Courtesy translation. In case of any discrepancy, the Italian version of this document prevails.
Privacy Notice
Unsigned draft, published for consultation purposes. The company providing the service has a VAT number; the REA number will be added once registration with the Companies Register is complete. Until then this document cannot be signed.
This notice describes the methods for processing personal data collected, stored, and processed within the institutional website Fibonacci (https://fibonaccimedica.it (opens in a new tab)), the Fibonacci SaaS application accessible at https://app.fibonaccimedica.it (opens in a new tab), and related services. This document is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter "GDPR") and Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101 (hereinafter "Privacy Code").
Fibonacci is an outpatient clinical record for aesthetic medicine, distributed as Software as a Service to physicians and healthcare professionals. It includes patient registry and records with aesthetic medicine forms, encrypted clinical photos, facial analysis, AI-transcribed dictation, informed consent forms in PDF, scheduling and reminders, access logs, two-factor authentication, and data export in FHIR R4 format.
Preliminary notice: three distinct roles coexist within the service perimeter. For navigation data on the Fibonacci website and for data of physician clients subscribing to the software, Fibonacci acts as Data Controller. For patient data entered by physician clients into the software, Fibonacci acts as Data Processor pursuant to Article 28 GDPR, while the Data Controller is the physician client who has the professional relationship with the patient. The regulation of patient data processing is governed by the Data Processing Agreement (hereinafter "DPA"), signed concurrently with the service contract by the physician client, and is briefly described in Section 3 and Section 8 of this notice.
1. Data Controller
The Data Controller for personal data is:
Name: Fibonacci Works S.r.l. Registered office: Via Brigata Liguria 105 R, 16121 Genova (GE) VAT number: 03108390992 REA number: GE-533577 Certified email: fibonacciworks@pec.it Privacy contact: info@fibonaccimedica.it Data Protection Officer (DPO): to be appointed; until then, write to info@fibonaccimedica.it
For any questions regarding the processing of personal data, including the exercise of rights under Articles 15-22 GDPR, the contact channel is as follows:
Contact channel: info@fibonaccimedica.it
2. Essential Definitions
For the purposes of this notice, the following terms shall mean:
- "Data Controller": the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (Article 4(7) GDPR).
- "Data Processor": the natural or legal person who processes personal data on behalf of the Data Controller (Article 4(8) GDPR).
- "Data Subject": the identified or identifiable natural person to whom the personal data relate (Article 4(1) GDPR).
- "Personal Data": any information relating to an identified or identifiable natural person (Article 4(1) GDPR).
- "Special Categories of Personal Data": data referred to in Article 9 GDPR, including data concerning health, sexual life, racial or ethnic origin, religious or philosophical beliefs.
- "Processing": any operation or set of operations performed on personal data, whether or not by automated means (Article 4(2) GDPR).
- "Sub-processor": a third party appointed by the Processor to carry out specific processing activities on behalf of the Data Controller, pursuant to Article 28(2) and (4) GDPR.
3. Categories of Processed Data
The Data Controller processes different personal data depending on the data subject segment. Below is the distinction.
3.1 Visitors to the Fibonacci Website
For visitors to the institutional website, potential clients filling out contact or demo request forms, and potential partners filling out the partnership proposal form (/partner page), the following data are processed:
- Identification and contact data: first name, last name, email address, phone number, name of the practice, clinic or company, professional qualification, medical specialty or type of partnership proposed;
- Navigation data: IP address, browser type, requested pages, date and time, recorded in the server’s technical logs; the website uses only technical cookies (see the Cookie Policy);
- Free content of messages sent via contact forms;
- Text of questions asked to the website assistant, which responds based solely on published site content.
3.2 Physician Clients Using the Software
For physicians and healthcare professionals subscribing to the Fibonacci software, the following data are processed:
- Identification and professional data: first name, last name, tax code, date and place of birth, address, registration number with the professional Order, specialization, VAT number, billing data;
- Access credentials: email address, password hash, two-factor authentication key, recovery codes stored as hashes, access logs;
- Service usage data: account configuration, preferences, activity logs, audit trail of operations performed on the application;
- Payment data: data necessary for managing the subscription (account holder name, payment method reference) are processed by Stripe Payments Europe Ltd, which handles card data according to its own terms. Fibonacci does not store full card numbers.
3.3 Patients of Physician Clients
Data of patients from client healthcare facilities, entered into the software by the physician client or their authorized collaborators, include identification data, contact details, clinical and medical history data, clinical photographs, reports, prescriptions, informed consent forms, and any other data necessary for providing healthcare services, including data belonging to the special categories referred to in Article 9 GDPR (particularly health data).
For such data, Fibonacci acts as Data Processor pursuant to Article 28 GDPR. The Data Controller is the physician client or healthcare facility using the software. Details on the categories of processed data, documented instructions, authorized sub-processors, and adopted security measures are governed by the Data Processing Agreement (DPA) signed concurrently with the service contract. The DPA is published at /dpa, and the list of sub-processors at /sub-responsabili.
Patients wishing to exercise their rights are invited to contact their treating physician as Data Controller. Fibonacci, as Data Processor, provides the physician Data Controller with the technical assistance necessary to respond to data subjects' requests.
4. Purposes and Legal Basis of Processing
Processing carried out by the Data Controller pursues the purposes indicated below, each based on a specific legal basis.
| Purpose | Data Category | Legal Basis |
|---|---|---|
| Provision of the Fibonacci service to physician clients, account management, delivery of contractual functionalities (clinical records, scheduling, document archiving, AI dictation, audit log) | Identification and professional data of the physician client, access credentials, usage logs | Article 6(1)(b) GDPR (performance of a contract to which the data subject is party) |
| Administrative, accounting, and tax management of relationships with physician clients (billing, debt collection, tax compliance) | Identification data, tax data, payment data | Article 6(1)(c) GDPR (compliance with a legal obligation) |
| IT security, fraud prevention, unauthorized access, service integrity maintenance, security audits | Access logs, IP addresses, device identifiers, technical navigation data | Article 6(1)(f) GDPR (legitimate interest of the Data Controller in protecting the service and users) |
| Responding to requests submitted via contact forms, managing demo requests from potential clients and partnership proposals from potential partners | Contact data, message content | Article 6(1)(b) GDPR (performance of pre-contractual measures at the data subject’s request) |
| Answering questions posed to the website assistant | Question text | Article 6(1)(f) GDPR (legitimate interest of the Data Controller in responding to information requests about the product) |
| Exercise or defense of a right in legal proceedings | All relevant categories for the specific dispute | Article 6(1)(f) GDPR (legitimate interest of the Data Controller) and, where applicable, Article 9(2)(f) GDPR |
| Processing patient data on behalf of the physician client Data Controller (clinical records, consents, photos, dictation, scheduling, documents for the patient) | Patient identification data, health data, clinical photographs, informed consent forms | For the physician Data Controller: Article 6(1)(b) GDPR and Article 9(2)(h) GDPR (purposes of preventive medicine, diagnosis, healthcare provision or treatment). For Fibonacci: Article 28 GDPR as Processor, according to documented instructions in the DPA |
Providing data for contractual, administrative, and security purposes is necessary for service provision. Refusal makes it impossible to provide the service. The Data Controller does not send newsletters or promotional communications and does not transfer addresses to third parties.
5. Processing Methods and Security Measures
Processing is carried out using electronic tools, in compliance with the principles of integrity and confidentiality under Article 5(1)(f) GDPR and by adopting appropriate technical and organizational measures pursuant to Articles 24, 25, and 32 GDPR. Specifically:
- Clinical photos encrypted in the browser with AES-256-GCM, with keys held by the service Data Controller and separated by practice;
- Encrypted nightly backups, retained for 30 days on a rotating basis, with a tested recovery procedure;
- Traffic encrypted with TLS between the browser and the server, without intermediaries;
- Two-factor authentication required for the practice owner at first access and available for each user;
- Access logs to records with a hash chain that makes any alteration visible;
- Data separation by practice, so each physician Data Controller sees only their own patients;
- Infrastructure in Italy, hosted by Aruba S.p.A.;
- Processing activity records pursuant to Article 30 GDPR.
The database is not encrypted at rest at the disk level as of this revision; backup copies with a second provider are planned before the service processes real patient data.
Data are accessible only to authorized Fibonacci personnel trained as designated data processors under Article 29 GDPR and Article 2-quaterdecies of the Privacy Code.
6. Sub-processors and Data Recipients
For processing where it acts as Data Controller (website, website assistant, relationships with physician clients), Fibonacci uses the following providers, who act as its data processors:
| Provider | Location | Activity |
|---|---|---|
| Aruba S.p.A. | Italy | Hosting the website, application, technical logs, and requests received via forms |
| Hostinger International Ltd | Cyprus | Domain email (responses to forms, client communications) and DNS |
| Mistral AI SAS (artificial intelligence models, European endpoint) | France | Responding to questions posed to the website assistant |
| Stripe Payments Europe Ltd | Ireland | Subscriptions and payments from physician clients |
For patient data, which Fibonacci processes as Processor on behalf of the physician, the list of sub-processors, including location, processed data, and contract status for each, is published at /sub-responsabili. Changes are communicated to the physician with 30 days' notice, as provided in the DPA.
Data may also be disclosed to:
- Professional consultants (accountants, lawyers, auditors) appointed as Data Processors or independent Data Controllers, within the scope of their services;
- Judicial, public security, supervisory, or public administration authorities, upon legitimate request and in cases provided by law;
- Third parties in extraordinary operations (mergers, acquisitions, business unit transfers), after informing data subjects.
Data are never disseminated.
7. Data Transfers Outside the European Union
The application infrastructure and databases are hosted in Italy by Aruba S.p.A. Patient health data are not transferred outside the European Union: the software prevents sending clinical texts to artificial intelligence providers outside the EU.
No intermediary is interposed between the browser and the backend. The website and application domains resolve directly to the infrastructure address: no content delivery networks, third-party reverse proxies, or third-party managed Web Application Firewalls are used, and there is no point where a subject other than the Data Controller terminates the encrypted connection. Anyone can verify this externally, without requesting our consent, by querying the domain via DNS.
A transfer to the United States may involve payment data of physician clients processed by the Stripe group, based on Stripe, LLC’s adherence to the EU-U.S. Data Privacy Framework and Stripe’s standard contractual clauses. Documentation is available upon request by writing to info@fibonaccimedica.it.
8. Retention Period
Personal data are retained for the time strictly necessary for the purposes for which they were collected, in compliance with the principle of storage limitation under Article 5(1)(e) GDPR. Specific terms are indicated in the following table.
| Data Category | Retention Period |
|---|---|
| Identification and professional data of the physician client | Duration of the contract and subsequent 10 years from termination, for civil, tax, and accounting compliance purposes (Article 2220 of the Italian Civil Code and Presidential Decree 600/1973) |
| Billing and payment data | 10 years from the issuance of the accounting document, pursuant to tax regulations |
| Access and security logs | Term to be defined; for system administrator access, no less than 6 months (Garante provision of 27 November 2008). Will be indicated here before service launch |
| Navigation data in server technical logs | Term to be defined, indicated here before service launch |
| Questions posed to the website assistant | Term to be defined, indicated here before service launch |
| Technical session cookies | Duration of the navigation session |
| Data collected via demo forms from potential clients and via the partnership proposal form from potential partners | 24 months from the last contact; if no contract is concluded within this period, data are deleted. Early deletion upon data subject’s request |
| Communications with customer service | 24 months from request closure, unless for defensive needs |
| Patient data processed on behalf of the physician client Data Controller | Retained for the period chosen by the physician Data Controller: by default 10 years from the last clinical contact, extendable. Upon expiration, the software prompts the physician to delete data and does not delete anything automatically. Upon contract termination, data are returned to the physician Data Controller or deleted as provided in the DPA |
After the indicated terms, data are deleted or irreversibly anonymized, unless retention is required by law or for jurisdictional protection needs.
9. Data Subject Rights
You may exercise at any time the rights recognized under Articles 15-22 GDPR, specifically:
- Right of access (Article 15 GDPR): obtain confirmation of processing and receive a copy of personal data;
- Right to rectification (Article 16 GDPR): correct inaccurate data or complete incomplete data;
- Right to erasure (Article 17 GDPR): obtain erasure of data no longer necessary, subject to legal limits, including healthcare and tax documentation retention obligations;
- Right to restriction of processing (Article 18 GDPR): in cases provided by law;
- Right to data portability (Article 20 GDPR): receive personal data provided in a structured, commonly used, and machine-readable format, and have them transmitted directly to another controller where technically feasible. For physician clients, an export function in ZIP format with FHIR R4 data is available;
- Right to object (Article 21 GDPR): object at any time to processing based on legitimate interest or direct marketing;
- Right to withdraw consent (Article 7(3) GDPR): withdraw consent at any time, without prejudice to the lawfulness of processing carried out before withdrawal;
- Right not to be subject to automated decisions (Article 22 GDPR): no decision producing legal or significant effects is made solely on an automated basis. AI dictation and assistance functions support the healthcare professional, who retains full decision-making autonomy.
Requests may be addressed to the Data Controller at the following contacts:
- Data Controller email: info@fibonaccimedica.it
- Email: info@fibonaccimedica.it
The Data Controller responds within 30 days of receiving the request. The term may be extended by an additional 60 days in case of particularly complex requests or a high number of requests, with reasons communicated to you. The response is free of charge; the Data Controller reserves the right to request a cost contribution or refuse the request in case of manifestly unfounded or excessive requests, pursuant to Article 12(5) GDPR.
Patients of physician clients must address their requests to the physician Data Controller, who remains their primary contact. Fibonacci, as Data Processor, promptly assists the physician in responding to such requests, in accordance with Article 28(3)(e) GDPR.
10. Data Breach
In case of a personal data breach, the Data Controller assesses the risk to data subjects' rights and freedoms and adopts necessary measures to contain and remedy the breach. Pursuant to Article 33 GDPR, the breach is notified to the Garante for the protection of personal data within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Pursuant to Article 34 GDPR, when the breach is likely to result in a high risk to data subjects' rights and freedoms, the Data Controller communicates the breach directly to data subjects without undue delay, in clear language and providing useful information to protect against possible consequences.
If the breach involves patient data processed on behalf of the physician client Data Controller, Fibonacci, as Data Processor, notifies the breach to the physician Data Controller without undue delay, providing the information necessary to enable compliance with notification obligations under Articles 33 and 34 GDPR, as governed by the DPA.
11. Complaint to the Supervisory Authority
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority, pursuant to Article 77 GDPR. In Italy, the supervisory authority is the Garante for the protection of personal data, with the following contacts:
Garante per la protezione dei dati personali Piazza Venezia 11, 00187 Rome Website: www.garanteprivacy.it (opens in a new tab) Email: protocollo@gpdp.it PEC: protocollo@pec.gpdp.it
The right to bring legal proceedings under Article 79 GDPR and Articles 140-bis and following of the Privacy Code remains unaffected.
12. Cookies
The Fibonacci website uses only technical cookies necessary for its operation; no analytical, profiling, or third-party cookies are present. For details on the types of cookies used, their purposes, and preference management methods, refer to the Cookie Policy available at /cookie.
13. Minors
The Fibonacci service is intended for adult healthcare professionals meeting the professional qualification requirements under Italian law. The institutional website and software subscription area are not directed at individuals under 18. The Data Controller does not knowingly collect data of minors in relation to its relationships with physician clients.
If a patient of the physician client is a minor, data collection and processing occur under the responsibility of the physician Data Controller, who obtains consent from the parent or legal guardian as required by healthcare regulations and Legislative Decree 101/2018. The software allows recording who signs consent on behalf of the minor patient.
14. Changes to the Notice
This notice may be updated at any time to reflect regulatory changes, service developments, or organizational changes by the Data Controller. The current version is always published on Fibonacci/privacy with the date of the last revision.
Substantial changes, defined as changes significantly affecting processing purposes, legal bases, sub-processors, or data subject rights, are notified via email to registered users and highlighted in the reserved area, with adequate notice before the changes take effect.
Using the service after the publication of changes constitutes acknowledgment of the same, without prejudice to the right of withdrawal and data subject rights.
15. Last Revision
Last revision date: 9 novembre 2026 Document version: 0.2 (draft to be reviewed with legal counsel)
Final notice: this document is a template adapted to the Fibonacci service context and will be subject to legal review before commercial activities begin. The version published here is a draft numbered 0.2 and does not replace the advice of a qualified legal consultant. Any comments, corrections, or additions may be sent to info@fibonaccimedica.it.