Courtesy translation. In case of any discrepancy, the Italian version of this document prevails.

Public List of Physicians and Facilities: Privacy Notice

This notice is provided pursuant to Article 14 of Regulation (EU) 2016/679 to natural persons whose data appear in the list of physicians, clinics, and facilities specializing in aesthetic medicine, plastic and aesthetic surgery intended for the patient section of the Fibonacci website. Today the list is not published.

Article 14 applies when data have not been collected from the data subject: this is precisely the case for this list, whose contents are sourced from the public websites of clinics and facilities, not from any communication by the individuals or entities listed.

If you are a physician or facility and do not wish your profile to appear, you may request its removal by writing to info@fibonaccimedica.it, specifying the website address. Removal is permanent: the address will be added to a permanent exclusion list and will no longer be scanned in subsequent updates. No justification is required.

1. Data Controller

When the company that will manage Fibonacci is established, this notice will be updated and communicated again.

2. Data Processed and Source

Only information that the clinic or professional has already published on their own website is processed, specifically:

The following are not processed:

• Personal email addresses identifiable to an individual (e.g., name.surname@), which are automatically discarded;
• The name of the medical director or team members: only whether a facility declares one is recorded, never who it is;
• Reviews, ratings, rankings, or scores;
• Photographs of individuals;
• Prices, price lists, or offers;
• Any data relating to patients.

The sole source of the data is the data subject’s website. No data are sourced from booking portals, commercial directories, maps, business registers, or other third-party collections.

3. Purposes and Legal Basis

The data are processed to make professionals and facilities in the sector publicly accessible, enabling individuals seeking a physician to identify a suitable one and contact them directly.

The legal basis is the legitimate interest (Article 6(1)(f), GDPR) of the Controller and users in having a search tool, as well as that of the data subject in being found: the processed information is what the data subject has published on their website specifically to be located by patients, and its use in a consultation list falls within the reasonable expectations referred to in Recital 47 of the Regulation.

The processing is not for marketing purposes. No commercial, promotional, or solicitation communications are sent using the data from this list.

The data do not concern the health of the data subject: the indication of the specialty practiced relates to their professional activity, not their personal condition, and therefore does not constitute a special category under Article 9 of the Regulation.

4. Forwarding Patient Messages

When a user fills out the contact form on a profile, the message is forwarded once to the email address published by the clinic, along with any contact details the user chose to provide.

• Forwarding is unidirectional: any reply occurs directly between the clinic and the user, outside the Controller’s systems.
• The content of messages is not retained after forwarding.
• The first forwarded message includes a link to this notice, pursuant to Article 14(3)(b) of the Regulation.

Forwarding a message from a user is not a promotional communication and does not imply any contractual relationship between the Controller and the recipient clinic.

5. Recipients

The list is not published. The data are stored and processed by providers that process them on behalf of the Controller:

• GitHub, Inc. (United States), where the website repository containing the profiles is located. The transfer to the United States is based on the adequacy decision (EU) 2023/1795 (EU-U.S. Data Privacy Framework), to which GitHub adheres.
• Hostinger (UAB Hostinger, Lithuania, European Union), which provides the mailbox from which communications are sent.

The data are not disclosed to other third parties and are not sold.

6. Retention Period and Accuracy

Data are retained as long as the profile remains published and are periodically verified by re-scanning the source website. If the website becomes unreachable or the activity appears to have ceased, the profile is removed.

As long as the list is not published, the data are retained for a maximum of 12 months from collection, then deleted if the list has not been published.

Each profile displays the date of the last scan. If any data are inaccurate or outdated, rectification may be requested at the contacts listed in Section 1, and will be promptly addressed.

7. Data Subject Rights

Under Articles 15 to 22 of the Regulation, the data subject has the right to access their data, request rectification, erasure, restriction of processing, and data portability, as well as to object at any time to processing based on legitimate interest (Article 21).

Objection requires no justification and is granted without exception: the profile is removed, and the website address is added to a permanent exclusion list, ensuring it is no longer scanned in subsequent updates.

To exercise these rights, write to info@fibonaccimedica.it. The right to lodge a complaint with the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it (opens in a new tab)) is also recognized.

There are no decisions based solely on automated processing, nor profiling (Article 14(2)(g) of the Regulation).

8. How This Notice Is Provided

Those who have a verified email address for the clinic receive this notice by email. For those who do not have a valid address, the notice is provided publicly on this page, because reaching individuals without an address individually would require a disproportionate effort (Article 14(5)(b) of the Regulation).

Last updated: 5 ottobre 2026