Privacy Policy

How we process personal data.

Last updated: [TO BE COMPLETED]

This policy describes how the personal data of users of the Box della Salute website and service is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable law.

1 · Data controller

Wealty S.A., Viale Stefano Franscini 16, 6900 Lugano, Switzerland. E-mail: [email protected].

Data Protection Officer (DPO) and EU representative, where appointed: [TO BE COMPLETED].

2 · Types of data processed

• Navigation data: technical data collected automatically while browsing the site (e.g. IP address, browser type, pages visited), within the limits set out in the Cookie Policy.
• Contact data: data provided voluntarily (e.g. e-mail) for information or demo requests.
• Booking and service-management data: digital identity (SPID/CIE), appointments and any payments.
• Health data: measurements and results generated during use of the Box. These are special categories of data (Art. 9 GDPR) and are processed with reinforced safeguards.

3 · Purposes

• provide and manage the Box della Salute service and enable results to be downloaded;
• verify the user's identity and capture and log consent;
• respond to information or demo requests;
• ensure system security and comply with legal obligations.

4 · Legal bases

• Explicit consent (Art. 9(2)(a) GDPR) for processing health data;
• performance of a contract or pre-contractual measures (Art. 6(1)(b)) for booking and service management;
• legitimate interest (Art. 6(1)(f)) for system security;
• legal obligation (Art. 6(1)(c)) where applicable.

5 · Consent and digital identity

Health data is processed only with explicit consent. Access via SPID/CIE allows the identity to be verified and consent to be captured and logged digitally, without paper forms. Consent may be withdrawn at any time, without affecting the lawfulness of processing based on consent before withdrawal.

6 · Processing methods and security

Data and documents are protected with encryption and cryptographic pseudonymisation. Servers do not store names, surnames or tax codes in clear text associated with results, but technical codes not directly traceable to identity. Transmission takes place over a protected virtual private network (Tailscale/WireGuard).

7 · Recipients and providers

Data may be processed by authorised providers acting as data processors (e.g. technology provider, digital-identity services, cloud infrastructure), under specific agreements. An up-to-date list of processors is available on request: [TO BE COMPLETED with provider names].

8 · Server location

Cloud servers are located in the European Union. Any transfers to third countries take place only with adequate safeguards under the GDPR. Specific provider and region: [TO BE COMPLETED].

9 · Retention periods

• results generated by the Box are retained for a maximum of 15 days, then permanently deleted;
• contact and booking data are retained for as long as necessary for the related purposes and legal obligations: [TO BE COMPLETED];
• navigation data is retained as set out in the Cookie Policy.

10 · Data subject rights

The data subject may exercise the rights of access, rectification, erasure, restriction, portability and objection, as well as withdrawal of consent, within the limits of the law, by writing to [email protected].

11 · Complaint to the supervisory authority

The data subject has the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali; in Switzerland, the Federal Data Protection and Information Commissioner), under applicable law.

12 · Contacts and updates

For any privacy-related request: [email protected]. This policy may be updated; changes will be published on this page.