Privacy Policy
Information on the Processing of Personal Data pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Swiss data protection legislation (nLPD)
Procrea Centro Fertilità Svizzera italiana SA considers the protection of the personal data of its existing and prospective patients to be of fundamental importance.
The purpose of this Privacy Policy is to provide the information required under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), as well as Swiss data protection legislation (nLPD).
Data Controller
The Data Controller is Procrea Centro Fertilità Svizzera italiana SA, with its registered office at Via Clemente Maraini 8, 6900 Lugano (Switzerland), which can be contacted at privacy@procrea.ch (the “Company” or the “Data Controller”). The Company processes the personal data of users accessing the website www.nextfertilityprocrea.ch (respectively, the “Users” and the “Website”) in accordance with the provisions set out below.
Categories of Personal Data and Methods of Collection
The data provided by Users will be processed in accordance with the principles of data minimisation and transparency and fall into the following categories:
Personal identification and contact data: First name, last name, mobile phone number, residential address and email address, voluntarily provided through:
completion of the contact form available on the Website;
social media channels associated with the Clinic, including Meta platforms.
Additional data and information voluntarily provided by Users through the contact form available on the Website, including any information concerning the health status of the User and/or a third party who has authorised the User to contact the Company, or concerning clinical or therapeutic needs voluntarily described by the User in the free-text fields of the contact form;
Browsing data, namely technical information automatically collected by the Website or by third-party applications used by the Website, which is necessary for the provision of web services (e.g. IP addresses, domain names of the computers used by Users to connect to the Website, and characteristics of the browser and operating system used). For further information on the processing of cookies or other tracking technologies, please refer to the Cookie Policy.
Certain personal data requested when using the Website are considered mandatory or necessary (e.g. identification data and email address when contacting the Company through the contact form available on the Website). Failure to provide such data may make it impossible to use the Website’s services.
Where the provision of data is optional (e.g. the content of messages and additional information entered in the contact form), failure to provide such data will not affect the availability or operation of the service.
Purposes and Legal Basis of Processing
1. Management of Information Requests and Initial Consultations Prior to the Provision of Assisted Reproduction Healthcare Services
Personal data will be processed to respond to Users’ requests concerning assisted reproduction healthcare services, arrange an initial consultation and/or provide information about the Clinic.
The legal basis for such processing is the performance of a contract to which the data subject is a party or the implementation of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) of the GDPR and Article 6 of the nLPD.
The provision of data for this purpose is not mandatory. However, without such data, the Company will be unable to respond to requests for information or establish or manage pre-contractual and contractual relationships with the User.
Where Users provide information concerning their health status through the online form, the legal basis for processing such data will be the explicit consent of the data subject, pursuant to Article 9(2)(a) of the GDPR and Article 6(7) of the nLPD. Such consent will be provided by selecting a dedicated checkbox at the bottom of the form.
At a subsequent stage, following the establishment of a contractual relationship with the User, the data provided may be processed by the Data Controller for the provision of the requested healthcare services and, more generally, for treatment, diagnosis and patient care purposes, pursuant to Article 9(2)(h) of the GDPR.
2. Compliance with Legal Obligations and Orders Issued by Competent Authorities
The data provided may be processed by the Data Controller to comply with obligations arising from European Union laws and regulations, as well as to respond to requests from judicial authorities, law enforcement agencies or other authorities to whose jurisdiction the Data Controller is subject.
The legal basis for such processing is compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR.
The provision of data for this purpose is necessary to enable the Data Controller to fulfil its legal obligations.
3. Improvement of Services Provided Through the Website
The data provided may be processed by the Data Controller for the development and improvement of the services made available through the Website, with the aim of ensuring that they are efficient and meet Users’ needs.
The legal basis for such processing is the legitimate interest of the Data Controller in providing a service that meets Users’ expected standards, pursuant to Article 6(1)(f) of the GDPR.
Methods of Processing
Personal data are processed using both automated and paper-based methods, with appropriate technical and organisational security measures in place to prevent data loss, unlawful or improper use, and unauthorised access.
Personal data will not be subject to fully automated decision-making processes or profiling activities.
Personal data relating to minors will be processed exclusively with the explicit consent of their parents or persons exercising parental responsibility or legal guardianship.
Data Retention
Personal data will be retained in accordance with the following criteria:
Data collected through the Website’s forms and data relating to requests for information that do not result in the provision of clinical care will be retained for the period strictly necessary to manage and respond to the request and, in any event, will be deleted or anonymised within 12 months of the last contact;
Data included in medical records and healthcare documentation in general will be retained for the periods required by applicable healthcare and civil legislation (normally at least 10 years);
Data processed to comply with legal obligations will be retained for the mandatory period established by applicable laws (e.g. 10 years for accounting and tax documentation).
Disclosure and Transfer of Personal Data
Personal data will not be disclosed indiscriminately, meaning that they will not be communicated to an undefined number of recipients.
However, personal data may be disclosed, to the extent strictly necessary for the purposes described above, to the following categories of recipients:
Other healthcare facilities, external analysis laboratories and other third parties carrying out analyses, examinations and the transport of biological samples;
IT service providers, hosting providers, web platform operators and system administrators appointed as Data Processors;
Public bodies, social security or insurance institutions, healthcare, judicial or supervisory authorities in Italy, Switzerland or other countries, for compliance with regulatory and legal obligations;
Law firms, commercial and tax advisory firms, medical-legal consultants, insurance companies and insurance brokers, banks and credit institutions, as well as other companies belonging to the same corporate group, for compliance with obligations imposed by applicable legislation or for the proper performance of the contractual relationship.
The entities belonging to the categories listed above will act either as Data Processors or as independent Data Controllers, depending on the circumstances.
For further information on the Data Processors engaged by the Data Controller, Users may send an email to the contact details provided in this Privacy Policy.
Employees, collaborators and healthcare professionals of the Data Controller or of facilities belonging to the same corporate group may also have access to personal data, provided that they have been duly authorised and instructed pursuant to Article 29 of the GDPR.
International Data Transfers
Personal data will be processed by the Data Controller at its registered office in Lugano (Switzerland), on servers located within the European Economic Area (EEA) or in Switzerland.
The transfer of personal data to Switzerland is fully authorised under European Commission Adequacy Decision 2000/518/EC, confirmed in January 2024, which establishes that Switzerland ensures a level of personal data protection equivalent to that provided within the European Union.
Should specific technical or operational requirements (e.g. the use of cloud service providers) make it necessary to transfer personal data to additional third countries outside the European Economic Area or Switzerland, the Data Controller ensures that such transfers will take place exclusively where an adequacy decision has been issued by the competent authority or following the execution of the Standard Contractual Clauses approved by the European Commission.
Exercise of Data Subject Rights
Data subjects may exercise the rights provided for under Articles 15–21 of the GDPR.
Right of access: Data subjects have the right to obtain confirmation as to whether their personal data are being processed and to receive information concerning the purposes of processing, the categories of personal data processed, the recipients of the data, and the retention period or the criteria used to determine it.
Right to rectification: Data subjects may request the correction or completion of inaccurate or incomplete personal data.
Right to erasure: Data subjects may request the deletion of their personal data where one of the conditions set out in Article 17 of the GDPR applies.
Right to restriction of processing: Data subjects may obtain restriction of processing in the circumstances provided for under Article 18 of the GDPR.
Right to data portability: Where processing is based on consent or a contract, data subjects may receive their personal data in a structured, commonly used and machine-readable format and request their transmission to another Data Controller without hindrance.
Right to object to processing: Data subjects may object at any time to the processing of their personal data on grounds relating to their particular situation. In such cases, unless overriding legal obligations or compelling legitimate grounds of the Data Controller apply, the personal data will no longer be processed.
Data subjects also retain the right to lodge a complaint with the competent supervisory authority (the Italian Data Protection Authority — Garante per la protezione dei dati personali — or the Federal Data Protection and Information Commissioner — FDPIC — in Switzerland).
Contact Details
Requests concerning the exercise of data subject rights may be addressed to:
Procrea Centro Fertilità Svizzera italiana SA
Via Clemente Maraini 8, 6900 Lugano – Switzerland
Email: privacy@procrea.ch
The Data Protection Officer (DPO) appointed by the Company pursuant to Article 37 of the GDPR and Article 10 of the nLPD may also be contacted at: dpo@procrea.ch
