How we handle personal data

The controller of personal data is:

MaxMed S.r.l.Via Giorgio Oprandi, 124065 Lovere (BG), ItalyEmail: info@maxmed.it

(hereinafter "MaxMed" or the "Controller")

MaxMed is the controller of the personal data and health data processed in providing its structured telemedicine service through its digital platform.

The MaxMed platform is a digital infrastructure for managing the clinical process in a structured way. It covers:

• Taking the patient's medical history
• Video consultations with an accredited doctor
• Making a diagnosis
• Issuing clinical prescriptions
• Storing health records

Patients access the service through an accredited healthcare operator, with whom they keep a direct professional relationship. The doctor is involved solely to make the diagnosis and issue the prescription, within the process organised by the platform.

In providing the service, we process:

Identification and personal details

• First and last name
• Date and place of birth
• Tax code (codice fiscale)
• Phone number and email
• Address

Health data (special categories under Art. 9 GDPR)

• Medical history
• Symptoms
• Medical reports
• Diagnostic tests (lab tests, X-rays, CT scans, MRIs, etc.)
• Uploaded clinical documents
• Diagnoses
• Prescriptions
• Recordings of video consultations (where enabled)

These belong to the special categories of data under Article 9 of the GDPR.

Personal data is processed for the following purposes:

• Providing healthcare services digitally
• Making diagnoses and issuing prescriptions
• Storing health records
• Meeting legal obligations in healthcare
• Protecting the professionals involved from a medico-legal standpoint
• Administering and organising the service
• Preventing abuse, misuse and unauthorised access

Processing is lawful under:

• Art. 9(2)(h) GDPR: processing necessary for medical diagnosis, care or treatment
• Art. 6(1)(b) GDPR: performance of a service requested by the data subject
• Art. 6(1)(c) GDPR: compliance with legal obligations

Data is processed using IT and electronic tools, following the principles of lawfulness, fairness, transparency, data minimisation, integrity and confidentiality.

The platform uses:

• Strong authentication
• Permissions based on role and clinical function
• Traceability of operations (activity log)
• Timestamping of operations
• Encryption and data protection
• Backup and disaster recovery

Health records processed through the platform are kept for the period required by current healthcare and professional liability law, currently 10 (ten) years, unless the law requires longer retention.

Records are kept to:

• Ensure continuity of the clinical record
• Allow the clinical pathway to be reconstructed
• Protect the professionals involved from a medico-legal standpoint
• Meet legal obligations

Once the retention period ends, data is deleted or anonymised, unless the law requires otherwise.

Where the platform records video consultations:

• Recordings are made solely for clinical and medico-legal purposes
• Recordings form part of the health record
• Patients are informed in advance of any recording
• Recordings are kept for the same period as other clinical records

Recordings may not be used for any purpose other than those strictly related to healthcare and legal protection.

Data may be shared only with:

• Accredited healthcare operators involved in the clinical process
• Accredited doctors, to make diagnoses and issue prescriptions
• Competent authorities, where required by law
• Technology providers acting on the Controller's behalf, bound by contractual confidentiality obligations

Data is never made public.

Data is not transferred outside the European Union. Should this become necessary, any transfer will follow the safeguards set out in the GDPR.

You can exercise the rights set out in Articles 15–22 of the GDPR:

• Right of access to your data
• Right to rectification
• Right to erasure (within legal limits)
• Right to restriction of processing
• Right to data portability
• Right to object (within legal limits)
• Right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali)

Requests can be sent to info@maxmed.it.