Privacy Policy

1. Data Controller

The Data Controller is Studio Dentistico Dott. Davide Tarallo, located at Via Cardinale Maurilio Fossati, 4, 10141 Torino TO.
VAT / P.IVA: 08745260011
Medical Director: Dott. Davide Tarallo (Registered with the Register of Dentists of the Order of Doctors and Dentists of Turin).
Email: info@dentistadavidetarallo.it • Telephone: 011 383 3565

2. Categories of Personal Data Collected

• Contact and Appointment Data: Name, telephone number, email (optional), requested dental service, preferred time slot, and any optional notes submitted through the online booking and contact wizards.
• Voluntary Health-Related Notes (Art. 9 GDPR): Any preliminary health condition or clinical requirement freely provided by the patient in optional inquiry notes to organize their visit.
• Technical Browsing Data: Anonymized IP addresses, browser specifications, and timestamps collected strictly for security, rate-limiting, and network transmission.
• Aggregated Statistics (Google Analytics 4): Statistical measurement of visits and user journeys, strictly conditioned upon prior user consent via our cookie banner.

3. Purposes and Legal Bases for Processing

• Managing appointment bookings and inquiries: Legal basis is the performance of pre-contractual measures requested by the data subject (Art. 6(1)(b) GDPR) and explicit consent for any voluntarily submitted health-related notes (Art. 9(2)(a) GDPR).
• Complying with statutory and healthcare regulations: Legal basis is compliance with legal obligations (Art. 6(1)(c) GDPR).
• Website security and spam prevention: Legal basis is the Controller's legitimate interest in securing IT systems (Art. 6(1)(f) GDPR).
• Aggregated traffic analysis (Google Analytics): Legal basis is affirmative user consent (Art. 6(1)(a) GDPR).

4. Data Processors and Service Providers

Personal data is processed only by authorized clinical and administrative personnel bound by professional confidentiality, and by appointed Data Processors (Art. 28 GDPR):

• Vercel, Inc. — Web hosting and edge distribution infrastructure.
• Google Ireland Limited (Google Workspace & Google Analytics 4) — Encrypted reception and logging of appointment requests on enterprise Google Drive/Sheets, clinic email notification and automated courtesy confirmation via Google Workspace Gmail (covered by the Google Cloud Data Processing Addendum under Art. 28 GDPR), and consent-gated traffic analytics (GA4).
• CARTO / OpenStreetMap — Interactive vector map tile delivery (cookieless).

5. Data Retention

Appointment requests and inquiries are retained for the duration strictly necessary to process the request and for subsequent medical record administration if a clinical relationship is established. Cookie consent preferences are stored for 180 days (6 months) in accordance with Italian Garante Privacy guidelines.

6. Rights of the Data Subject

Pursuant to Articles 15–22 of the GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Requests may be sent to info@dentistadavidetarallo.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it).