Privacy notice

The data controller is Dott. Matteo Cuccovillo, physiotherapist, with practice at Piazzale G. Marconi 21, 95039 Trecastagni (CT), VAT no. 06243330872 ("Motus Rx" or "the Controller"). You can contact the Controller about any privacy matter at info@motusrx.it.

Data you give us through the appointment request form. Required: full name and mobile number, the only data needed to contact you. Optional: email address, how you heard about the clinic, preferred day and time of day and a short description of your problem.

The description of your problem may contain health data, which the GDPR treats as a "special category of data" (art. 9). It is optional and we only process it with your explicit consent, given through the dedicated box. Please only include strictly necessary information: everything else will be discussed during the visit.

Browsing data: the website is hosted by Cloudflare, whose servers log data such as IP address, browser type and requested pages for technical and security reasons, kept for a limited time. The website also counts clicks on the main buttons (e.g. "Call", "WhatsApp" or "Book") anonymously: it records only the action and the page it started from, with no IP address, no identifiers and never any data typed into forms.

We do not collect data from children under 14 without the consent of a parent or guardian: for minors, the request must be sent by a parent or guardian.

Managing your appointment request: contacting you, agreeing on day and time and sending confirmation. Legal basis: pre-contractual steps taken at your request (art. 6.1.b GDPR) and, only for any health data written in the description, your explicit consent (art. 9.2.a GDPR), given through the dedicated box. Without that consent you can still send the request leaving the description empty.

Anonymous website statistics, to improve the site. Legal basis: legitimate interest (art. 6.1.f GDPR); data are anonymous and aggregated.

Website security and abuse prevention (e.g. automated requests or spam). The request form may use Cloudflare Turnstile, an anti-spam check that examines technical data about the browser and connection (such as IP address and browser type) to tell people from automated programs, without reading what you type in the form. Legal basis: legitimate interest (art. 6.1.f GDPR).

Compliance with legal obligations, e.g. tax obligations, if you become a patient (art. 6.1.c GDPR).

If you start treatment at the clinic, health data collected during visits will be processed for diagnosis and care under professional secrecy (art. 9.2.h GDPR), as described in the notice you will receive at the clinic.

Only name, mobile number and confirming you have read this notice are required: without them we cannot contact you. All other fields are optional. You can always book by phone as well.

Data are processed electronically with appropriate technical and organisational measures: encrypted connection (HTTPS), access restricted to the Controller and strictly necessary providers, no health data stored in the website's technical logs. We do not carry out profiling or automated decision-making.

Data are never disclosed publicly or sold. The following providers, acting as processors (art. 28 GDPR), may access them, only as needed:

Cloudflare, Inc. hosts the website: delivery network, images, technical logs, statistics and, when active, the form's anti-spam check. While the old address motus-sito.vercel.app remains active, a copy of the website is also hosted by Vercel Inc. If the practice management system does not respond, Cloudflare keeps the appointment request in a queue in the European Union, only to forward it as soon as possible: the request is deleted within 7 days and Cloudflare's technical copies expire within 30 days.

Appointment requests reach the clinic's practice management system (PhysioMind), whose data are stored by Supabase in data centres in the European Union (Ireland).

To reply, the clinic may use phone, WhatsApp or email. WhatsApp messages go through Meta's WhatsApp Business service; the clinic's automatic emails, when active, go through the Resend sending service (United States). The clinic is alerted to a new request in its practice management system and, if it turns them on, also by WhatsApp or email: the alert contains your name, your preferred time and, if the clinic chooses, your phone number, never the description of the problem.

Requests sent through the website are not processed by artificial intelligence systems. If you become a patient, the notice you receive from the clinic applies to your clinical records.

If you choose to message us on WhatsApp or open the Google map from the website, those services (Meta and Google) process data as independent controllers under their own privacy notices. Cloudflare also uses the technical data of the anti-spam check as an independent controller, to improve its detection of automated programs.

Some providers are based in the United States or may process data outside the European Union (e.g. Cloudflare, Resend and Meta for WhatsApp). Transfers rely on standard contractual clauses approved by the European Commission or, for providers that have joined it, on the EU-U.S. Data Privacy Framework adequacy decision.

Appointment requests that do not lead to treatment are deleted within 12 months of being sent.

If you become a patient, health and tax records are kept for the period required by law (usually 10 years).

Website statistics and click counts are anonymous and aggregated; server technical logs are kept briefly, for security purposes only.

At any time you can request access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest (arts. 15-22 GDPR).

You can withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To exercise your rights write at info@motusrx.it: we will reply within 30 days.

If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

This notice may be updated, for example if the services used by the website change. The current version is always published on this page, with the date of the last update.