Privacy notice
2026-10-28-site-2
Information under Article 13 of Regulation (EU) 2016/679 (GDPR). BMT STP SRL processes personal data lawfully, fairly and transparently, respecting confidentiality. This notice covers the MIRP website and general information enquiries. The online questionnaire is inactive and does not collect health information.
Controller and contacts
The controller is BMT STP SRL, C.so Cavallotti 22, 18038 Sanremo (IM), Italy. For MIRP enquiries: info@mirprehab.com. To exercise your rights, you may also contact info@ambulatoriofisiomed.it or send a registered letter to the office. The Data Protection Officer (DPO) is Fulvio Benedetti: address correspondence to his attention at the office or ask the controller for his direct contact details.
Data and purposes
During browsing, the infrastructure processes technical information needed to deliver pages and protect the service, such as IP address, request time and browser information. If you contact us using your email application, we receive your email address, name and message to answer your enquiry. Please send general information only at this stage, without medical reports, diagnoses, identity documents or other people’s health information.
Legal grounds
We handle MIRP enquiries to respond to your questions and any pre-contractual steps you request (GDPR Article 6(1)(b)). Website delivery and security rely on the legitimate interest in providing and protecting the service (Article 6(1)(f)), respecting visitors’ rights. We do not use these contacts for newsletters, profiling or advertising. Participation decisions are not made automatically.
Access and providers
Messages are handled by authorised BMT STP SRL staff and collaborators, including Davide Azzalin for MIRP enquiries within his role. The website is hosted through OpenAI Sites, using Cloudflare delivery infrastructure. Domain email is managed through OVHcloud. Providers process technical information needed for their services. The Google spreadsheet and Apps Script testing setup receive no visitor information from this version.
Retention and transfers
Enquiries closed without starting a programme are kept for six months after closure, except for documented legal obligations or protection of rights. Infrastructure data follows the hosting service’s retention periods and criteria for delivery, security and applicable obligations; we do not state an unverified numerical period. Technology services may involve processing outside the EEA: we do not promise exclusively European storage. You may ask the controller for information on recipients, applicable safeguards and how to obtain a copy.
Choice and future participation
Contacting us is optional; without contact details we cannot reply. You do not need to complete a questionnaire to visit this website. Specific information and any required consent will be provided before health-data collection is activated. For children or represented persons, contact us first without health information to arrange an appropriate method.
Your rights
You may request access, correction, erasure, restriction and, where applicable, portability; object to processing based on legitimate interests; and withdraw consent. Contact info@mirprehab.com. We normally respond within one month, subject to justified GDPR extensions. You may complain to the authority where you habitually reside, work or where the alleged infringement occurred: Garante in Italy, IMY in Sweden or Datatilsynet in Denmark.
How data is handled
Enquiries are handled electronically and, where correspondence requires it, on paper, with access limited to authorised persons and appropriate safeguards. Healthcare, contractual, tax and accounting obligations relating to a subsequent programme will be described in its specific notice, with the relevant recipients and retention periods.
Health information and healthcare
Health information is a special category of personal data. This website notice does not replace the notice for any subsequent healthcare programme. Processing necessary for diagnosis, care or treatment by or under the responsibility of professionals bound by professional secrecy may rely on GDPR Articles 9(2)(h) and 9(3), without requiring data-protection consent for that care. Other processing requires an appropriate legal basis. Before any questionnaire collection starts, we will provide specific information about the preliminary enquiry and the explicit consent envisaged for that purpose.
Marketing and market research
The MIRP website does not use received contacts for market research, satisfaction surveys, profiling or promotional messages. Any future initiatives will have dedicated information and, where required, freely given, specific consent separate from enquiries and healthcare. Refusing marketing does not affect access to information or care.