Information regarding the processing of personal data for psychological support services pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
We inform you that the personal data provided for the performance of the professional service by the professional assigned to you (hereinafter the ‘Professional’), within the services provided by Unobravo S.r.l. SB (hereinafter ‘Unobravo’) will be processed in compliance with EU Regulation 2016/679 (hereinafter, the ‘GDPR’ or the ‘Regulation’) and Legislative Decree no. 196/2003 and subsequent amendments (hereinafter, the ‘Privacy Code’, jointly the ‘Applicable Regulations’).
1. PROCESSING CARRIED OUT BETWEEN UNOBRAVO SRL SB AND THE PROFESSIONAL AS THE JOINT DATA CONTROLLERS
Joint data controllers and DPO contact details
The processing of personal data acquired in the context of the provision of services provided by Unobravo provides, for certain purposes, a joint data controller regime between the following parties
• Unobravo S.r.l. SB, based in Naples (NA), via Giovanni Porzio, 4 - Isola B2
• The Professional providing the professional service in the context of the online therapy service provided by Unobravo.
An internal agreement as joint data controllers has been concluded between the aforementioned joint data controllers that outlines their respective responsibilities, pursuant to Article 26 of the GDPR, available at the request of the data subject to be sent to the following email address: privacy@unobravo.com.
The contact details of the DPO are as follows: dpo@unobravo.com.
For the full text of the information pursuant to Article 13 of the Regulation on processing carried out as joint data controllers, please refer to what is expressly specified in the Unobravo information available during registration, in the reserved area and available on this Privacy Policy page.
We inform you that the data may be used by Unobravo, in anonymous and aggregated form, for statistical and research purposes.
• Unobravo S.r.l. SB, based in Naples (NA), via Giovanni Porzio, 4 - Isola B2
• The Professional providing the professional service in the context of the online therapy service provided by Unobravo.
An internal agreement as joint data controllers has been concluded between the aforementioned joint data controllers that outlines their respective responsibilities, pursuant to Article 26 of the GDPR, available at the request of the data subject to be sent to the following email address: privacy@unobravo.com.
The contact details of the DPO are as follows: dpo@unobravo.com.
For the full text of the information pursuant to Article 13 of the Regulation on processing carried out as joint data controllers, please refer to what is expressly specified in the Unobravo information available during registration, in the reserved area and available on this Privacy Policy page.
We inform you that the data may be used by Unobravo, in anonymous and aggregated form, for statistical and research purposes.
2. PROCESSING FOR WHICH THE PROFESSIONAL IS THE SOLE DATA CONTROLLER
Data Controller
The Professional operates as an independent data controller of the personal data provided by the data subject, both of common information (personal and identification data) and data falling into special categories (including information relating to health status) for the purposes and within the terms described below.
Purpose of the processing
The Professional needs to carry out processing operations on the aforementioned data for the following purposes:
A. establishment, management and administration of the relationship with the data subject aimed at carrying out the requested services;
B. execution of the service for purposes of prevention, diagnosis, health therapy and treatment;
C. activity planning;
D. fulfilment of the obligations provided for by laws, regulations and EU legislation, for example in relation to administrative, accounting and tax matters;
E. litigation management.
A. establishment, management and administration of the relationship with the data subject aimed at carrying out the requested services;
B. execution of the service for purposes of prevention, diagnosis, health therapy and treatment;
C. activity planning;
D. fulfilment of the obligations provided for by laws, regulations and EU legislation, for example in relation to administrative, accounting and tax matters;
E. litigation management.
Legal basis for processing data
The legal basis for processing is:
for the purposes indicated in lit. A., B., C. and D. referred to in the previous section,
• as for personal data, in the execution of the contract or in the execution of pre-contractual measures adopted (Article 6, paragraph 1, lit. b) of the Regulation
• for special data, if diagnosis, assistance or medical therapy is required (Article 9, paragraph 2, lit. h) of the Regulation;
for the purpose indicated in lit. E. referred to in the previous section
• as for personal data, in the legitimate interest of the Professional (Article 6, paragraph 1, lit. f) of the Regulation);
• as for special data, if it is necessary to ascertain, exercise or defend a right in court (Article 9, paragraph 2, lit. f) of the Regulation)
for the purposes indicated in lit. A., B., C. and D. referred to in the previous section,
• as for personal data, in the execution of the contract or in the execution of pre-contractual measures adopted (Article 6, paragraph 1, lit. b) of the Regulation
• for special data, if diagnosis, assistance or medical therapy is required (Article 9, paragraph 2, lit. h) of the Regulation;
for the purpose indicated in lit. E. referred to in the previous section
• as for personal data, in the legitimate interest of the Professional (Article 6, paragraph 1, lit. f) of the Regulation);
• as for special data, if it is necessary to ascertain, exercise or defend a right in court (Article 9, paragraph 2, lit. f) of the Regulation)
Categories of data processed and nature of its provision
The processing will concern the following data:
• personal data of a common nature (personal and identification data, payment data);
• data relating to state of health: personal data relating to physical and/or mental health collected during therapy, including through the request for assessments, examinations, diagnostic assessments, rehabilitation and any other type of professional service related to the execution of the assignment;
Professional reflections/assessment/interpretations translated into data by the Professional constitute the set of professional data (or data resulting from the processing and assessment of the Professional during their clinical activity), processed in accordance with all the principles of the GDPR and managed/due in accordance with the provisions of the Code of Ethics.
The provision of data by the data subject is mandatory. Failure to provide it will result in the impossibility for the Professional to provide the requested service.
• personal data of a common nature (personal and identification data, payment data);
• data relating to state of health: personal data relating to physical and/or mental health collected during therapy, including through the request for assessments, examinations, diagnostic assessments, rehabilitation and any other type of professional service related to the execution of the assignment;
Professional reflections/assessment/interpretations translated into data by the Professional constitute the set of professional data (or data resulting from the processing and assessment of the Professional during their clinical activity), processed in accordance with all the principles of the GDPR and managed/due in accordance with the provisions of the Code of Ethics.
The provision of data by the data subject is mandatory. Failure to provide it will result in the impossibility for the Professional to provide the requested service.
Processing means
Personal data may be processed manually and/or electronically by the Professional. All the suitable security measures shall be used in order to guarantee the confidentiality, protection, security, integrity and accessibility of personal data in compliance with current regulations and professional secrecy. The information collected by the Professional during the professional relationship in the form of a therapy notebook, such as session notes, data and results of assessment tools, shall be stored in accordance with the provisions of the GDPR on the storage of special categories of data, in a secure manner and without third parties having access to it.
Communication and disclosure
Personal data may need to be made accessible
• as for personal, contact and payment data, to the Healthcare and/or Judicial Authorities based on specific legal obligations.
• as for data relating to health status, as a rule, only to the data subject and only in the presence of written consent of the data subject to third parties (Article 12 of the Code of Ethics). Any suitable means will be adopted to prevent unauthorised disclosure to third parties, including those present at the time of provision. It may be shared with the Medical Director and, in the event of legal obligations and/or explicit consent of the data subject where necessary, with national healthcare facilities/services/operators or other public authorities.
The data may also be disclosed to:
• any employees of the Professional specifically authorised for the processing (e.g. administrative staff, etc.);
• parties specifically appointed as Data Processors (for example, party responsible for the management and maintenance of computer systems, etc.);
• subject to specific consent, the data may be disclosed to Unobravo for the purpose of improving the services provided by it or verifying the quality of the support provided.
Where the professional perceives the need, they will make use of the comparison with their clinical supervisor, in turn a psychologist or psychotherapist, in order to improve and enhance the intervention. These supervisions, which may also be requested by the supervisor himself to monitor the quality and effectiveness of the therapies provided, as per the code of ethics, are covered by professional secrecy.
The information collected by the Professional during the professional relationship in the form of a therapy notebook will in no way be accessible to Unobravo.
• as for personal, contact and payment data, to the Healthcare and/or Judicial Authorities based on specific legal obligations.
• as for data relating to health status, as a rule, only to the data subject and only in the presence of written consent of the data subject to third parties (Article 12 of the Code of Ethics). Any suitable means will be adopted to prevent unauthorised disclosure to third parties, including those present at the time of provision. It may be shared with the Medical Director and, in the event of legal obligations and/or explicit consent of the data subject where necessary, with national healthcare facilities/services/operators or other public authorities.
The data may also be disclosed to:
• any employees of the Professional specifically authorised for the processing (e.g. administrative staff, etc.);
• parties specifically appointed as Data Processors (for example, party responsible for the management and maintenance of computer systems, etc.);
• subject to specific consent, the data may be disclosed to Unobravo for the purpose of improving the services provided by it or verifying the quality of the support provided.
Where the professional perceives the need, they will make use of the comparison with their clinical supervisor, in turn a psychologist or psychotherapist, in order to improve and enhance the intervention. These supervisions, which may also be requested by the supervisor himself to monitor the quality and effectiveness of the therapies provided, as per the code of ethics, are covered by professional secrecy.
The information collected by the Professional during the professional relationship in the form of a therapy notebook will in no way be accessible to Unobravo.
DATA TRANSFER OUTSIDE THE EU
The data will not be transferred abroad. Personal data will not be transferred abroad, to Countries or international Organisations not belonging to the European Union that do not guarantee an adequate level of protection, as recognised, pursuant to Article 45 GDPR, through an adequacy decision of the EU Commission. Where the Commission has not adopted any adequacy decision, the transfer will only take place in the presence of adequate guarantees pursuant to Article 46 of the GDPR or, in their absence, if one of the conditions indicated in Article 49 of the GDPR occurs.
Data storage time
The Company stores the User’s personal data only for the amount of time necessary to achieve the purposes for which they were collected or for any related legitimate purpose. In the event of the filing of any disputes pending the deadline, this deadline will be extended until the definition of the procedure in administrative or judicial proceedings with a non-appealable measure.
The storage times, in relation to the different purposes listed above, will be as follows:
• personal, contact and payment data: they will be required for the time necessary to manage the contractual/accounting and legal obligations;
• data relating to the state of health: they will be kept for the time necessary to carry out the assignment and to pursue the purposes of the same and in any case for a minimum period of 5 years (Article 17 of the Code of Ethics) and/or as required or permitted by current law.
Your personal data that are no longer needed, or for which there is no longer a legal requirement for its preservation, will be irreversibly anonymised or destroyed securely.
The information collected by the Professional during the professional relationship in the form of a therapy notebook, whether session notes, data and results of evaluation tools will be kept, also for legal and ethical reasons, for a period of five years after the end of the relationship.
The storage times, in relation to the different purposes listed above, will be as follows:
• personal, contact and payment data: they will be required for the time necessary to manage the contractual/accounting and legal obligations;
• data relating to the state of health: they will be kept for the time necessary to carry out the assignment and to pursue the purposes of the same and in any case for a minimum period of 5 years (Article 17 of the Code of Ethics) and/or as required or permitted by current law.
Your personal data that are no longer needed, or for which there is no longer a legal requirement for its preservation, will be irreversibly anonymised or destroyed securely.
The information collected by the Professional during the professional relationship in the form of a therapy notebook, whether session notes, data and results of evaluation tools will be kept, also for legal and ethical reasons, for a period of five years after the end of the relationship.
Rights of the data subject
Versione del 29/2/2024
When certain conditions persist, in relation to the specificities associated with the execution of the assignment, it will be possible for the data subject to exercise the rights referred to in Articles 15 to 22 of the GDPR (such as access to personal data as well as their rectification, deletion, limitation of processing, copying of personal data in a structured format commonly used and readable by an automatic device and the transmission of such data to another data controller). For the exercise of the aforementioned rights, the data subject may send the relevant request by email to the address: privacy@unobravo.com.
Finally, you have the right to lodge a complaint with the Guarantor for the protection of personal data.
Finally, you have the right to lodge a complaint with the Guarantor for the protection of personal data.