Information on the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), and on the use of cookies.
This is an English translation of the Italian privacy policy. In case of any discrepancy, the Italian version prevails.
1. Data controller
The website giuliomaggi.com presents the work of Dr Giulio Maria Maggi, plastic surgeon, who practises at Aesthetic Clinic. The controller of the data collected through the website is Aesthetic Clinic S.r.l., Lungo Dora Pietro Colletta 67, 10153 Torino, Italy — VAT and tax code 12268790016 — REA TO-1277314.
"Request a consultation" form: full name, email, phone (optional), country of residence (optional), preferred way of being contacted, procedure or treatment of interest, type of consultation (in person or online), preferred location, time of day, how you heard about us and any notes you write. The procedure of interest and the notes may contain health data, which the GDPR treats as "special categories of data" (Article 9).
Virtual assistant (chat): the text of the questions you write and the page you write them from. No name, IP address or other data identifying you are collected. Please do not enter names, contact details or information about your health in the chat: the assistant only provides general information taken from the content of the website.
Browsing data: technical data collected automatically by the hosting systems (for example IP address, date and time of the request, type of browser), needed for the website to work and to be secure.
Statistics and ad measurement (only with your consent): information about how the website is used and about visits coming from our Google ads, collected through Google Analytics, Google Tag Manager and Google Ads.
3. Purposes and legal bases
Handling your consultation request and contacting you: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
Health data you may include in the form: processed only to contact you and arrange the consultation, on the basis of your explicit consent (Article 9(2)(a) GDPR), given with a specific optional, unticked box, separate from the acknowledgement of this policy. If you do not give this consent you can still ask to be contacted, without including information about your health in the form.
Virtual assistant answers: to provide the general information you ask for (Article 6(1)(b) GDPR). Questions are kept anonymously to understand what information is missing from the website and to improve the service: legitimate interest of the controller (Article 6(1)(f) GDPR).
Security and operation of the website: legitimate interest of the controller in protecting its systems and keeping them working properly (Article 6(1)(f) GDPR).
Statistics and Google ad measurement: your consent (Article 6(1)(a) GDPR), given through the cookie banner and revocable at any time.
Providing data in the form is optional, but without contact details we cannot follow up on your request. The form is for adults only. No decisions are taken based solely on automated processing (Article 22 GDPR): the virtual assistant only provides general information and does not assess your case.
4. Who receives the data
Data may be processed by the following parties, appointed as processors under Article 28 GDPR:
Netlify, Inc. — website hosting, collection of requests sent with the form, cookie consent register and anonymous storage of questions to the assistant. Processing is governed by Netlify's Data Processing Agreement, which is part of its terms of service.
Anthropic PBC — provider of the artificial intelligence model that generates the assistant's answers; the text of the questions reaches it through the Netlify AI Gateway service. The service is configured for "zero data retention": the provider processes the text to generate the answer and does not store it.
Google Ireland Limited — Google Analytics, Google Tag Manager and Google Ads, active only if you give your consent. Google Signals and personalised advertising (remarketing) are turned off.
Within the clinic, data are processed only by authorised staff, who handle consultation requests for the location you choose (Turin, Asti or Alessandria).
Transfers outside the EU
Netlify and Anthropic are based in the United States, and data collected by Google tools may also be processed by Google LLC in the United States. Transfers comply with Chapter V of the GDPR: for Netlify and Google on the basis of their participation in the EU-U.S. Data Privacy Framework; for Anthropic on the basis of the Standard Contractual Clauses approved by the European Commission.
5. How long we keep data
Consultation requests: for as long as needed to contact you, and in any case no longer than 12 months from receipt. If a care relationship follows, the data become part of your medical records, which are kept for the periods required by law.
Questions to the virtual assistant: kept anonymously for 12 months, then deleted automatically. The conversation stays in your browser's temporary memory (sessionStorage) and is deleted when you close the tab.
Google tools: Google Analytics statistics are kept according to the property settings; the ad measurement cookie (_gcl_au) lasts up to 90 days.
Cookie consent register: 24 months.
Browsing data: for the period set out in the hosting provider's terms of service, for security purposes.
6. Cookies and third-party content
The website does not use profiling cookies or personalised advertising.
Technical tools (no consent needed): the website saves in your browser (localStorage) the choice you make in the cookie banner, so that it is not shown on every page, and remembers it for 6 months; the virtual assistant uses the browser's temporary memory (sessionStorage) to keep the conversation while you browse.
Google Analytics, Google Tag Manager and Google Ads (only with consent): on your first visit a banner lets you accept or reject, with two equally visible buttons. Closing the banner with the X counts as rejecting. Until you accept, these tools are not loaded and no third-party cookie is set. If you accept, the cookies _ga and _ga_* (statistics) and _gcl_au (ad measurement) may be set. You can change or withdraw your consent at any time from Cookie preferences, also at the bottom of every page.
Consent register: to be able to demonstrate the choices made in the banner (Article 7 GDPR), each choice is recorded on the server with a random code generated by the browser, the choice (accept or reject), how it was made (button or closing with the X), the banner version, the page and the date and time. No IP address or other data directly identifying you are recorded.
YouTube videos: videos are not loaded automatically. The YouTube player, in privacy-enhanced mode (youtube-nocookie.com), is activated only when you choose to start the video with a click; from that moment Google's privacy policy applies.
WhatsApp and maps: the WhatsApp buttons and the clinic addresses are simple links: WhatsApp and Google Maps open only if you tap them, and from that moment their privacy policies apply.
access to your data, rectification, erasure or restriction of processing (Articles 15–18 GDPR);
portability of the data you have provided (Article 20 GDPR);
to object to processing based on legitimate interest (Article 21 GDPR);
to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR).
You also have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.
