Osteopatico

Privacy notice for osteopaths

This notice (Art. 13 of Regulation (EU) 2016/679, the "GDPR") describes how Osteopatico processes your personal data as a professional using the service. The processing of your patients' data is governed separately by the data-processing agreement: for that data you are the controller and Osteopatico is the processor acting on your behalf.

1. Controller

2. What data we process

  • Account data: name, email address, your identifier at the identity provider (Auth0) and the email-verification state. Osteopatico never stores your password.
  • Professional profile: personal details, contact details, preferred language, the practices and services you configure.
  • Billing profile: the fiscal data needed to issue electronic invoices (VAT number, tax code, tax regime, address, numbering), if you enable invoicing.
  • Acceptances: version and date of your acceptance of the data-processing agreement and of any other required document.
  • Technical and security logs: IP address, date and time, action performed and resource concerned for every access to patient data (the access log required by the data-processing agreement), plus the service's application logs.
  • Error reports: when the application hits an error in the browser it sends our systems the technical message, the page and the browser type. Only the shape of the page address is kept: search parameters are removed and every identifier in the address (a patient's or an intake form's, for example) is replaced with `:id`. Patient record content is not included.
  • Service notices: the notices we send you (maintenance, updates to contractual documents, any data breach) and the related proof of delivery.
  • In-app notifications: the list of notifications you receive in the "Notifications" section (for example: a patient completed a questionnaire or booked through one of your invites, a message to a patient was not delivered, service notices and announcements from Osteopatico) and, for each one, whether and when you read it. Notifications hold references only: the patient's name and the other details are read from the patient's record at the moment you open the list.

3. Purposes and legal bases

  • Providing the service (Art. 6(1)(b) GDPR): creating and managing the account, calendar, patient records, questionnaires, electronic invoicing, support.
  • Compliance with legal obligations (Art. 6(1)(c) GDPR): keeping the fiscal documents issued through the service for the periods required by tax law; documenting the communications the GDPR requires.
  • Security and protection of the service (Art. 6(1)(f) GDPR): access and technical logs, abuse prevention, error diagnosis. Our legitimate interest is keeping the service secure and working; logs are kept for limited periods.

Providing account and profile data is necessary to use the service: without it the account cannot be created or maintained.

4. Recipients

Data is processed by the technical providers listed in the sub-processor register (hosting, identity, email and SMS delivery, the electronic-invoicing intermediary), each only for the part needed for its own service. Data is not sold or passed to third parties for marketing purposes.

5. Transfers outside the EU

The service's main systems are hosted in the European Union. Any transfers to third countries by individual providers are listed in the sub-processor register together with the safeguards applied (Art. 44 et seq. GDPR).

6. Retention

  • Account and profile data: for the life of the account. When the account is deleted the data is erased; if you issued fiscal documents through the service, the account is deactivated and only the data required for fiscal retention is kept for the statutory periods.
  • Access and technical logs: for limited periods, set out in the service's retention schedule.
  • Service notices and their proof of delivery: for as long as needed to document the obligations the GDPR imposes.
  • In-app notifications and their read status: 12 months from the notification; announcements from Osteopatico for the same period, unless withdrawn earlier. Notifications about a patient are deleted sooner, together with the patient's data, if you delete the patient.

7. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to object to processing based on legitimate interest, and to receive your data in a portable format (Arts. 15-22 GDPR). You can exercise these rights from the profile settings (editing your data, deleting the account) or by writing to the contact details above. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

8. Changes to this notice

Material changes are announced with a notice in the application and by email to the account address. The version in force is shown at the bottom of this page.

Version: privacy-osteopati-2026-10

Service provider

The party you contract with, and whom you can contact for support and to exercise your rights.