Privacy policy
Last updated:
Data controller
Dr Laura Monacò, Via Marco Greppi 10, 20137 Milan, Italy. VAT no. 08745150964. Email: dott.lauramonaco@gmail.com. No data protection officer has been appointed, as none is required.
Data we process
Browsing data: the systems hosting the website automatically record some technical data, such as IP address, browser type, requested page, date and time. It is used only to run the website and protect it from abuse.
Usage statistics: we measure how the website is used (pages visited, language, clicks on the contact and booking buttons, sections read, page load times, where people click and how far they scroll, without the text or what you type) with Umami, in cookieless mode: nothing is stored on your device. To count visits, Umami computes a code that changes every month from your IP address and browser type, and derives your country and approximate city from the IP address; the IP address is not stored and the code cannot recognise you in later months. We do not link these statistics to your name or to any other data you give us. If your browser sends the Do Not Track signal, Umami records nothing.
Technical errors: when a page fails, we record the error type, the page without parameters, the browser and the operating system, so we can fix it. We do not record your IP address, cookies or text typed into the pages.
Restricted area: the website’s management pages are open only to the controller. To protect them from abuse we record the IP address and email of whoever tries to sign in and the number of attempts.
Data you give us: if you call or write to the email address, we process the data you choose to share in order to reply and, if you ask, to arrange a first session. Please do not send health information by email: we will talk about it in person. If you include it anyway, we process it only to reply, under professional secrecy. The website has no contact forms. Giving this data is optional, but without it we cannot reply.
Booking takes place on an external platform, which processes data as an independent controller under its own privacy policy.
Purposes and legal basis
Running and securing the website, including protecting the restricted area: the controller’s legitimate interest (Art. 6(1)(f) GDPR).
Statistics to understand which content is useful and how to improve the website: the controller’s legitimate interest (Art. 6(1)(f) GDPR).
The legitimate interest is keeping the website working and secure and understanding how it is used, with minimal data and no profiling. You can object at any time (Art. 21 GDPR).
Replying to contact requests: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). Any health information you share of your own accord is processed by a healthcare professional bound by professional secrecy (Art. 9(2)(h) and 9(3) GDPR).
Recipients
Vercel Inc., the hosting provider, as processor. Transfers to the United States rely on the EU-US adequacy decision (Data Privacy Framework, which Vercel has joined) and on standard contractual clauses.
Felice Caricati, who runs the server hosting the statistics (Umami) and the error log (GlitchTip), as processor, with data hosted in the European Union.
Cloudflare Inc., which routes traffic to that server, as processor. Transfers to the United States rely on the Data Privacy Framework, which Cloudflare has joined, and on standard contractual clauses.
Databricks Inc. (Neon), the database provider for the restricted area, as processor, with data hosted in the European Union (Frankfurt). Any access from outside the Union is covered by standard contractual clauses.
Google, which provides the practice’s mailbox, for the messages you send us.
Retention
Browsing data in the hosting logs: up to one day.
Statistics: one year, then deleted.
Technical errors: 90 days.
Sign-in attempts to the restricted area: up to two days.
Emails and messages: as long as needed to reply; if you then start therapy, according to the retention duties for professional records.
Your rights
You can ask at any time for access, rectification, erasure, restriction, portability and object to processing (Arts. 15-22 GDPR) by writing to dott.lauramonaco@gmail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
No decisions are made solely by automated processing.