Privacy Policy

Privacy Notice (pursuant to EU Regulation 2016/679, GDPR)

1. Data controller

The controller of personal data is KinAura Clinic S.r.l., with registered office at Viale Andrea Doria 48/A, 20124 Milan (MI), Italy, and operational office at Via Sant’Andrea 21, 20121 Milan (MI), Italy.
Email: info@kinauramed.com
PEC (certified email): kinauraclinic@legalmail.it
Tel: +39 392 5481654

2. Categories of data processed

KinAura processes several types of personal data, in particular:

• Identification and contact data (first name, surname, email, telephone, date of birth, address, etc.);
• Payment and billing data, for managing purchases of services and memberships;
• Health data, including clinical tests, medical reports, medical history, images and biometric data;
• Digital and browsing data, collected through the KinAura website and app (IP address, cookies, access logs, service usage data).

3. Purposes and legal bases of processing

Data are processed for the following purposes:

• a) Booking, provision and management of clinical, aesthetic and wellness services. Legal basis: performance of a contract or of pre-contractual measures.
• b) Administrative and accounting management (billing, payments, membership enrolment). Legal basis: compliance with legal and contractual obligations.
• c) Processing of health data to define personalised therapeutic protocols (AI Engine). Legal basis: explicit consent of the data subject.
• d) Clinical research, improvement of therapeutic protocols and algorithm development in anonymised or pseudonymised form. Legal basis: legitimate interest of the controller, in compliance with the data minimisation principle.
• e) Informational and promotional communications about KinAura events, services or news. Legal basis: consent of the data subject.
• f) IT security, audit and technical management of the digital platform. Legal basis: legitimate interest of the controller.

4. Methods of processing

Processing is carried out using electronic and paper tools, in compliance with the principles of lawfulness, fairness, transparency and data minimisation.
KinAura uses secure infrastructure and encryption protocols to protect information, including health information.
Data may also be processed through the KinAura AI Engine, an artificial intelligence engine that operates on deterministic and traceable logic, with clinically validated models and without automated decision-making that is not supervised by medical staff.

5. Data retention

Personal data are kept for as long as necessary to achieve the purposes stated above and, in any case:

• Health data: up to 10 years after the end of the relationship, as required by Italian healthcare regulations;
• Administrative and tax data: for 10 years, as required by law;
• Marketing data: until consent is withdrawn;
• Anonymised data for research and AI purposes: with no time limit, as they cannot be traced back to the data subject.

6. Disclosure and dissemination of data

Data may be disclosed to:

• Internal medical and paramedical staff or collaborators of KinAura Clinic;
• GDPR-compliant providers of IT, cloud and data-hosting services;
• Scientific and academic partners (e.g. Harvard Medical School, Imperial College London, IRCCS San Raffaele) for research activities in anonymised form;
• Insurance bodies or health authorities, where required by applicable law.

Data will not be made public, nor transferred to countries outside the EU without adequate safeguards (Art. 46 GDPR).

7. Rights of the data subject

The data subject may at any time exercise the rights provided for by Articles 15 to 22 of the GDPR:

• Access to the data and a copy of them;
• Rectification or updating;
• Erasure (“right to be forgotten”), within the limits permitted by law;
• Restriction of, or objection to, processing;
• Data portability;
• Withdrawal of consent;
• Lodging a complaint with the Italian Data Protection Authority, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).

To exercise these rights, you can send a written request to privacy@kinauramed.com or a PEC (certified email) to kinauraclinic@legalmail.it.

8. Data Protection Officer (DPO)

KinAura has appointed a Data Protection Officer (DPO), who can be contacted at: dpo@kinauramed.com

9. Cookies and tracking

The website uses technical cookies and, subject to consent, analytics and profiling cookies.
For more details, please see the Cookie Policy available in the dedicated section of the website.

10. Updates

KinAura reserves the right to update this notice periodically to comply with regulatory changes or improvements to its data processing.
The most recent version will always be available at www.kinauramed.com/privacy-policy, together with the date of the last update.

This English text is a translation of the Italian privacy notice. In case of discrepancy, the Italian version prevails.