Book a consultation

Privacy notice

Version 2 – effective from 4 November 2026

This is a translation of the Italian privacy notice. In case of doubt, the Italian version prevails.

1. Data controller

This notice explains how personal data are processed for people who visit giovannibrunelli.it and for people who contact the practice through the website. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.

The data controller is Dr Giovanni Brunelli, specialist in Plastic, Reconstructive and Aesthetic Surgery, with his practice at Via Guido Zadei 64, 25123 Brescia, Italy.

Phone: +39 030 390790 · Email: info@giovannibrunelli.it · VAT number: IT03107090171

The controller has not appointed a Data Protection Officer (DPO).

This notice applies only to this website. It does not apply to third-party websites reachable through links, which are subject to their own privacy and cookie notices.

Patients’ data collected at the practice during consultations and treatments are covered by a separate notice.

2. What data we process

a) Browsing data. When you visit the website, the server that hosts it automatically records some technical data:

  • IP address (in anonymised form);
  • date and time of the request;
  • page visited;
  • browser type;
  • device type.

These data are needed for the website to work and to keep it secure. They are not used to identify or profile visitors.

b) Data sent through the contact form. If you request an appointment or information through the website, you may provide:

  • first name and surname;
  • phone number and/or email address;
  • the subject of your request, chosen from a list;
  • an optional free-text message;
  • the language version of the website the request is sent from;
  • date and time of sending;
  • the consents you give.

c) Newsletter data. If you subscribe to the newsletter, you provide your email address and, optionally, your first name.

d) Data sent by email or phone. If you write to or call the practice using the contact details on the website, you provide the data contained in your message.

e) Any health-related data. The subject chosen in the form and the content of your message may reveal information about your health. For this reason, please include only the data strictly necessary to request information or book an appointment.

Requests concerning minors under 18 must be sent by a parent or by the person with parental responsibility.

3. Purposes and legal bases

a) Allowing you to browse the website and keeping it secure and working properly. Legal basis: the controller’s legitimate interest.

b) Handling requests for information, contacts and appointments. Legal basis: pre-contractual measures requested by you; for any health-related data included in the form or in your message, your explicit consent.

c) Sending information and promotional communications from the practice by email, phone or message. Legal basis: consent.

d) Sending the practice newsletter. Legal basis: consent.

e) Complying with legal obligations and defending the controller’s rights in case of disputes. Legal basis: legal obligation and legitimate interest; for any health-related data, processing necessary for the establishment, exercise or defence of legal claims.

Providing the data needed to answer your request is necessary; providing data for promotional purposes and for the newsletter is optional.

Consents for promotional purposes and for the newsletter are collected with separate, unticked boxes.

Data are not used for profiling or automated decision-making.

4. Promotional communications and newsletter

You can subscribe to the newsletter:

  • from the contact form, by ticking the dedicated optional box;
  • from the subscription box on the Italian pages of the website.

The newsletter is sent through Brevo (Sendinblue SAS, France), which receives your email address and, if provided, your first name.

Brevo records whether a message is opened and whether the links in it are clicked, in order to provide the practice with statistics on its mailings.

You can withdraw your consent at any time:

Promotional communications concern only the activity of the practice. Data are not passed on to third parties for marketing purposes.

5. How data are processed and who receives them

Data are processed electronically and, where necessary, on paper, with appropriate measures to prevent loss, unlawful use or unauthorised access.

Requests sent through the contact form reach the practice’s email inbox and are stored in a restricted area of the website.

Within the limits of their roles, the following may process the data:

  • the controller;
  • authorised and trained staff of the practice;
  • technical service providers appointed as data processors: IONOS SE (Germany), for website hosting and email, and Sendinblue SAS – Brevo (France), for the newsletter;
  • public authorities, where required by law.

Data are not disclosed to the public or sold.

6. Transfers outside the European Union

The providers listed above are based in the European Union and process data in data centres located in the European Union. Should a transfer to a non-EU country become necessary in future, it will take place in compliance with the safeguards of Articles 44–49 GDPR.

7. Retention period

Personal data are kept for as long as necessary for the purposes for which they are collected, according to these criteria:

  • browsing data (server logs): 8 weeks, with anonymised IP address, according to the hosting provider’s settings;
  • contact form requests that do not lead to a consultation: up to 24 months from the last contact;
  • requests that lead to a consultation: become part of the patient’s records and follow the retention periods that apply to them;
  • data for promotional communications and the newsletter: until consent is withdrawn or the subscription is cancelled;
  • data needed to defend a right in case of disputes: for the period provided by law.

When the applicable periods expire, data are deleted or anonymised.

8. Cookies

This website uses only technical cookies needed for it to work and to keep it secure. It does not use profiling, advertising or third-party statistics cookies, and it does not load external services such as embedded maps, external fonts, social buttons or embedded videos. For this reason there is no cookie banner. Details are in the cookie notice.

9. Your rights

You can exercise the rights provided by Articles 15–22 GDPR:

  • access to your data;
  • rectification;
  • erasure;
  • restriction of processing;
  • data portability;
  • objection;
  • withdrawal of the consents given, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, write to info@giovannibrunelli.it or to the controller at the practice, Via Guido Zadei 64, 25123 Brescia, Italy.

If you believe that the processing breaches the applicable law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.

10. Updates

This notice may be updated following changes in the law, organisation or technology. The version in force is the one published on this page, with its update date.

Let’s talk in person

Via Guido Zadei 64, Brescia, Italy · Tel. +39 030 390790

Request an appointment