Privacy notice

1. Who is responsible for your data

The data controller is Dr. Giovanni De Flaviis, Nutritionist Biologist and Kinesiologist, working as a self-employed professional in Italy.

• Registered office: Via Giovanni Iannucci 32, 65013 Città Sant'Angelo (PE), Italy
• VAT number: 02469650689 — Tax code: DFLGNN94P14A488Z
• Professional register: Ordine dei Biologi del Lazio e dell'Abruzzo n. AA_100637
• Email: nutrizionista@giovannideflaviis.it
• Phone: +39 388 759 4145

No Data Protection Officer has been appointed, as this activity does not require one. For anything about your data, write to the email address above.

2. The website and the practice are two different things

The website is a shop window: it lets you read what I do and send me a request for an appointment. It does not collect any information about your health, it has no online booking system, no patient area and no way to upload test results or medical reports.

Health information is collected only in person, during a consultation, and is handled under professional secrecy. Sections 3 and 4 describe the two situations one at a time.

3. What this website collects

The contact form. It asks for your full name, phone number, email address, the type of appointment you are asking for (first consultation or check-up) and the time of day you would prefer (morning, afternoon or no preference). That is all. There is no free-text field, and the form deliberately does not ask anything about your health: please do not write health information in it — we talk about that in person.

The WhatsApp button. If you use it instead of the form, your messaging app opens with a message already written, containing only what you typed in the form. The conversation then takes place on WhatsApp (see section 7).

Technical logs. The provider that keeps the site online records the usual technical information about visits — IP address, date and time, pages requested, type of browser and device — to keep the site available and to defend it from attacks and abuse.

There is no newsletter, no registration area, no advertising and no tracking of your behaviour on the site.

4. Health data, collected in the practice

Health data is a special category of personal data under Article 9 of the GDPR and is treated accordingly. It is collected during the consultation, not through this website. Depending on the programme, it may include:

• your clinical, family, nutritional and sporting history
• anthropometric measurements and body composition data (circumferences, BIA/BIVA)
• blood test results or other documents you choose to show me
• the nutrition plan and the notes from your follow-up appointments

The legal basis is Article 9(2)(h) of the GDPR — preventive medicine and the provision of health care by a professional bound by professional secrecy — together with Article 6(1)(b), because the data is needed to carry out the service you asked for. The purpose is your care: nothing else.

Minors. When the person I follow is a minor, the appointment is arranged and the data is processed with the consent of whoever holds parental responsibility, who can exercise all the rights listed in section 9 on the child's behalf.

Health data is never published, never used to promote anything, and never shared for commercial purposes.

5. Why your data is processed, and on what legal basis

• To answer your request and arrange an appointment — your consent, which you tick when you send the form (Article 6(1)(a)), and the steps taken at your request before entering into a contract (Article 6(1)(b)). You can withdraw your consent at any time, which does not affect what was lawfully done before.
• To provide the professional service — performance of the agreement between us (Article 6(1)(b)) and, for health data, Article 9(2)(h).
• To issue invoices and meet accounting and tax obligations — a legal obligation (Article 6(1)(c)).
• To keep the site online, safe and working — my legitimate interest in the security and availability of the site (Article 6(1)(f)).

6. How long your data is kept

Data is kept only for as long as it is needed for the purpose it was collected for. Requests that do not lead to an appointment are deleted once it is clear that there will be no follow-up. Clinical documentation is kept for as long as my professional obligations require. Invoices and accounting records are kept for ten years, as required by Italian law (Article 2220 of the Civil Code). Technical logs are kept by the hosting provider for a short period, for security purposes only.

to confirm The exact retention periods for contact requests and for clinical records still have to be confirmed by the professional before this notice goes live.

7. Who else sees your data

Your data is not sold, not exchanged and not shared with advertising networks. It is seen only by:

• the hosting provider that keeps the website and the mailbox online — Hostingerhosting to confirm, acting as a data processor;
• my accountant, Massimo Gasbarri, for invoicing and tax obligations;
• Hive Digital Studio di Boris Mazza, the agency that built and maintains this website, appointed as a data processor under Article 28 of the GDPR;
• public authorities, where the law requires it.

If you write on WhatsApp. That conversation happens on a service run by Meta, under its own privacy policy and its own terms, which I do not control. I use the message only to reply to you and to arrange the appointment. Please do not send health information, test results or medical documents through WhatsApp.

8. Where your data is, and what is not done with it

The website and the mailbox are hosted on servers located in the European Union, and no transfer of your data outside the EU is planned. The exception is WhatsApp, described above: that is a service you choose to use, and it has its own rules.

Your data is not used for profiling, and no decision concerning you is taken by automated means. Every decision about your programme is taken by me, in person.

9. Your rights

Under Articles 15 to 22 of the GDPR you can ask me at any time to:

• know what data I hold about you and get a copy of it (access);
• correct data that is wrong or incomplete (rectification);
• delete data that is no longer needed (erasure);
• limit how the data is used while a request of yours is being examined (restriction);
• receive the data you gave me in a readable file, or have it sent to someone else (portability);
• object to a processing based on my legitimate interest;
• withdraw a consent you had given.

Write to nutrizionista@giovannideflaviis.it. You will get an answer within one month. Some rights have limits: data I have to keep to meet a legal or professional obligation — clinical records and invoices, for instance — cannot be deleted on request until that obligation has run its course.

If you believe your data has been handled incorrectly, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or bring the matter before a court.

Changes to this notice

If the way data is handled changes — a new service, a different supplier, statistics being switched on — this page is updated and the date below changes with it. It is worth checking it now and then.

Last updated: 2 September 2026.