Courtesy translation. In case of any discrepancy, the Italian version of this document prevails.
Cookie Policy
{NOTICE_DRAFT}
This Cookie Policy describes the types of cookies and other tracking tools used on the Fibonacci showcase website and, in a complementary manner, on the Fibonacci application. The policy is drafted pursuant to Article 122 of Legislative Decree No. 196 of 30 June 2003 (Personal Data Protection Code), Regulation (EU) 2016/679 (GDPR), and the Provision of the Garante per la Protezione dei Dati Personali of 10 June 2021 entitled "Guidelines on cookies and other tracking tools."
1. What are cookies and other tracking tools
Cookies are small text files that visited websites send to the user's device (computer, tablet, smartphone), where they are stored and retransmitted to the same websites on the next visit. Alongside HTTP cookies, there are other technically equivalent tracking tools, including browser web storage (local storage, session storage), unique device identifiers, tracking pixels (web beacons), and digital fingerprints (fingerprinting).
For the purposes of this policy, the following distinctions are made:
- Session cookies, which are deleted when the browser is closed, and persistent cookies, which remain stored on the device for a set period;
- First-party cookies, installed directly by the Data Controller of the visited website, and third-party cookies, installed by entities other than the Data Controller;
- Technical cookies, used solely to transmit a communication over an electronic communications network or to the extent strictly necessary for the provider of an information society service explicitly requested by the user; such cookies do not require the data subject's prior consent, pursuant to Article 122 of the Privacy Code;
- Profiling and marketing cookies, aimed at creating user profiles and used to send advertising messages in line with the preferences expressed by the user while browsing the web; such cookies require the data subject's free, specific, informed, granular, and unambiguous consent.
2. Cookies used on the Fibonacci website (showcase site)
The Fibonacci showcase website is a static informational site. Currently, no profiling cookies, marketing cookies, non-anonymized statistical cookies, or third-party tracking tools are used (for example: Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, or similar services are not integrated).
| Cookie name | Type | Purpose | First or third party | Duration | Legal basis | Consent |
|---|
Should anonymous analytical tools be activated in the future (for example, a self-hosted instance of Plausible Analytics or Matomo configured in compliance with the Garante's Guidelines of 10 June 2021), they would remain exempt from the consent requirement, provided the conditions set out in the aforementioned provision are met, particularly IP address masking, disabling cross-site tracking, absence of enrichment with third-party data, and the impossibility of re-identifying individual users. In such case, this policy will be updated with a detailed list of the activated tools.
3. Cookies used on Fibonacci (application)
The Fibonacci application is intended for registered users (healthcare professionals and client facility operators) and uses only technical cookies strictly necessary for providing the service requested by the user. Application cookies are not used for profiling purposes nor shared with third parties for marketing purposes.
| Cookie name | Type | Purpose | First or third party | Duration | Legal basis | Consent |
|---|---|---|---|---|---|---|
| medplum_session | Technical authentication cookie (httpOnly, Secure, SameSite=Strict) | Maintain the user's authenticated session after login, including second-factor verification (MFA) | First party (application domain) | Duration of the work session | Art. 6(1)(b) GDPR (performance of the service contract) and Art. 122 of Legislative Decree 196/2003 | Exempt from consent |
| csrf_token | Technical security cookie | Prevent Cross-Site Request Forgery attacks on authenticated operations | First party (application domain) | Duration of the work session | Art. 6(1)(f) GDPR (legitimate interest in the security of processing pursuant to Art. 32 GDPR) and Art. 122 of Legislative Decree 196/2003 | Exempt from consent |
| fibonacci_lang | Technical preference cookie | Store the interface language selected by the user | First party (application domain) | 365 days | Art. 6(1)(f) GDPR (legitimate interest in providing the interface in the chosen language) and Art. 122 of Legislative Decree 196/2003 | Exempt from consent |
All the cookies listed above are classified as technical cookies pursuant to Article 122 of Legislative Decree 196/2003 and paragraph 3.1 of the Garante's Guidelines of 10 June 2021 and therefore do not require the data subject's prior consent.
4. Profiling, marketing, and non-anonymized statistical cookies
Currently, the Fibonacci showcase website and the Fibonacci application do not use profiling cookies, marketing cookies, or non-anonymized statistical cookies. No tools are present that allow the creation of user behavioral profiles, advertising retargeting, or the sharing of identifiers with third-party platforms.
Should such tools be introduced in the future, the Data Controller will first:
- Display a first-visit banner compliant with the Garante's Provision of 10 June 2021, including a brief notice and a link to the extended information;
- Allow a free, granular, and revocable choice, with at least three equivalent options in terms of graphics, typography, and prominence: "Accept all," "Reject all," and "Manage preferences";
- Avoid using pre-selected checkboxes (no pre-flagging) and not interpret scrolling, closing the banner, or continuing navigation as consent;
- Ensure the user can revoke consent at any time with the same ease as it was given;
- Renew the consent request no later than 6 months after the previous expression of will, or if the processing conditions or third-party recipients change significantly, in accordance with paragraph 7 of the Garante's Guidelines;
- Keep a record of the consent given and its date to demonstrate compliance pursuant to Article 7(1) GDPR;
- Update this Cookie Policy with a detailed list of the activated profiling and marketing cookies, their purposes, third-party recipients, transfer countries, and adopted safeguards.
5. Managing cookie consent and preferences
Below are links to the official guides of the main browsers for managing cookies:
- Google Chrome: https://support.google.com/chrome/answer/95647 (opens in a new tab)
- Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox (opens in a new tab)
- Apple Safari (macOS): https://support.apple.com/en-gb/guide/safari/sfri11471/mac (opens in a new tab)
- Apple Safari (iOS): https://support.apple.com/en-gb/HT201265 (opens in a new tab)
- Microsoft Edge: https://support.microsoft.com/en-gb/help/4027947 (opens in a new tab)
- Opera: https://help.opera.com/en/latest/web-preferences/ (opens in a new tab)
Additionally, users can visit https://www.youronlinechoices.com/ (opens in a new tab) for general information on behavioral advertising and opt-out options, as well as the https://www.aboutads.info/choices/ (opens in a new tab) initiative for the U.S. market.
6. Disabling technical cookies
7. Data subject rights
In relation to the processing of personal data carried out through cookies and other tracking tools, you may exercise at any time the rights recognized by Articles 15 to 22 of Regulation (EU) 2016/679, including the right of access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent (where applicable), as well as the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (https://www.garanteprivacy.it (opens in a new tab)).
For a full explanation of data subject rights, retention periods, and processing methods, please refer to the Privacy Policy available on the website. The exercise of these rights is free of charge and can be done by sending a written communication to info@fibonaccimedica.it, clearly stating the rights you wish to exercise and attaching a copy of a valid ID, where necessary for identification.
8. Data Controller and contacts
The Data Controller is:
Name: ⟨to be specified⟩ Registered office: ⟨to be specified⟩ VAT number: ⟨to be specified⟩ REA number: ⟨to be specified⟩ Privacy communications address: info@fibonaccimedica.it Data protection contact: info@fibonaccimedica.it
You may contact the above addresses for any requests regarding the processing of personal data, the exercise of rights recognized by the GDPR, and cookie management.
9. Updates to this policy
This Cookie Policy may be modified or updated at any time to reflect changes in the cookies used, the Data Controller's organization, applicable regulations, or the guidance of supervisory authorities. In the event of substantial changes (for example: activation of profiling cookies, introduction of third-party tools, change of Data Controller), the Data Controller will provide appropriate notice on the website and, where necessary, request your consent again. You are therefore advised to periodically check this page to verify the current version.
10. Last revision
Last revision date: 7 agosto 2026
Disclaimer: This document is a template adapted to the context of the Fibonacci project and is subject to legal review before commercial go-live. Version 0.1, internal draft.