Privacy Policy

1. Controller and roles

The Controller for Doctful’s own processing is Dario Sangiovanni (10 Under Tiber Studio), with office at Via Castagnevizza 192, Fiumicino, Rome, 00054 Italy, VAT number IT13120271005. Privacy requests: privacy@doctful.com.

Doctful is an independent Controller for accounts, authentication, security, platform management, public profiles and search, platform availability, payments owed to Doctful, its own consents, legal obligations, its own newsletter if activated, technical diagnostics and necessary technical analysis. These purposes do not include independent use of persisted booking-request data processed on the professional’s behalf.

The professional or practice is Controller for the healthcare service, contacts, professional calendar, health data, service payments, booking requests, invoicing and Sistema Tessera Sanitaria. Doctful processes persisted data needed for the agreed functions on the professional’s behalf, including the booking request. This processing is governed by the applicable SaaS agreement and the platform Terms and Conditions, whose acceptance is required to use the service. The roles are separate and do not create joint controllership.

For healthcare data, calendar, care, invoices and Sistema Tessera Sanitaria, patients should contact the professional. For accounts, security and Doctful’s own technical functions, they may contact Doctful.

2. Data and purposes

Depending on the function, we may process:

• identity, contact, authentication, profile and language data;
• public professional data, availability and booking requests;
• fiscal data entered in an invoice and payment-flow data;
• health data in anamnesis, treatments, reports or notes entered by the professional;
• technical, security, log, consent and cookie-preference data, information about navigation and interactions with the service, technical timings, events and technical session indicators;
• tokens and technical metadata for push notifications, only after an express choice.

The legal bases are linked to the purposes as follows:

• accounts, authentication and necessary functions: performance of the contract or steps taken at the data subject’s request before entering into a contract;
• operation, availability, security, abuse prevention, technical diagnostics, interaction analysis and performance management: Doctful’s legitimate interest in security, continuity, reliability and platform protection, limited to necessary data;
• public profiles, search and professional availability: performance of the relationship with the professional and, for data made public at the professional’s request, legitimate interest in operating the public search and availability service;
• payments owed to Doctful, its own invoicing and related duties: performance of the contract and, where applicable, compliance with legal obligations;
• operational and transactional communications: performance of the contract or compliance with legal obligations; Doctful’s own newsletter, if activated: consent;
• push notifications and other optional browser or device functions: express consent. Storing cookie preferences is necessary to record the data subject’s choices; any optional technologies are activated as described in the Cookie Policy;
• management and documentation of consents: compliance with a legal obligation where applicable and legitimate interest in demonstrating compliance;
• booking requests, calendar, care, healthcare data, invoicing and Sistema Tessera Sanitaria processed on the professional’s behalf: Doctful acts as Processor on the professional’s instructions. The professional identifies its legal basis and, where applicable, the Article 9 GDPR condition for processing healthcare data.

Data required to create an account or use a necessary function is identified in the relevant flow; failure to provide it may prevent that function. Other data is optional. Data is normally supplied directly by the data subject or by the professional within its relationship; where it comes from another source, that source is the professional or the person lawfully communicating it. Doctful does not carry out profiling or automated decisions producing legal or similarly significant effects.

3. Healthcare data and booking

Service-generated communications may include operational notifications linked to appointments. Doctful processes them to provide and maintain the requested functions and does not use them for profiling, training or autonomous product-improvement purposes, nor disclose them to external communication or artificial intelligence services, except as strictly necessary for the stated function.

Healthcare data entered by the professional is protected and accessible only to the authorised professional for the relevant relationship. It is not shared with marketing tools, push notification services, AI services or other professionals.

A booking request organises a possible appointment; it is not informed consent or healthcare treatment. Before sending it, the patient acknowledges the professional’s notice. The professional remains responsible for healthcare processing and consent.

4. Invoices and Sistema Tessera Sanitaria

An invoice may be made available to the recipient selected by the professional through restricted access using a link and personal code. The recipient must protect both and must not forward them to third parties.

An invoice may contain patient data, including an address, VAT number or other fiscal data entered by the professional, as well as treatment items. This processing supports invoicing and related obligations, not Doctful’s own commercial purposes.

Doctful facilitates completion and transmission to Sistema Tessera Sanitaria based on supplied data. The professional must verify accuracy, completeness, transmission, receipt, retention and its obligations. Doctful remains responsible for its own processing and service defects.

5. Tools and recipients

Data may be processed by Doctful and the providers needed for active functions, in their respective roles:

• infrastructure, storage and technical-support providers: application-data hosting, maintenance, security and incident management; production infrastructure is located in France, for the requested functions and platform security;
• Cloudflare: DNS, proxy and traffic protection, on the basis of legitimate interest in security and service availability;
• Stripe: payments and identifiers needed for the relevant flows, on the basis of contract performance and applicable legal obligations;
• hCaptcha: bot and abuse prevention in protected flows, on the basis of legitimate interest in security and abuse prevention;
• Google Identity Services: federated authentication and profile data requested by the flow, at the user’s request for authentication and access to the service;
• Nominatim, Photon, OpenStreetMap and OpenFreeMap: public professional addresses or coordinates for geocoding and maps as part of professional profiles and public search;
• transactional email providers or internal mail systems: recipient addresses, minimum content and delivery metadata for operational communications; Doctful’s own newsletters are sent only with consent;
• Doctful internal tools and infrastructure: technical measurement, error diagnosis, interaction analysis and platform security, using technical metadata, navigation information, timings and interaction events limited to what is necessary, on the basis of legitimate interest in service security and reliability;
• OneSignal: tokens and technical metadata for generic push notifications, only for authenticated users who gave express consent. It does not receive email, names, phone numbers, chats, invoices or appointment details.

The legal bases above concern Doctful’s purposes and do not replace any privacy notices of providers that process data for their own purposes, such as payments or federated authentication. For processing carried out on behalf of Doctful or the professional, providers act in their respective roles under the applicable instructions and agreements.

Doctful uses internal technical measurement and interaction-analysis tools on public pages and restricted areas to identify errors, delays and reliability problems. They may process technical metadata, page and navigation information, timings, interaction events and technical session indicators. These tools are not used for advertising, commercial profiling or cross-site tracking. Data minimisation, access restrictions and exclusion or masking measures are applied to data that is not necessary for the technical purposes.

Providers may process data in the European Union or other countries where they operate. Where a transfer outside the European Economic Area is necessary, Doctful uses an adequacy decision or, where applicable, the Data Privacy Framework; otherwise it uses an appropriate GDPR safeguard, such as standard contractual clauses and necessary supplementary measures. Updated information about recipients, locations, safeguards and retention are described in this Policy and in the information made available about providers. If a request concerns information already published, Doctful may refer to the current version; tailored reports or analyses not necessary for transparency duties are not owed without a separate agreement, without prejudice to rights provided by law.

6. Retention and security

• invoices, Sistema Tessera Sanitaria data and delivery logs: up to 10 years from issuance, subject to legal holds or further duties;
• events, technical identifiers, IP addresses, navigation information, user agents, interaction data and security or diagnostic logs: no more than 30 days, subject to legal holds;
• backups: retained according to the periods applicable to the related data categories and continuity requirements, with rotation and deletion under documented procedures;
• service-generated communications: 365 days;
• data needed to document and protect operations performed without an account: until removal of any account subsequently created or for the necessary period where no account is created, subject to applicable duties.

Technical and interaction data collected for these purposes is deleted or made no longer attributable to the data subject within the stated maximum period, under documented procedures.

We apply risk-proportionate measures, access control, encryption of protected data, separation between professionals, logging of relevant operations, backups and restoration. Doctful staff do not ordinarily access readable healthcare or communication content.

Security incidents are managed under applicable security processes and obligations. Doctful informs the professional without undue delay when a breach concerns data processed on its behalf and notifies authorities or data subjects where the obligation falls on Doctful as Controller.

7. Rights and contacts

You may request access, rectification, erasure, restriction, portability or objection where applicable, and withdraw consent without affecting previous processing. For data processed by the professional, contact the professional; for Doctful’s own purposes, write to privacy@doctful.com.

Where processing is based on legitimate interest, you may object at any time on grounds relating to your particular situation. You may exercise this right by writing to the privacy contact above; the request will be assessed under Article 21 GDPR.

You may lodge a complaint with the competent supervisory authority, including the Italian Garante. The Cookie Policy and preference management are available here.

Rights may be exercised without charge, except where the law provides otherwise. We respond within applicable time limits and may request information needed to verify identity and the scope of the request. Requests concerning the same subject may be consolidated. For purposes for which Doctful acts as Controller, where a request is manifestly unfounded or excessive, particularly because it is repetitive, Doctful may charge a reasonable fee proportionate to administrative costs or refuse to act, documenting the grounds and available supporting elements. Where data is processed on a professional’s behalf, we forward or direct the request to the professional according to the respective roles and follow the professional’s instructions for its handling.

Updates, reports and corrections

This Privacy Policy describes the processing carried out by Doctful based on the features, configurations and services actually active on the stated date. Some features may be optional, inactive or subject to specific contractual conditions.

You may report omissions, inaccuracies or information that is no longer current to the privacy contact indicated in this Policy. Doctful will assess the report against the processing actually carried out and, where necessary, correct or supplement this Policy without undue delay, stating the new version and update date.

Receipt of a report does not, by itself, constitute an admission of a breach or an acknowledgement that the report is well founded. Changes will be applied according to their nature and relevance: non-substantial editorial corrections do not require renewed acknowledgement, while changes affecting processing will be communicated through appropriate means before or at the time they are applied and, where required, will be subject to renewed acknowledgement or acceptance.

Duplicate reports concerning the same text or period may be consolidated; Doctful is not required to reopen a report already reviewed in the absence of new elements, without prejudice to data subject rights and mandatory obligations.

This clause does not limit data subject rights, Doctful’s mandatory legal obligations or the professional’s responsibilities for processing for which the professional is the Controller.

Last review: 20 September 2026.