Courtesy translation. In case of any discrepancy, the Italian version of this document prevails.

Data Processing Agreement (DPA)

Version 0.2 (draft to be reviewed with legal counsel) · Last revision: 9 novembre 2026

Unsigned draft, published for consultation purposes. The company providing the service has a VAT number; the REA number will be added once registration with the Companies Register is complete. Until then this document cannot be signed.

This Data Processing Agreement (hereinafter, "DPA" or "Agreement") is entered into pursuant to and for the purposes of Article 28 of Regulation (EU) 2016/679 (hereinafter, "GDPR") and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (hereinafter, "Privacy Code"), and governs the relationship between the Parties with regard to the processing of personal data carried out by the Processor on behalf of the Controller within the scope of the Fibonacci Service.

This DPA constitutes an integral and substantial part of the Fibonacci Service Agreement entered into between the Parties (hereinafter, "Service Agreement") and shall remain in effect for the same duration as the latter.

Art. 1 · Recitals

1.1. The Controller has entered into a Service Agreement with the Processor for the provision of the Fibonacci software, a SaaS application for outpatient clinical records in aesthetic medicine, delivered by the Processor to the Controller in cloud mode, accessible at https://app.fibonaccimedica.it. Data specific to aesthetic medicine are described in Annex D.

1.2. The performance of the Service Agreement involves the processing, by the Processor on behalf of the Controller, of personal data and special categories of data pursuant to Article 9 GDPR, relating to the Controller's patients.

1.3. The Parties acknowledge that this DPA is necessary to regulate their mutual obligations and rights under Article 28 GDPR and to ensure compliance of the processing with the applicable data protection legislation.

1.4. This DPA prevails, for the matters governed herein, over any conflicting provisions contained in the Service Agreement or other agreements between the Parties.

1.5. The duration of this DPA coincides with that of the Service Agreement. Obligations that by their nature are intended to survive the termination of the relationship (confidentiality, data return and deletion obligations, cooperation with the supervisory authority) shall remain effective even after the termination of the Service Agreement.

Art. 2 · Identification of the Parties

2.1. Controller

2.2. Processor

Hereinafter, the Controller and the Processor shall be collectively referred to as the "Parties" and individually as a "Party".

Art. 3 · Definitions

For the purposes of this DPA, terms used with a capital letter shall have the meaning set forth below. For terms not expressly defined herein, the definitions set out in Article 4 GDPR shall apply.

• Controller: the entity identified in Article 2.1, which determines the purposes and means of the processing of patients' personal data, pursuant to Article 4(7) GDPR.
• Processor: Fibonacci, as identified in Article 2.2, which processes personal data on behalf of the Controller pursuant to Article 4(8) GDPR.
• Sub-processor: any other entity appointed by the Processor to carry out specific processing activities on behalf of the Controller, pursuant to Article 28(2) and (4) GDPR.
• Personal data: any information relating to an identified or identifiable natural person (the Data Subject), processed within the scope of the Service, pursuant to Article 4(1) GDPR.
• Special categories of data: personal data referred to in Article 9 GDPR, with particular reference to health data processed within the scope of the Service.
• Processing: any operation or set of operations performed on Personal Data, pursuant to Article 4(2) GDPR.
• Data Subject: the natural person to whom the Personal Data relate. For the purposes of this DPA, Data Subjects are the Controller's patients and, where relevant, their guardians or reference family members.
• Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, pursuant to Article 4(12) GDPR.
• Software: the Fibonacci SaaS application for digital clinical records, delivered by the Processor to the Controller in cloud mode.
• Service: the set of services provided by the Processor to the Controller under the Service Agreement, including the provision of the Software, its maintenance, technical support, and ancillary functionalities.

Art. 4 · Subject matter, nature, purposes and duration of processing

4.1. Subject matter. The Processor processes Personal Data on behalf of the Controller only to the extent strictly necessary for the provision of the Fibonacci Service, as defined in the Service Agreement.

4.2. Nature of processing. The processing is carried out by automated and IT means and includes, by way of example and not limited to: collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, alignment, erasure, and destruction of Personal Data.

4.3. Purposes of processing. The processing is carried out solely for the purpose of providing the Controller with the functionalities of the Fibonacci Service, and in particular:

• a) storage and management of the Controller's patients' digital clinical records;
• b) collection, signing, and archiving of informed consents in PDF format;
• c) transcription of the Controller's dictation and sorting of dictated texts via artificial intelligence services, and assistant on the open record, under the conditions set out in Article 7.6;
• d) encrypted archiving of patients' clinical photographs;
• e) recording of operations performed on the account for audit purposes;
• f) appointment scheduling, reminders to patients who have consented, public practice page and booking, medical history completed by the patient on their phone, sending documents to the patient by email;
• g) ancillary functionalities that the Controller may request to activate: patient area, remote follow-up video call with optional transcription, invoices to patients and income register, payment at booking, access for the Controller's external programs, electronic health record.

4.4. Duration. The processing shall last for the duration of the Service Agreement. Upon termination of the Service Agreement, the provisions of Article 12 of this DPA shall apply.

Art. 5 · Categories of Data Subjects and types of Personal Data

5.1. Categories of Data Subjects. The following are Data Subjects:

• a) the Controller's patients, whose clinical and administrative information is entered into the Software;
• b) legal guardians, those exercising parental responsibility, or reference family members of minor or incapacitated patients, limited to contact and relationship data.

5.2. Types of Personal Data processed. The following categories of Personal Data relating to Data Subjects are processed:

• a) Identification data: first name, last name, tax code, date of birth, gender, place of birth.
• b) Contact data: postal address, email address, telephone number.
• c) Health data (special category under Article 9 GDPR): medical history, allergies, pathologies, medications, physical examination, visit or session notes, treatments performed with product and batch, clinical photographs. Details are provided in Annex D.
• d) Dictation audio and, if the patient chooses, video call audio: audio tracks sent to the sub-processor Mistral AI SAS for transcription, not retained by the Processor; the transcribed text is saved to the record only if the physician saves it.
• e) Informed consents: consent text, signatory's identity, telephone number and signature code outcome, version and hash of the provided information. The Software offers a library of informed consent templates for aesthetic medicine, which the physician adopts as their own before signing.
• f) Audit log: recording of openings and modifications of the Controller's account clinical resources, with hash chain.
• g) Patients' fiscal and payment data, only if the Controller activates invoicing to patients or payment at booking: tax code, service, amount, payment method and date, email for the receipt.

5.3. The Controller warrants that it has obtained all necessary consents from Data Subjects or has another valid legal basis for the processing of Personal Data, including data referred to in Article 9 GDPR, and has provided Data Subjects with the privacy notice pursuant to Articles 13 and 14 GDPR.

Art. 6 · Processor's obligations

In accordance with Article 28(3) GDPR, the Processor undertakes to:

6.1. a) Documented instructions. Process Personal Data only on the basis of documented instructions from the Controller, including in the event of a transfer of Personal Data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject, in which case the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The following constitute documented instructions from the Controller: the Service Agreement, this DPA, Software configurations made by the Controller via the application interface, written communications addressed to the Processor's technical support.

6.2. b) Confidentiality of personnel. Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and are trained on data protection.

6.3. c) Technical and organisational measures. Implement all appropriate technical and organisational measures, pursuant to Article 32 GDPR, as detailed in Article 9 of this DPA, to ensure a level of security appropriate to the risk.

6.4. d) Sub-processors. Engage Sub-processors only with the Controller's prior authorisation, as set out in Article 7 of this DPA, ensuring that the same data protection obligations under this DPA are imposed on Sub-processors by means of a contract or other legal act.

6.5. e) Assistance with Data Subjects' rights. Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the Data Subject's rights under Articles 12-23 GDPR (access, rectification, erasure, restriction, portability, objection). The Software provides the Controller with specific functionalities to extract, rectify, and erase Data Subjects' data.

6.6. f) Assistance with security, data breaches, DPIAs, prior consultation. Assist the Controller in ensuring compliance with the obligations under Articles 32-36 GDPR, taking into account the nature of the processing and the information available to the Processor.

6.7. g) Return or erasure of data. At the Controller's choice, return or erase all Personal Data after the end of the provision of services relating to processing and erase existing copies, unless Union or Member State law requires storage of the data, in accordance with the procedures set out in Article 12 of this DPA.

6.8. h) Audits and information. Make available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR and allow and contribute to audits, including inspections, conducted by the Controller or another auditor appointed by it, in accordance with the procedures set out in Article 11 of this DPA.

6.9. i) Reporting of GDPR-incompatible instructions. Immediately inform the Controller if, in its opinion, an instruction given by the Controller infringes the GDPR, the Privacy Code, or other Union or Member State data protection provisions.

6.10. j) Record of processing activities. Maintain a record of all categories of processing activities carried out on behalf of the Controller, pursuant to Article 30(2) GDPR, and make it available to the Controller and the supervisory authority upon request.

6.11. k) Cooperation with the supervisory authority. Cooperate, upon request, with the supervisory authority in the performance of its tasks.

6.12. l) Appointment of the DPO. Appoint a Data Protection Officer where required under Article 37 GDPR and communicate the relevant contact details to the Controller. The Processor's DPO contact details are set out in Annex C of this DPA. The Processor has decided to appoint an external DPO; until formal appointment, the contact is the one indicated in Annex C.

Art. 7 · Authorised Sub-processors

7.1. The Controller grants the Processor, pursuant to Article 28(2) GDPR, general authorisation to engage the Sub-processors listed in paragraph 7.2 below for the provision of the Service, with the obligation for the Processor to inform the Controller of any changes to the list in accordance with paragraph 7.3.

7.2. List of authorised Sub-processors as of the signing date. The detailed list, including name, registered office, activities, data processed, location, and contract status of each, is set out in Annex B. In summary:

• a) Aruba S.p.A. (Italy): virtual machine hosting the Software, databases, photographs, and backups. Processes all data. No transfers outside the EU.
• b) Mistral AI SAS (Paris, France): provides the artificial intelligence models (transcription, sorting of dictated texts, assistant) through its European endpoint (api.eu.mistral.ai). Receives clinical text without name or tax code and dictation audio. Article 7.6 applies.
• c) Hostinger International Ltd (Cyprus), with its email forwarding provider: domain email and DNS. Receives email addresses, message text, and, when the Controller sends a document to the patient, the attached document.
• d) Stripe (Ireland and United States), only if the Controller activates payment at booking: patient's email, appointment amount and description, on the Controller's Stripe account.

SMS providers (for signature codes and reminders) and off-site backup storage are not active as of this version: they will be added following the procedure in paragraph 7.3 before being used.

7.3. Changes to the list. The Processor shall inform the Controller of any changes to the list of Sub-processors, whether additions or replacements, with at least 30 days' prior notice before the effective date of the change. The notice shall be provided by publishing the updated sheet at the address indicated in Annex B and by email to the Controller's address set out in Article 2.1.

7.4. Right to object. Within the 30-day notice period, the Controller may object in writing and with reasoned justification to the appointment of a new Sub-processor. In such case, the Parties shall cooperate in good faith to identify alternative solutions. In the absence of agreement, either Party may terminate the Service Agreement with 30 days' notice, without penalties for the Controller and with a pro-rata refund of any advance payments for the unused period.

7.5. Contractual obligations towards Sub-processors. The Processor shall impose on each Sub-processor, by written contract and before using them for real patient data, substantially the same data protection obligations as those set out in this DPA (Article 28(4) GDPR). The status of each contract is indicated in Annex B. The Processor shall be liable to the Controller for any failure by Sub-processors to comply with their data protection obligations.

7.6. Artificial intelligence functions and special categories of data. The contract with Mistral AI SAS takes effect on acceptance of its commercial terms, which incorporate its data processing agreement: no separate signature has been requested or issued. At the date of this version Mistral AI SAS has not yet confirmed in writing zero retention of content or the validity of its agreement for the Processor's organisation. Until the Processor has received those confirmations and communicated them to the Controller, the Controller shall not use dictation, sorting of dictated texts, the assistant, or video call transcription for real patients, and the Processor shall disable the assistant for the Controller's account upon request.

Art. 8 · Transfers outside the EU/EEA

8.1. Patients' health data are stored in Italy (Article 7.2(a)) and the Software prevents the sending of clinical texts to any artificial intelligence provider other than the European endpoint of Mistral AI SAS (api.eu.mistral.ai), based in France. Training of models on the data sent is switched off in the settings of the Processor's organisation.

8.2. No network intermediaries are interposed between the Controller's browser and the Software: no content delivery networks, proxies, or third-party firewalls; the encrypted connection terminates on the machine referred to in Article 7.2(a).

8.3. The following may involve transfers to the United States and are therefore listed with their safeguards in Annex B: Stripe, only with payment at booking; browser notification services, which receive a notification without content; the physician's literature search, which sends only the search text to a US public service (the Controller shall not include patient data). The email forwarding provider's server location is under verification and is indicated in Annex B.

8.4. Should the Processor in the future engage other Sub-processors based outside the EU/EEA, the provisions of Article 7 of this DPA shall apply, and the transfer mechanisms provided for in Chapter V of the GDPR shall be adopted.

Art. 9 · Technical and organisational measures (Article 32 GDPR)

The Processor adopts and maintains for the duration of the DPA the following technical and organisational measures, proportionate to the risk of processing special categories of data under Article 9 GDPR.

9.1. Encryption.

• a) Clinical photographs encrypted in the browser with AES-256-GCM before upload; each photograph's key is protected by a practice key held by the signature service, separate from the main application.
• b) Backups encrypted before being written.
• c) Traffic encrypted with TLS.
• d) ⚠️ The database is not encrypted at rest at disk level as of this version: it is protected by machine access controls and practice-level separation.

9.2. Access control.

• a) Mandatory authentication for all Software users.
• b) Two-factor authentication (TOTP) required for the practice owner at first login and available for all users.
• c) Data separation by practice: one Controller has no visibility over another Controller's patients.
• d) Roles and permissions within the Controller's practice.

9.3. Integrity.

• a) Record of openings and modifications of clinical resources, with a hash chain that makes any alteration visible.
• b) Audit log retention period: to be defined, to be set before signing.
• c) The Controller accesses the log via the application.

9.4. Availability.

• a) Nightly backup of databases and files.
• b) Backup retention for 30 days on rotation.
• c) Tested restore procedure.
• d) ⚠️ As of this version, backups reside on the same machine; off-site backup with a different provider is planned before the first real data and will be indicated in Annex B.

9.5. Secure development.

• a) Code and dependency analysis with each change, before release.
• b) Periodic security assessments of the Software and remediation of findings.

9.6. Minimisation towards AI providers. The text sent is stripped of the patient's name and tax code; the assistant receives an opaque identifier; audio is not retained by the Processor.

9.7. Confidentiality. Persons authorised by the Processor are bound by confidentiality and instructed on the processing of health data; system administrators are appointed in writing.

9.8. Business continuity. Recovery objectives (RTO and RPO) are indicated in Annex A and become contractual commitments only after off-site backup activation.

9.9. The detailed technical description of security measures is available and constantly updated at the address indicated in Annex A.

Art. 10 · Personal data breach

10.1. Processor's notification obligation to the Controller. The Processor shall notify the Controller of any Personal Data Breach of which it becomes aware, within 24 hours of discovery, by written communication to the Controller's email address set out in Article 2.1, containing:

• a) a description of the nature of the breach, including, where possible, the categories and approximate number of Data Subjects concerned, and the categories and approximate number of personal data records affected;
• b) the name and contact details of the DPO or another contact point for obtaining further information;
• c) a description of the likely consequences of the breach;
• d) a description of the measures taken or proposed to be taken to address the breach and mitigate its possible adverse effects.

10.2. Updates. If it is not possible to provide all the information referred to in paragraph 10.1 at the same time, the Processor shall send the Controller initial partial information and subsequently provide timely updates as soon as the information becomes available.

10.3. Controller's residual obligations. The obligation to notify the competent supervisory authority of the breach within 72 hours pursuant to Article 33 GDPR and to communicate it to Data Subjects pursuant to Article 34 GDPR, where applicable, remains with the Controller.

10.4. Cooperation. The Processor shall actively cooperate with the Controller in managing the breach, providing the information and technical and organisational assistance necessary to comply with the obligations set out in the preceding paragraphs.

Art. 11 · Audits and inspections

11.1. The Controller has the right to request from the Processor information useful to demonstrate compliance with the obligations under Article 28 GDPR and this DPA, as well as to conduct compliance audits.

11.2. Audits may be conducted no more than once per year, except in cases of justified urgency (e.g., serious Personal Data Breach or order from the supervisory authority), with at least 30 days' written notice.

11.3. The audit may be carried out directly by the Controller or by an independent third-party auditor, accepted by both Parties and bound by confidentiality obligations equivalent to those of this DPA.

11.4. The Processor may fulfil its audit obligation by presenting a valid security certification accepted by the Controller (e.g., ISO/IEC 27001, SOC 2 Type II, or equivalent), together with a summary compliance report.

11.5. The costs of the audit shall be borne by the Controller, unless the audit reveals significant breaches of this DPA or the GDPR by the Processor, in which case the costs shall remain with the Processor.

11.6. The audit shall not involve access to other clients' data, trade secrets, proprietary source code, or information whose disclosure would compromise the security of the Service for other clients.

Art. 12 · Termination of processing

12.1. Data return. Upon termination of the Service Agreement, at the Controller's written request to be made within 30 days from the termination date, the Processor shall return to the Controller all Personal Data processed on its behalf in a ZIP file structured according to the FHIR R4 standard.

12.2. Erasure of production data. Thirty days after the termination of the Service Agreement, or, if the Controller has not requested the return of the data, 90 days after termination, the Processor shall erase all the Controller's clinical data from production systems.

12.3. Erasure of backups. Backups containing the Controller's Personal Data shall be erased within an additional 30 days from the date of erasure from production systems, in accordance with the natural backup retention cycle (30 days).

12.4. Exceptions. Only copies retained for legal obligations are excluded from the erasure obligation. Such copies shall remain protected by the security measures set out in Article 9 and shall not be subject to any further processing beyond compliance with the legal obligation.

12.5. Certification. Upon completion of the erasure operations, the Processor shall provide the Controller, upon request, with written certification of the activities performed.

Art. 13 · Liability

13.1. Each Party shall be liable for damages caused to third parties within the limits provided for in Article 82 GDPR and according to its own sphere of responsibility. The Controller shall be liable for the lawfulness of the processing and the correctness of the instructions given to the Processor; the Processor shall be liable for compliance with the obligations specifically imposed on it by this DPA, Article 28 GDPR, and Article 32 GDPR.

13.2. In the internal relationship between the Parties, any recourse for damages caused to Data Subjects or fines imposed by the supervisory authority shall be governed by the principle of proportionate liability, based on each Party's causal contribution to the damaging event.

13.3. The Processor's overall liability to the Controller for breaches of the obligations under this DPA shall be governed, to the extent not provided for by mandatory law, by the liability limitation provisions contained in the Service Agreement.

13.4. The provisions of this Article shall not limit in any way the rights of Data Subjects under the GDPR.

Art. 14 · Applicable law and jurisdiction

14.1. This DPA shall be governed by Italian law.

14.2. For any dispute between the Parties concerning the interpretation, performance, or termination of this DPA, the jurisdiction shall be that indicated in the Service Agreement.

Art. 15 · Annexes

The following Annexes, always updated to the latest version published by the Processor, form an integral part of this DPA:

• Annex A · Technical description of processing and security measures: detailed technical sheet published at https://fibonaccimedica.it/sicurezza.
• Annex B · Sub-processors sheet: always updated list of authorised Sub-processors, published at https://fibonaccimedica.it/sub-responsabili.
• Annex C · Operational contacts: data protection contact for the Processor: info@fibonaccimedica.it.
• Annex D · Data specific to aesthetic medicine: reproduced below.

Annex D · Data specific to aesthetic medicine

Art. 16 · Execution

This Data Processing Agreement is executed by the Parties as follows. Execution may be carried out by handwritten signature on paper or by advanced or qualified electronic signature, with full equivalent legal effect.

For the Controller

For the Processor

Art. 17 · Last revision

Last revision of this document: 9 novembre 2026.