Privacy Policy
Florence Premium Healthcare Services — last updated 6 October 2026This policy explains how personal data submitted through this website is handled, in accordance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.
This policy covers this website only. If you become a patient, the handling of your clinical data is governed by a separate notice provided to you at the time of your first consultation.
1. Who is responsible for your data
The Data Controller is:
Dr. Andrea Bernardini, MD, PhD
Registered Physician, Medical Board of Bologna (Ordine dei Medici Chirurghi e Odontoiatri di Bologna), reg. no. 17266
VAT / P.IVA 03825971207
Email: info@florencepremiumhealthcare.com
No Data Protection Officer has been appointed, as the processing described here does not meet the thresholds set out in Article 37 GDPR.
2. What data is collected
Data you provide. When you use a contact form on this website, you submit your name, your email address, and, optionally, your telephone number and the content of your message.
Please do not include clinical details, symptoms, diagnoses, medication or any other health information in the contact form. The form is intended only to arrange an initial contact. If you choose to include such information nonetheless, see section 4.
Data collected automatically. Our hosting provider records standard server log data, including your IP address, the pages requested, the date and time of the request, and your browser and operating system. This data is generated by the technical operation of the website and is used for security and reliability purposes.
Cookies. This website does not use profiling, analytics or advertising cookies, and does not embed third-party tracking of any kind. No cookie consent banner is therefore required.
3. Why your data is used, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry and, where applicable, arranging a consultation | Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract |
| Operating, securing and maintaining the website | Article 6(1)(f) GDPR, our legitimate interest in a functioning and secure website |
| Complying with accounting, tax and professional obligations | Article 6(1)(c) GDPR, compliance with a legal obligation |
Providing your name and email address is necessary in order for us to reply to you. Providing a telephone number is optional.
4. Health information
Information concerning health is a special category of personal data under Article 9 GDPR and receives heightened protection.
We ask you not to send health information through this website. If you voluntarily include it in a message, it is processed on the basis of your explicit consent under Article 9(2)(a) GDPR, given by the act of sending it, and solely for the purpose of responding to you. You may withdraw that consent at any time by writing to the address in section 1, and we will delete the message.
Clinical information gathered in the course of an actual consultation is processed under Article 9(2)(h) GDPR for the purposes of preventive medicine, medical diagnosis and the provision of healthcare, and is covered by the separate notice referred to above.
5. Who else has access to your data
Your data is not sold, rented or disclosed for commercial purposes. It is accessible to the following service providers, each appointed as a Data Processor under Article 28 GDPR:
| Provider | Role |
|---|---|
| Vercel Inc. | Website hosting and server logs |
| Resend (Plus Five Five, Inc.) | Transmission of contact form messages by email |
| Google Ireland Limited | Business email (Google Workspace) |
Your data may also be disclosed to professional advisers or public authorities where we are required to do so by law.
6. Transfers outside the European Economic Area
Some of the providers listed above are established in the United States or process data there. Such transfers take place on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework, or, where that does not apply, on the basis of Standard Contractual Clauses adopted by the European Commission under Article 46 GDPR.
7. How long your data is kept
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a professional relationship | 12 months from the last contact |
| Enquiries that lead to a consultation | Governed by the separate clinical notice |
| Server logs | As retained by the hosting provider for security purposes, generally no longer than 12 months |
At the end of these periods the data is deleted, unless a longer period is required by law.
8. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- obtain confirmation as to whether we hold data about you, and obtain a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data erased, where the conditions set out in Article 17 apply;
- obtain restriction of processing;
- receive your data in a structured, commonly used and machine-readable format, and have it transmitted to another controller;
- object at any time to processing carried out on the basis of legitimate interest;
- withdraw any consent you have given, without affecting the lawfulness of processing carried out before withdrawal.
To exercise these rights, write to info@florencepremiumhealthcare.com. We will respond within one month, as provided by Article 12(3) GDPR.
If you consider that your data has been handled unlawfully, you have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma, garanteprivacy.it), or with the supervisory authority of the EU Member State in which you reside.
9. Automated decision-making
No automated decision-making or profiling within the meaning of Article 22 GDPR is carried out on this website.
10. Changes to this policy
This policy may be updated to reflect changes in the way the website operates or in applicable law. The date at the top of this page indicates the version currently in force.