Security and data
The questions your consultant will ask: before you do
Where is the data physically stored?
Su server di Aruba S.p.A., in Italia, quindi dentro l'Unione europea. Non su cloud statunitensi, e senza repliche fuori dall’Unione: la filiera clinica non lascia il territorio europeo in nessun passaggio. Non devi crederci sulla parola: l’indirizzo del sito è pubblico e un «whois» te lo dice in trenta secondi, anche contro di noi.
Who is the data controller?
You. The patients are yours, the medical record is yours, and you decide how data is processed. We are the data processor and act on your instructions, under a written agreement per Article 28 of the GDPR, which you sign before starting.
How are they encrypted?
Traffic is transmitted over TLS. Disks are encrypted at the volume level. Clinical photos and certain identifiers have additional application-level encryption, with keys remaining server-side and never passing through the browser.
Who within Fibonacci can access a medical record?
Technical staff managing the servers have access to the infrastructure, as with any hosted service. Data access is logged in the same audit trail you see. We don’t review records on our own initiative, and if you ask for assistance on a specific case, we do it with you: it’s recorded.
Are patient data used to train AI models?
No. The providers of the models we use are contractually bound not to train on data from our API calls. The contracts are listed on the sub-processors page.
What about backups?
Encrypted daily backups with periodic restore testing: a backup no one has ever tested restoring isn’t a backup: it’s wishful thinking. The historical log lets you roll the system back to a precise moment, not just the previous night.
What happens to my data if I stop using the service?
Export everything in a standard format readable without us, anytime and without asking permission. When the relationship ends, data is returned to you and then deleted within the terms specified in the contract.
What if you shut down?
Same applies: export is a product feature, not a favor. The format is FHIR, an international healthcare standard, so another provider can read it without reinventing the wheel.
Documents
Share them with your consultant before talking to us
They are public. No form to fill out to read them, because a vendor hiding the contract behind a form is already telling you something.
- Data processing agreementArticle 28 between you, as data controller, and us, as data processors.
- Sub-processorsWho accesses data besides us, and for what purpose.
- Security measuresThe technical sheet under Article 32, in detail.
- Privacy policyHow we handle data from those who visit the site and use the service.
If you find an issue
Security reports
Se individui una vulnerabilità, scrivi a info@fibonaccimedica.it. We respond, we don’t threaten, and we explain what we’ve fixed. We only ask you not to access real patients’ data while investigating.