

• to assess and treat you: this is healthcare, art. 9(2)(h) GDPR, under professional secrecy;
• to manage our relationship, including appointments: art. 6(1)(b) (performance of a contract);
• for tax and legal obligations, such as invoices: art. 6(1)(c).

Who sees your data

Your data stays with me, and I don't share health data with anyone without your consent unless the law requires it. It can be seen, only as far as needed, by:

• the practices where I work (Gymnasium Villafranca, Gymnasium Sona, Gymnasium Affi, Fisioterapia Dossobuono, Studio FisicaMente), for organising appointments;
• my accountant, for bookkeeping and invoices;
• the providers of the services I use for work, such as email, who process data on my behalf.

How long I keep it

I keep data only as long as necessary:

• clinical records: 10 years after the last session;
• tax documents: as long as the law requires, usually 10 years;
• contact details used only for appointments: while we keep seeing each other, then I delete them, unless you want to stay in touch.

Your rights

At any time you can ask me to:

• see your data and get a copy;
• correct anything wrong or incomplete;
• delete it, within the limits of legal retention obligations;
• restrict its use or object to it, where the law allows;
• receive it in a readable format, to take it to another professional.

How to exercise them

Just write to me or ask me at the practice: I'll reply within one month.

If you think I'm handling your data improperly, you can contact the Italian data protection authority, the Garante per la protezione dei dati personali.