Privacy Policy for MedBox

The Data Controller for personal data processed in connection with the MedBox application is:

For requests concerning personal data protection and the exercise of data protection rights, users may use the contact details made available on the official website and within the MedBox application.

MedBox is a platform designed for the storage, organization, sharing, distribution and consultation of documents and content mainly related to healthcare, professional and organizational activities.

The application allows authorized users to access, directly from their devices, documentation made available through the platform, including, by way of example:

• procedures;
• protocols;
• operating instructions;
• guidelines;
• informational and training documents;
• healthcare and organizational documentation;
• other documents and content relevant to the purposes of the platform.

Documents and content available on MedBox may be produced directly by MedHome STP S.r.l. or may originate from institutions, organizations, public or private bodies, companies, professionals or other third parties that have authorized their publication, sharing or distribution through the platform.

The presence of documents originating from third parties does not imply that MedHome STP S.r.l. is their author or owner. Such content is made available through MedBox on the basis of the authorizations and any conditions established by the respective rights holders.

MedBox provides document management, storage, distribution and consultation functions.

Healthcare-related content made available through the platform is primarily intended for informational, organizational, training and professional purposes and does not replace the judgment, assessment, clinical decisions or activities of a qualified healthcare professional.

Public self-registration by users is not available.

MedBox accounts are created and enabled in order to allow authorized users to access the services and content made available to them through the platform.

Only the data necessary to identify the user and manage the account are required for account creation, specifically:

• first name;
• last name;
• email address.

Once enabled, users may manage their account using the features available within the platform.

Users are responsible for safeguarding their login credentials and must not allow unauthorized persons to use them.

4.1 Identification and contact data

• first name;
• last name;
• email address.

4.2 Account data

Information necessary for account creation, authentication, management and security may be processed.

4.3 Technical data

When using the application, certain technical information necessary for the operation and security of the service may be processed, where applicable:

• device information;
• operating system;
• technical access information;
• technical identifiers;
• data necessary for the security and proper functioning of the platform.

4.4 Notification data

MedBox uses a push notification service. For this purpose, technical device identifiers and other information strictly necessary to send and manage notifications may be processed.

Documentation available through MedBox may be:

• produced directly by MedHome STP S.r.l.;
• provided by institutions, organizations, public or private bodies, companies or professionals;
• provided by third parties that have authorized MedHome STP S.r.l. to publish, share or distribute their content through MedBox.

Ownership of documents and their content remains with the respective authors or rights holders, where applicable.

Users must use the documentation in accordance with any restrictions, terms of use, copyright requirements and authorizations established by the content owner.

The ability to view a document through MedBox does not automatically grant permission to reproduce, modify or distribute it outside the platform unless expressly authorized.

• creation and management of user accounts;
• user authentication;
• management of access to the platform;
• making documentation available to authorized users;
• management of document consultation, organization and sharing;
• controlled distribution and dissemination of content;
• sending notifications concerning new documents, updates, communications or other platform features;
• management of user requests;
• technical support;
• IT security;
• prevention of unauthorized access or use;
• maintenance and improvement of the platform;
• compliance with applicable legal obligations.

Personal data are processed in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national data protection legislation.

Depending on the specific purpose and the relationship with the user, processing may be based on:

• performance of a contract or measures related to the provision of the service;
• compliance with legal obligations;
• the legitimate interests of the Data Controller, where applicable;
• the data subject's consent, where required by law.

The specific legal basis may also depend on the relationship between the user, MedHome STP S.r.l. and any institution or organization that has authorized the user to access the platform.

Data and documents managed through MedBox are stored using the technological infrastructure used to provide the service and accessible through the domain medhacademy.it.

MedHome STP S.r.l. adopts technical and organizational measures designed to ensure an appropriate level of security and to protect data against unauthorized access, loss, destruction, alteration, disclosure or misuse.

Access to restricted areas of the platform is permitted only to authorized users.

Personal data are retained for the period necessary to fulfil the purposes for which they were collected and, thereafter, for any additional retention periods required by applicable law or necessary to protect the rights of the Data Controller.

MedBox uses OneSignal for the management and delivery of push notifications to users.

The use of this service may involve the processing of technical information required for the correct delivery of notifications, such as device identifiers and other technical information associated with the notification service.

Notifications may be used, for example, to inform users about new documents, updates, communications or relevant content available within MedBox.

The use of services provided by OneSignal is also subject to the provider's applicable terms and data protection policies.

Personal data may be processed, to the extent necessary to provide the service, by external parties providing technical or organizational services to MedHome STP S.r.l.

These may include:

• IT infrastructure providers;
• hosting service providers;
• maintenance and technical support providers;
• IT security providers;
• push notification service providers, including OneSignal;
• other providers strictly necessary for the operation of the platform.

Such parties process data only for purposes necessary to provide their respective services and in accordance with applicable law.

Users' personal data are not sold to third parties.

If the use of technology providers or services involves the transfer of personal data to countries outside the European Economic Area, such transfers will be carried out in accordance with the conditions and safeguards required by the GDPR and applicable legislation.

MedHome STP S.r.l. adopts technical and organizational measures designed to protect personal data and the security of the platform.

These measures are intended, in particular, to reduce the risks of:

• unauthorized access;
• accidental loss of data;
• unauthorized modification or alteration;
• improper disclosure;
• destruction of data;
• misuse of user accounts.

Users are required to contribute to the security of the service by keeping their credentials confidential and reporting any suspicious access or activity.

Under the GDPR and where provided for by applicable law, data subjects may exercise their rights, including the right to:

• obtain confirmation as to whether personal data concerning them are being processed;
• request access to their personal data;
• request correction of inaccurate or incomplete data;
• request deletion of personal data where permitted by law;
• request restriction of processing;
• object to processing where applicable;
• request data portability, where applicable;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Data subjects also have the right to lodge a complaint with the competent Data Protection Authority if they believe that their personal data are being processed in breach of applicable law.

MedBox provides users with a dedicated procedure to request:

• access to their personal data;
• correction of their personal data;
• deletion of their personal data;
• deletion of their MedBox account and associated personal data, subject to applicable legal requirements.

Requests may be submitted through the dedicated Data Access / Data Deletion Request page available on the website.

To protect account security and personal data, MedHome STP S.r.l. may verify the identity of the requester before processing the request.

Delete Your Account Here

Users may request deletion of their MedBox account.

Following the request and any necessary verification, the account will be deactivated and the associated personal data will be deleted or anonymized, except for information that MedHome STP S.r.l. is required or permitted to retain for legal obligations, security, protection of its rights or other purposes permitted by applicable law.

Deleting an account results in loss of access to the platform and to the documentation made available through that account.

Deletion of a user account does not necessarily result in deletion of general documents, procedures, protocols or other content available on MedBox that are not personally related to that user.

Delete Your Account Here

MedBox may make available documentation, references or links relating to institutions, organizations or other third parties.

MedHome STP S.r.l. does not acquire ownership of third-party content merely because such content is made available through MedBox.

Any external websites, services or platforms are subject to their own terms of use and privacy policies.

MedHome STP S.r.l. may update this Privacy Policy as a result of:

• changes in applicable law;
• introduction of new features;
• changes to services used by the platform;
• technical or organizational developments affecting MedBox.

The updated version will be published on the website and identified by the date of the latest update.

For information concerning this Privacy Policy, the processing of personal data or the exercise of data protection rights, please contact:

Requests concerning access to or deletion of personal data may also be submitted through the dedicated Data Access / Data Deletion Request page available on the MedBox website.

Delete Your Account Here