+39 06.50.13.817

Privacy Policy (GDPR)

This is a courtesy translation; in case of discrepancy, the Italian version prevails. Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, we explain how we process the personal data of patients and visitors of www.neabios.com.

1. Data controller

Dr Nihad Pljevljak – Nea Bios Dental Clinic
Via Cesare Pavese 135, 00144 Rome (RM), Italy
VAT No. 10311731003
Email: studio.neabios@gmail.com
Telephone: +39 06 501 3817

The controller has not appointed a Data Protection Officer (DPO), as this is not mandatory under Article 37 GDPR.

2. What data we process

  • Identification and contact data: first name, surname, tax code, date and place of birth, address, telephone number, email.
  • Health data (special categories, Art. 9 GDPR): medical history, diagnoses, treatments, X-rays, clinical photographs, reports and clinical records.
  • Administrative and tax data: estimates, payments, invoices.
  • Data sent through the website: the data you enter in the contact form (first name, surname, email, telephone, consents given and the page you are writing from).
  • Browsing data: IP address, date and time of the request, pages visited, browser and device type, logged by the server systems for security and operation.
  • Cookies and similar tools: as described in the Cookie Policy.

3. Purposes and legal bases

  • Dental services and care (diagnosis, treatment, clinical records, prescriptions, continuity of care): Art. 6(1)(b) and Art. 9(2)(h) GDPR.
  • Legal obligations (tax, accounting and healthcare obligations, transmission of expense data to the Italian Health Card System unless you object): Art. 6(1)(c) GDPR.
  • Replying to requests sent through the website, by email, telephone or WhatsApp, and managing appointments: Art. 6(1)(b) GDPR (pre-contractual steps at your request).
  • Website security and operation: Art. 6(1)(f) GDPR (legitimate interest in protecting the website against misuse).
  • Statistics and advertising measurement through non-technical cookies: Art. 6(1)(a) GDPR (consent given through the banner).
  • Promotional communications and telemarketing: Art. 6(1)(a) GDPR (optional consent given with the dedicated box in the form).
  • Establishment, exercise or defence of legal claims: Art. 6(1)(f) and Art. 9(2)(f) GDPR.

Providing the data needed for care and legal obligations is mandatory: without it we cannot provide our services. Consents for statistics, advertising measurement and marketing are optional and can be withdrawn at any time, with no effect on your care.

4. How data is processed

Data is processed on paper and electronically by authorised and trained staff, with appropriate technical and organisational measures (Art. 32 GDPR): restricted access, encrypted HTTPS connection, backups. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

5. Who we share data with

  • Clinic staff and collaborators authorised to process the data.
  • Healthcare professionals and dental laboratories involved in your treatment.
  • Providers acting as data processors (Art. 28 GDPR): website hosting (Aruba S.p.A., Italy), email service (Google Ireland Ltd), practice management software, accountant.
  • The AlfaDocs online booking platform, if you choose to book through the “Book Online” button: the data entered on the platform is also processed according to its own privacy notice.
  • Meta Platforms Ireland Ltd and Google Ireland Ltd, only for the cookies you have consented to (see the Cookie Policy).
  • Public bodies and authorities where required by law (Italian Revenue Agency, Health Card System, health and judicial authorities).

Data is never published. If you contact us via WhatsApp, the service is provided by WhatsApp Ireland Ltd under its own terms.

6. Transfers outside the EU

Health data and clinical records are stored in the European Union. Some providers (Google, Meta) may transfer data to the United States: transfers take place under the European Commission adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 or under standard contractual clauses (Arts. 45-46 GDPR).

7. How long we keep data

  • Clinical records and healthcare documentation: 10 years from the last treatment (ordinary limitation period, Art. 2946 of the Italian Civil Code), unless a longer period is required by law or for the defence of legal claims.
  • Tax and accounting documents: 10 years (Art. 2220 of the Italian Civil Code and tax law).
  • Requests sent through the website: until the request has been handled; a backup copy is kept on the server for 12 months and then automatically deleted. If you become a patient, the data becomes part of the clinic’s records.
  • Marketing data: until consent is withdrawn and in any case no longer than 24 months from the last contact.
  • Server browsing data: for the period set by the hosting provider for security purposes, unless needed to investigate offences.
  • Cookies: for the duration stated in the Cookie Policy.

8. Your rights

At any time you can exercise the rights provided by Arts. 15-22 GDPR: access to your data and clinical records, rectification, erasure (within the limits of retention obligations), restriction, portability, objection (including to the transmission of expense data to the Health Card System) and withdrawal of consent, without affecting the lawfulness of prior processing. You can change your cookie choices at any time through the “Cookie preferences” link at the bottom of the page.

To exercise them, write to studio.neabios@gmail.com, call +39 06 501 3817 or send a letter to Nea Bios Dental Clinic, Via Cesare Pavese 135, 00144 Rome, Italy. We reply within one month of the request (Art. 12 GDPR).

9. Complaints to the supervisory authority

If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, certified email protocollo@pec.gpdp.it.

10. Minors

The data of patients under 18 is provided and managed by the person exercising parental responsibility. The website contact form is intended for adults only.

11. Updates

This notice may be updated; the current version is always published on this page. Last updated: 20 October 2026.