Courtesy translation. In case of any discrepancy, the Italian version of this document prevails.

Public List of Physicians and Facilities – Privacy Notice

{DRAFT_NOTICE}

This notice is provided pursuant to Article 14 of Regulation (EU) 2016/679 to natural persons whose data appear in the public list of physicians, clinics, and facilities specializing in aesthetic medicine, plastic and aesthetic surgery published in the patient-dedicated section of the Fibonacci website.

Article 14 applies when data have not been collected from the data subject: this is precisely the case for this list, whose contents are sourced from the public websites of clinics and facilities, not from any communication by the individuals or entities listed.

If you are a physician or facility and do not wish your profile to appear, you may request its removal by writing to info@fibonaccimedica.it, specifying the website address. Removal is permanent: the address will be added to a permanent exclusion list and will no longer be scanned in subsequent updates. No justification is required.

1. Data Controller

2. Data Processed and Source

Only information that the clinic or professional has already published on their own website is processed, specifically:

The following are not processed:

• Personal email addresses identifiable to an individual (e.g., name.surname@), which are automatically discarded;
• The name of the medical director or team members: only whether a facility declares one is recorded, never who it is;
• Reviews, ratings, rankings, or scores;
• Photographs of individuals;
• Prices, price lists, or offers;
• Any data relating to patients.

The sole source of the data is the data subject’s website. No data are sourced from booking portals, commercial directories, maps, business registers, or other third-party collections.

3. Purposes and Legal Basis

The data are processed to make professionals and facilities in the sector publicly accessible, enabling individuals seeking a physician to identify a suitable one and contact them directly.

The legal basis is the legitimate interest (Article 6(1)(f), GDPR) of the Controller and users in having a search tool, as well as that of the data subject in being found: the processed information is what the data subject has published on their website specifically to be located by patients, and its use in a consultation list falls within the reasonable expectations referred to in Recital 47 of the Regulation.

The processing is not for marketing purposes. No commercial, promotional, or solicitation communications are sent using the data from this list.

The data do not concern the health of the data subject: the indication of the specialty practiced relates to their professional activity, not their personal condition, and therefore does not constitute a special category under Article 9 of the Regulation.

4. Forwarding Patient Messages

When a user fills out the contact form on a profile, the message is forwarded once to the email address published by the clinic, along with any contact details the user chose to provide.

• Forwarding is unidirectional: any reply occurs directly between the clinic and the user, outside the Controller’s systems.
• The content of messages is not retained after forwarding.
• The first forwarded message includes a link to this notice, pursuant to Article 14(3)(b) of the Regulation.

Forwarding a message from a user is not a promotional communication and does not imply any contractual relationship between the Controller and the recipient clinic.

5. Recipients

The data in the list are public and accessible to anyone visiting the website, as well as indexable by search engines. They are not disclosed to third parties for purposes other than consultation, nor are they sold, transferred, or used to create commercial contact lists.

6. Retention Period and Accuracy

Data are retained as long as the profile remains published and are periodically verified by re-scanning the source website. If the website becomes unreachable or the activity appears to have ceased, the profile is removed.

Each profile displays the date of the last scan. If any data are inaccurate or outdated, rectification may be requested at the contacts listed in Section 1, and will be promptly addressed.

7. Data Subject Rights

Under Articles 15–22 of the Regulation, the data subject has the right to access their data, request rectification, erasure, restriction of processing, and data portability, as well as to object at any time to processing based on legitimate interest (Article 21).

Objection requires no justification and is granted without exception: the profile is removed, and the website address is added to a permanent exclusion list, ensuring it is no longer scanned in subsequent updates.

To exercise these rights, write to info@fibonaccimedica.it. The right to lodge a complaint with the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it (opens in a new tab)) is also recognized.

8. Why This Notice Is Published and Not Sent Individually

The Regulation allows the notice to be provided by publication when individual communication to each data subject would require a disproportionate effort, considering, among other factors, the number of data subjects (Article 14(5)(b) and Recital 62).

Sending an individual communication to each subject in the list would not only be disproportionate but also indistinguishable from unsolicited mass communication, causing greater disturbance to the data subjects than the informational benefit.

The Controller therefore adopts the appropriate measure provided by the law: the permanent publication of this notice, referenced in every profile and directly delivered to the recipient upon the first message forwarded, if any.

Last updated: 13 agosto 2026