Privacy Policy

The data controller is Ospedale Sacco, Via Giovanni Battista Grassi 74, 20157 Milano (Italy), email valeria.calcaterra@unipv.it (the "Controller").

The Controller has appointed a Data Protection Officer ("DPO"), who supervises and advises on data protection matters and can be contacted for any request at valeria.calcaterra@unipv.it.

We process the data of Platform users (parents, doctors and administrators) and of the children registered by them:

• Account data: first name, last name and email address.
• Data about children entered by the parent or the linked doctor: date of birth, sex, perinatal and family history, feeding, lifestyle (sleep, physical activity, diet), anthropometric measurements, blood pressure and, when available, laboratory results such as glycemia and lipids.
• Consent records: when you accepted this policy and which doctors you authorized to access your children's data.

Data about health are special categories of personal data under Article 9 GDPR. When you provide personal data of third parties, such as your children, you confirm that you are entitled to do so.

• To create and manage your account and send you service emails, such as the link to set or reset your password, on the basis of your consent (Article 6(1)(a) GDPR).
• To calculate risk indicators for obesity and cardiometabolic conditions, including estimates produced by the PoDiaCar prediction model when some values are missing, on the basis of your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR).
• To share your children's data with the doctors you choose, only after your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR).
• To guarantee the security of the Platform, on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR), and, where necessary, to establish, exercise or defend a right of the Controller in court (Articles 6(1)(f) and 9(2)(f) GDPR).

You can withdraw your consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal. Risk indicators support the doctor's assessment and do not produce decisions based solely on automated processing.

Data are processed with electronic means suitable to guarantee their security and confidentiality and to prevent unauthorized access, directly by the Controller's organization and by processors appointed under a contract pursuant to Article 28 GDPR.

Data are kept only for the time necessary for the purposes for which they are collected, in line with the data minimization principle (Article 5(1)(c) GDPR) and with the Controller's legal obligations, without prejudice to your right to withdraw consent at any time. In general, the Controller applies the retention periods set by the "Massimario di scarto" (Version 04) of the Lombardy Social and Health System, approved by Decree of the D.G. Welfare No 11466 of 17 December 2015 and subsequent amendments. More information is available from the Controller.

• You, for your own account and your children.
• The doctors you have authorized, limited to the children linked to them.
• Platform administrators, only as needed to operate and support the Platform.
• Technical providers acting as processors under Article 28 GDPR: Amazon Web Services (servers and database, EU region) and Google Firebase (authentication and service emails).
• Authorities and public bodies entitled by law, as independent controllers.

Employees and collaborators authorized to process the data act under the Controller's instructions and are bound by confidentiality. Data are not disseminated, sold or used for advertising. The list of processors is available on request.

Data are stored in the European Union. Should a transfer outside the EU be necessary, for example because a technical provider processes data in another country, it takes place only towards countries considered adequate by the European Commission or with the appropriate safeguards of Article 46 GDPR, such as the Standard Contractual Clauses approved by the Commission.

Under Articles 15 to 22 GDPR you have the right to:

• obtain confirmation of whether your data are processed and access them;
• know the purposes, the categories of data, the recipients and the retention period;
• obtain the rectification or erasure of your data or the restriction of their processing;
• object to the processing, subject to compelling legitimate grounds of the Controller;
• receive your data in a structured, commonly used, machine-readable format and transmit them to another controller;
• withdraw your consent at any time;
• lodge a complaint with a supervisory authority (in Italy, the Garante per la protezione dei dati personali).

Requests must be sent in writing to the Controller or to the DPO at valeria.calcaterra@unipv.it. Any rectification, erasure or restriction will be communicated to the recipients of the data, unless this proves impossible or involves disproportionate effort.

This policy may be updated. The date at the top shows the latest version; significant changes will be communicated through the Platform.