Security and data
Your consultant’s questions, answered
The rules that apply to us, and where we stand
- Art. 28 GDPRYou are the data controller. Public processing agreement, no form to fill out.
- Data in ItalyItalian infrastructure, no intermediaries, no transfers outside the EU.
- Security measuresFull technical sheet published.
- Encrypted photosEvery clinical photo is encrypted in the browser before it is sent.
- Two-step sign-inPassword plus an authenticator app on your phone.
- European code of conductOur hosting provider follows a code of conduct approved under Article 40 GDPR.
- Art. 50 · transparencyWe tell you when you’re talking to an AI. Machine-readable marking isn’t available yet.In progress
- CE marking from 2029Today, no one can apply it. We already meet three out of four requirements.In progress
These are the names of the rules, not marks issued by any body.
Where is the data physically stored?
On servers run by Aruba S.p.A., in Italy, so inside the European Union. Not on US clouds, and with no replicas outside the Union: the clinical data chain never leaves European territory. You can check it with a ‘whois’ query on the site’s address.
Who is the data controller?
You. The patients are yours, the medical record is yours, and you decide how data is processed. We are the data processor and act on your instructions, under a written agreement per Article 28 of the GDPR, which you sign before starting.
How are they encrypted?
Traffic travels over TLS. Clinical photos are encrypted in the browser before upload, and the key that protects each photo stays on the server; backups are encrypted before they are written. The database, on the other hand, is not yet encrypted at rest, neither at disk level nor field by field: it is protected by access control on the machine and by separation between practices.
Who within Fibonacci can access a medical record?
Technical staff managing the servers have access to the infrastructure, as with any hosted service. Data access is logged in the same audit trail you see. We don’t review records on our own initiative, and if you ask for assistance on a specific case, we do it with you: it’s recorded.
Are patient data used to train AI models?
No. The providers of the models we use are contractually bound not to train on data from our API calls. The contracts are listed on the sub-processors page.
What about backups?
Encrypted daily backups, with periodic restore testing. The historical log lets you roll the system back to a precise moment, not just the previous night.
What happens to my data if I stop using the service?
Export everything in a standard format readable without us, anytime and without asking permission. When the relationship ends, data is returned to you and then deleted within the terms specified in the contract.
What if you shut down?
The same applies: export is a product feature. The format is FHIR, an international healthcare standard, so another provider can read it without reinventing the wheel.
Documents
Share them with your consultant before talking to us
They are public, with no form to fill out.
- Data processing agreementArticle 28 between you, as data controller, and us, as data processors.
- Sub-processorsWho accesses data besides us, and for what purpose.
- Security measuresThe technical sheet under Article 32, in detail.
- Privacy policyHow we handle data from those who visit the site and use the service.
If you find an issue
Security reports
Se individui una vulnerabilità, scrivi a info@fibonaccimedica.it. We reply and tell you what we fixed. We only ask you not to access real patients’ data while you investigate.