Privacy

Last updated: 17 July 2026

Data controller

The data controller is Rosa Federica Nesci. VAT number 03848700799. For any request regarding the processing of personal data you can write to federicanesci88@gmail.com or call +39 320 415 3531.

Data processed

This website has no contact forms or accounts. The only form is the newsletter sign-up described in the dedicated section below, which collects an email address only. The only personal data processed is what a visitor voluntarily provides when reaching out via WhatsApp, phone or email to ask for information or request an appointment — for example name, contact details and, if the visitor chooses to share it, health information useful to assess or provide care.

Purposes and legal basis. If you choose to subscribe to the newsletter through the form on this website, we process your email address only: you are not asked for — and must not provide — any information about your health. The purpose is the periodic delivery of informational content on physiotherapy and wellbeing and notifications about new articles published on the website. The legal basis is your consent (art. 6(1)(a) GDPR), given by ticking the dedicated checkbox — never pre-ticked — at the time of sign-up and confirmed through a double opt-in mechanism: the subscription becomes effective only after you click the confirmation link you receive by email.

Service provider. Email delivery is handled by Brevo, which acts as a data processor under art. 28 GDPR on the basis of an agreement with the controller and stores data on servers located in the European Union. Your address is not shared with third parties or used for purposes other than sending the newsletter.

Retention and unsubscribing. You can unsubscribe at any time by clicking the link at the bottom of every email, or by writing to federicanesci88@gmail.com: unsubscribing is equivalent to withdrawing consent and results in your address being removed from the list. We keep the address until consent is withdrawn; proof of consent (date, time and method) is kept for as long as necessary to demonstrate the lawfulness of the processing, and in any case no longer than 24 months from unsubscribing. The rights listed under "Your rights" below continue to apply.

Cookies and tracking

This website uses Cloudflare Web Analytics, a statistics tool that measures a few navigation metrics in aggregated, anonymous form (for example the number of visits, most-viewed pages and the general source of traffic) without using cookies and without storing personal data or building user profiles. Loading the measurement script transmits some technical request data to Cloudflare (for example IP address and user agent), which is processed transiently and not used to identify visitors. No advertising or profiling trackers are used, and there are no third-party social media embeds. Fonts are self-hosted directly on this website: no request is sent to external services to load them.

Third-party services

If you choose to contact us on WhatsApp, the communication is handled by WhatsApp/Meta under its own WhatsApp privacy policy. The "Open in Google Maps" link on the Contact page opens Google Maps under Google's privacy policy. The website is hosted on Cloudflare, which also provides the aggregated statistics described above and processes the technical server logs necessary to run the website, under its Cloudflare privacy policy. For these operations Cloudflare acts as a data processor under art. 28 GDPR.

Data transfers outside the European Union

Some of the providers listed above (Cloudflare, WhatsApp/Meta) are based in the United States or may process data outside the European Economic Area. Such transfers rely on the safeguards provided by artt. 44–49 GDPR, in particular certification under the EU-US Data Privacy Framework and, where applicable, the standard contractual clauses approved by the European Commission.

Purposes and legal basis

Data provided voluntarily is processed to respond to enquiries and to provide the physiotherapy service requested (legal basis: consent and pre-contractual/contractual measures, art. 6(1)(a) and (b) GDPR). Any health data is processed exclusively for prevention, assessment and care purposes, insofar as necessary to provide physiotherapy services by a health professional subject to professional secrecy (art. 9(2)(h) and 9(3) GDPR). Where processing is not necessary for those purposes, it is based on the data subject's explicit consent (art. 9(2)(a) GDPR). Aggregated navigation statistics and technical server logs are processed to keep the website running, secure and improving, on the basis of the controller's legitimate interest (art. 6(1)(f) GDPR). Data is not used for marketing purposes, with the exception of the newsletter, for which a specific, revocable consent is collected (see the 'Newsletter' section), and is not sold or shared with third parties for commercial purposes.

Retention

Data is kept only for as long as necessary to manage the care relationship and to comply with legal obligations: in particular, accounting and tax records are kept for ten years (art. 2220 of the Italian Civil Code) and any healthcare documentation for the period required by the applicable regulations and professional guidelines. After these periods, data is deleted or anonymised. Navigation statistics are kept by Cloudflare exclusively in aggregated, anonymous form.

Your rights

As a data subject you have the right to access, rectify, erase, restrict, port and object to the processing of your data (artt. 15–22 GDPR). Where processing is based on consent, you also have the right to withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal. Finally, you have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali). To exercise these rights you can contact the data controller at federicanesci88@gmail.com.