DRAFT for review by an Italian privacy lawyer before launch. Replace every [bracket].
[Company name], [registered address], VAT [number], is the data controller. Contact: [email].
Contact details, date of birth, sex, height, weight, goals, answers to four yes/no safety questions, weekly check-in data, body measurements, optional progress photos, and blood-test values you choose to share.
To run your coaching membership (contract, Art. 6(1)(b) GDPR). Health data (weight, measurements, photos, blood values, safety answers) only with your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time. Marketing emails only if you opt in.
We compare your values only with the reference ranges printed by your laboratory. If a value is outside range, we ask you to see your GP or a specialist physician. We do not diagnose or give medical advice.
Google (Workspace: storage and email), Cloudflare (website hosting), Anthropic (AI assistance drafting coaching replies). Each acts under a data processing agreement. [Confirm data locations and transfer safeguards.]
Applications not accepted: deleted after 6 months. Members: deleted [12] months after membership ends (including maintenance), except accounting records kept as required by Italian law.
Access, correction, deletion, restriction, portability, objection, and withdrawal of consent: email [email]. You can complain to the Garante per la protezione dei dati personali (garanteprivacy.it).