Courtesy translation. In case of any discrepancy, the Italian version of this document prevails.

Sub-processors

Version 2.1 · Last updated: 9 novembre 2026

Unsigned draft, published for consultation purposes. The company providing the service has a VAT number; the REA number will be added once registration with the Companies Register is complete. Until then this document cannot be signed.

This document constitutes Annex B of the Data Processing Agreement (DPA) pursuant to Article 28 of Regulation (EU) 2016/679 (hereinafter, "GDPR") entered into between the Controller (client physician) and Fibonacci as Processor for the provision of the Fibonacci SaaS software. It lists by name the sub-processors authorised under Articles 28.2 and 28.4 GDPR and is subject to continuous updates.

1. Introduction and regulatory framework

1.1. Definition of sub-processor. A sub-processor (hereinafter, "Sub-processor") is defined as a third-party entity, whether a natural or legal person, engaged by the Processor to carry out specific processing activities on behalf of the Controller, in accordance with Article 28, paragraphs 2 and 4, of the GDPR.

1.2. General authorisation under Article 28.2 GDPR. By signing the DPA, the Controller grants the Processor general written authorisation to engage the Sub-processors listed in this Annex B, acknowledging that each has been selected by the Processor based on an assessment of reliability and the adequacy of the technical and organisational safeguards offered for data security, in compliance with Article 28, paragraph 1, GDPR.

1.3. Contractual chain. The Processor enters into a written contract with each Sub-processor, imposing the same data protection obligations as those set out in the DPA between the Controller and the Processor, particularly regarding confidentiality, security measures, assistance to the Controller in exercising data subjects' rights, and cooperation with the supervisory authority. The Processor is liable to the Controller for any failure by Sub-processors to comply with data protection obligations, pursuant to Article 28, paragraph 4, GDPR.

1.4. Information obligation and right to object. Any changes to the list of Sub-processors, including the addition of a new Sub-processor, the replacement of an existing Sub-processor, or the termination of a sub-processing relationship, will be communicated by the Processor to the Controller with at least 30 (thirty) days' prior notice before the effective date of the change, via email to the Controller’s address as recorded in the Service Agreement and by updating this page published at https://fibonaccimedica.it/sub-responsabili.

1.5. Exercise of the right to object. Within the 30-day period referred to in point 1.4, the Controller may object in writing to the proposed change, stating the reasons for the objection. The procedure applicable in the event of an objection is set out in paragraph 3 of this Annex.

1.6. Transparency. This list is made public to allow the Controller to verify, prior to signing the Service Agreement and throughout the duration of the relationship, the identity and location of the entities involved in the processing chain.

2. List of authorised sub-processors

The sub-processors as of the last update of this document are as follows. The contract status for each is also indicated: as of this version, no agreement has yet been signed by the company providing the Service, and the Service does not process real patients' data.

2.1. Aruba S.p.A.

• Legal name: Aruba S.p.A.
• Registered office: Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy
• Service category: virtual machine hosting the Software: database, encrypted clinical photos, backups
• Type of data processed: all Service data, including special categories under Article 9 GDPR
• Encryption: clinical photos are encrypted in the browser (AES-256-GCM) with keys managed by the Processor; backups are encrypted before being written. ⚠️ The database is not encrypted at rest at disk level as of this version
• Processing location: provider’s infrastructure on the Italian network. The IP block hosting the Service is registered in the RIPE database as ARUBA-NET, Aruba S.p.A., country IT: verification is possible for anyone via a whois query on the Service’s public IP address
• Non-EU transfers: none
• Guarantees declared by the provider: ISO/IEC 27001 certification and adherence to the CISPE Data Protection Code of Conduct, a code of conduct under Article 40 GDPR. Registration can be verified in the CISPE public register
• Provider’s privacy policy: https://www.aruba.it/documents/tc-files/it/11_it_privacy_policy_aruba_spa.aspx (opens in a new tab)
• CISPE public register: https://cispe.cloud/publicregister/ (opens in a new tab)
• Contract status: ⚠️ Article 28 agreement with the provider to be accepted using the company’s account

2.2. Mistral AI SAS

• Legal name: Mistral AI SAS (Paris RCS 952 418 325)
• Registered office: 15 rue des Halles, Paris, France
• Service category: AI models used by Fibonacci: transcription of dictation and, if the patient chooses, of video calls; sorting of dictated texts; assistant on the open record
• Type of data processed: clinical text without the patient’s name or tax code; audio recordings of dictation; model responses. They may contain special categories of data under Article 9 GDPR
• Models in use: Mistral Small for text and Voxtral Mini Transcribe for transcription, through the European endpoint api.eu.mistral.ai; the Software rejects any other address
• Processing location: European Union (France). Mistral’s sub-processors are published by the provider at trust.mistral.ai, with 10 days to object
• Retention and training: training on data sent through the API is switched off in the Processor’s organisation. Retention of content for abuse monitoring is excluded by the zero-retention option, which the provider reserves for paid plans: at the date of this version it is not active
• Provider’s agreement: https://legal.mistral.ai/terms/data-processing-addendum (opens in a new tab) (in force since 27 July 2026), incorporated by reference into the commercial terms
• Contract status: ⚠️ Mistral’s terms and its data processing agreement take effect on acceptance at sign-up; there is no separate signed agreement, and at the date of this version the provider has not confirmed in writing zero retention or the validity of the agreement for the Processor’s organisation. Until those confirmations, the AI functions are not used for real patients (DPA, Article 7.6)

2.3. Hostinger International Ltd

• Legal name: Hostinger International Ltd
• Registered office: 61 Lordou Vironos str., 6023 Larnaca, Cyprus
• Service category: domain email via authenticated SMTP server (invitations, first access, reminders, notices, document delivery to the patient) and authoritative DNS for the Service’s domain
• Type of data processed: recipient’s email address and name, message text, sending logs, and, when the Controller sends a document to the patient (consent form, privacy notice, visit sheet), the attached document, which contains health data
• Upstream forwarding: Hostinger’s outgoing mail passes through a forwarding provider chosen by Hostinger (MailChannels, identified in message headers). The location and guarantees of this step are under verification
• Processing location: provider established in the European Union (Cyprus); the location of mail servers is under verification
• Provider’s privacy policy: https://www.hostinger.com/legal/privacy-policy (opens in a new tab)
• Provider’s agreement: https://www.hostinger.com/legal/dpa (opens in a new tab)
• Contract status: ⚠️ provider’s agreement to be read and accepted using the company’s account

2.4. Stripe

• Legal name: Stripe Payments Europe Limited (Ireland), with Stripe, Inc. (United States)
• Registered office: 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland
• Service category: for the Controller, the Service subscription (physician’s data, not patients’). Only if the Controller enables payment at booking, collection from the patient to the Controller’s Stripe account
• Type of data processed: for the subscription, the Controller’s personal and payment data. For payment at booking, the patient’s email, amount, and appointment description
• Processing location: Ireland and United States
• Legal basis for transfer: Stripe, LLC adheres to the EU-U.S. Data Privacy Framework (verified on the official list on 6 August 2026); standard contractual clauses in Stripe’s agreement
• Provider’s privacy policy: https://stripe.com/it/privacy (opens in a new tab)
• Provider’s agreement: https://stripe.com/it/legal/dpa (opens in a new tab)
• Status: payments not active as of this version

2.5. Planned sub-processors not yet active

Before being used, they will be added to this list following the procedure in paragraph 3:

• an off-site backup archive, with a provider other than Aruba based in the European Union;
• an SMS provider for consent signature codes and reminders.

2-bis. Entities that are not sub-processors

No content delivery network (CDN), no third-party reverse proxy, no third-party managed Web Application Firewall. The Service’s domain resolves directly to the infrastructure address referred to in point 2.1, verifiable via a DNS query.

They receive data from the Software but not patient data, and are therefore not sub-processors:

• browser notification services (Google, Mozilla, Apple): receive a notification without content;
• timestamping (FreeTSA): receives only the document’s hash, not the document;
• bibliographic search (PubMed by the National Library of Medicine, United States; Europe PMC): receives the search text written by the physician, which must not contain patient data.

They are chosen by the Controller, not the Processor: external programs that the Controller connects with their own key and WhatsApp, if the physician chooses to send the video call link from their own device.

Implications for Chapter V of the GDPR: the processing chain for clinical data does not include providers based outside the European Union. The exception is payment at booking (point 2.4), only if the Controller enables it.

3. Procedure for modifying the list and right to object

3.1. Prior notification. Any changes to this list (addition of a new Sub-processor, replacement of an existing Sub-processor, termination of a sub-processing relationship) will be notified by the Processor to the Controller with at least 30 (thirty) days' prior notice before the effective date of the change. The notification will be sent via email to the Controller’s contact address as recorded in the Service Agreement, and this page will be updated simultaneously.

3.2. Content of the notification. The notification will specify: the name and registered office of the Sub-processor concerned, the service category assigned, the type of data processed, the processing location, the legal basis for transfer where applicable, the safeguards adopted, and the effective date.

3.3. Right to object. Within 30 days of receiving the notification, the Controller may object in writing to the proposed change, stating the reasons for the objection. The objection should be sent to info@fibonaccimedica.it, or by certified email or registered mail with return receipt to the Processor’s registered office.

3.4. Handling the objection. Upon receiving the objection, the Processor will in good faith assess alternative solutions to meet the technical or organisational need underlying the change, without prejudice to the Processor’s right to adopt the technical solution deemed most appropriate for the continuation of the Service.

3.5. Failure to reach agreement. If no agreement is reached between the Parties within a reasonable time following the objection, either Party may terminate the Service Agreement with written notice, without prejudice to the contractual provisions on data return and deletion at the end of the relationship.

3.6. Urgent changes for security reasons. If the change is urgently required for security reasons, service continuity, or to comply with a legal obligation, the Processor may proceed with shorter notice, promptly communicating the reasons to the Controller. In such cases, the Controller’s right to object and the provisions of points 3.3, 3.4, and 3.5 will still apply, albeit ex post.

3.7. No objection. Failure by the Controller to object within the 30-day period will be deemed as acceptance of the change.

4. Version history

5. Contacts

For any requests for clarification, exercise of the right to object, or requests for additional documentation regarding authorised sub-processors, the Controller may contact the following:

• Data protection contact: info@fibonaccimedica.it
• Privacy office: info@fibonaccimedica.it
• Processor: Fibonacci Works S.r.l. · registered office: Via Brigata Liguria 105 R, 16121 Genova (GE)

This document is updated as of the date indicated at the top and is subject to continuous review. The Controller may request written confirmation of the current version of this list at any time by writing to info@fibonaccimedica.it. In the event of any discrepancy between the printed copy and the version published at https://fibonaccimedica.it/sub-responsabili, the online version shall prevail.