Notice
Privacy notice
How the data of people who visit this website, and of people who contact the practice to book an appointment, is handled.
Last updated: October 2026
This page explains how the personal data of people who visit the website www.osteopatamassimofratini.com is handled, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). It covers the website only: the processing of health data that takes place during appointments and treatment is covered by a separate notice, given to you at the practice.
1. Who handles your data
The data controller is Massimo Fratini, osteopath and physiotherapist. For any question about your data you can write to massimo3fratini@yahoo.it or call 340 94 39 444.
The controller has not appointed a Data Protection Officer (DPO): the activity does not involve large-scale processing or systematic monitoring, so the conditions of Article 37 of the GDPR do not apply.
2. What data the website collects
Browsing data. The server that hosts the website automatically records some technical data, the transmission of which is inherent in the use of the internet: IP address, type of browser and device, date and time of the visit, pages requested. This data is needed to make the website work and to protect it from abuse, not to profile you. An IP address is personal data, so this data is processed with the safeguards provided by the GDPR.
No statistics and no profiling. The website does not use analytics tools, advertising pixels or profiling cookies. The fonts are hosted on the website itself and no maps or content from other websites are loaded: when you open a page, your browser does not communicate with third-party servers.
The “Write to the practice” form. The form on the Locations and contact page does not send or save anything: when you press the button, it opens the email program on your device with the message already written. The message reaches the practice only if you decide to send it, like any normal email.
3. Contact channels outside the website
Telephone. The number is a simple link: if you call, your data is processed by the controller to arrange the appointment.
WhatsApp. The “Book an appointment” and “WhatsApp” buttons open a conversation in the WhatsApp app or on the WhatsApp website: from that moment the data you enter there is also processed by WhatsApp Ireland Ltd., under its own terms. The controller uses the content of the conversation only to reply to you and arrange the appointment.
Email. If you write to the practice’s address, the message is processed by the controller in order to reply to you. The mailbox is provided by Yahoo, which manages the mail as an independent controller, under its own terms and its own privacy notice.
Google Maps. The “Open in Google Maps” links take you to Google’s website, which processes data as an independent controller, under its own privacy notice.
A notice. These channels are for booking an appointment, not for obtaining a remote assessment. I ask you not to send medical reports, radiological images or health documents: bring them to the appointment. If you nonetheless write to me with information about your health, I use it only to prepare for the appointment and keep it covered by professional secrecy.
4. Why your data is processed and on what legal basis
| Purpose | Legal basis |
|---|---|
| Making the website work, ensuring its security and preventing abuse | Legitimate interest of the controller (Art. 6.1.f GDPR) |
| Replying to people who call or write and arranging the appointment | Responding to your request and pre-contractual measures (Art. 6.1.b GDPR); for health information that you provide on your own initiative, healthcare purposes by a health professional bound by professional secrecy (Art. 9.2.h and 9.3 GDPR) |
| Complying with tax obligations and defending a legal right | Legal obligation and legitimate interest (Art. 6.1.c and 6.1.f GDPR) |
Providing your data is optional: if you do not write or call, no personal data reaches the practice. Without a contact detail, however, it is not possible to reply to you or arrange the appointment. Browsing data, on the other hand, is logged automatically by the server.
5. Who can access your data
The data is processed by the controller and, where present, by the people who work with him, who are authorised and bound by confidentiality. It may also be accessed, as processors (Art. 28 GDPR) and only to the extent necessary, by:
- Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), which hosts the website;
- the person who provides the technical maintenance of the website, appointed as a processor, who may occasionally access browsing data during maintenance work.
The data is not disclosed, transferred or sold. The services you use when you leave the website remain independent controllers, with their own privacy notices: WhatsApp, Google Maps and Yahoo (for email).
6. Transfer of data outside the European Union
The website is hosted in Italy. Some services you use when you leave the website (WhatsApp, Google) and the controller’s email service (Yahoo) belong to groups that may process data in the United States: in these cases the transfer takes place on the basis of the safeguards of Chapter V of the GDPR, that is, the EU-US Data Privacy Framework adequacy decision for participating companies or the standard contractual clauses approved by the European Commission. You can ask the controller how to obtain a copy of these safeguards.
7. How long the data is kept
| Data | Retention |
|---|---|
| Messages (email, WhatsApp) that do not lead to an appointment | 12 months, then deletion |
| Messages from people who become patients | They become part of the practice’s records and follow their retention periods |
| Tax and accounting data | 10 years, as required by law |
| Browsing data logged by the server | 12 months at most, unless unlawful acts are being investigated |
8. Your rights
At any time you can ask to access your data and obtain a copy of it (Art. 15), to correct it (Art. 16), to erase it (Art. 17), to restrict its processing (Art. 18), to receive it in a readable format or have it transferred (Art. 20), and to object to processing based on legitimate interest (Art. 21). Write to massimo3fratini@yahoo.it: you will receive a reply within one month, extendable by two months in complex cases.
If you believe that the processing infringes the Regulation, you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority; Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it) or apply to the courts.
9. Automated decisions
The website does not make automated decisions and does not create profiles of the people who visit it.
10. Changes to this notice
This notice may be updated, for example if a supplier changes or if tools are added to the website. The version in force is always the one published on this page, with the date shown at the top. For cookies, see the cookie notice.