WhatsAppinfo@ri-hub.it

Privacy Policy

Information notice pursuant to Articles 13–14 of EU Regulation 2016/679 (GDPR). Last revision: 16 October 2026.

1. Data Controller

The Data Controller is Ri-Hub S.r.l. Società tra Professionisti, with registered office in Italy. To exercise the rights granted by the GDPR and for any enquiry, please write to privacy@ri-hub.it.

Data Protection Officer (DPO). The appointment of a data protection officer (Art. 37 GDPR) is under assessment with our lawyer. In the meantime, for any question about your data write to privacy@ri-hub.it: the data controller will answer you directly.

Legal identification: Ri-Hub S.r.l. Società tra Professionisti — Registered office: Corso Assarotti 19/1, 16043 Chiavari (GE), Italy — VAT/Tax ID (P.IVA/C.F.): 02992670998 — REA GE-525421 — Share capital: €10,000 fully paid up — PEC: ri-hub@pec.it

2. Processing of health data (Article 9 GDPR)

Ri-Hub is an online physiotherapy platform: when you use the service we collect and process data concerning health (special category under Article 9 GDPR), in particular: answers to medical history questionnaires, pain levels, descriptions of symptoms, therapeutic objectives and treatment plans. Video consultations are delivered in real time and are not recorded or retained in any audio or video form.

Legal bases. We process data about your health to treat you (assessment, sessions, treatment plan, messages with the physiotherapist) because it is necessary for the healthcare service you ask us for, under the responsibility of professionals bound by professional secrecy (Art. 9(2)(h) and 9(3) GDPR). For this processing, as indicated by the Italian Data Protection Authority (decision no. 55 of 7 March 2019), we do not ask for your privacy consent: the informed consent you sign before the sessions concerns your choice to be treated, not the use of data. Any use of data that is not needed to treat you, for example the measurement of advertising campaigns described in § 5.2, takes place only with your explicit and separate consent (Art. 9(2)(a) GDPR), which is optional and can be withdrawn at any time, with no consequence for your care. Without the data needed for care, the service cannot be provided.

Telemedicine. Online sessions follow the Italian National guidelines for the provision of telemedicine services (State-Regions Agreement of 17 December 2020) and the decree of the Minister of Health of 21 September 2022 (guidelines for telemedicine services). For the processing of health data we follow the Italian Data Protection Authority's decision no. 55 of 7 March 2019.

Prohibition of disclosure and secondary use. Health data are processed exclusively for the purposes of care, diagnosis and management of the individual patient's rehabilitation pathway. Ri-Hub does NOT disclose, transfer, sell or communicate health data to third parties other than the expressly authorised parties listed in § 6 (assigned physiotherapist and technology providers appointed as Data Processors). Clinical content (medical history, pain, symptoms, treatment plans, sessions, messages) is never used for advertising, profiling or marketing purposes. To measure our advertising we use only, and only with your explicit and separate consent, the fact that you booked or attended the visit and your first purchase, communicated to Google Ads as described in § 5.2.

Where the data are. The health data we keep (questionnaires, records, treatment plans, messages) are stored on cloud infrastructure in the European Economic Area (EEA), with encryption both in transit (TLS 1.3) and at rest. The audio and video of video sessions, on the other hand, pass in real time through the servers of the video-call providers, companies based in the United States (§ 6): they are not recorded or stored, but a transfer of these data outside the EU cannot be ruled out. The other non-EU providers (for example Stripe for payments) process only administrative and accounting data, never health data, on the basis of the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).

Professional secrecy. The physiotherapists who access health data are registered with the professional Register and bound by professional secrecy pursuant to Art. 622 of the Italian Criminal Code, Art. 200 of the Italian Code of Criminal Procedure and the professional Code of Conduct. Access to health data is restricted to the assigned patient only (data minimisation principle, Art. 5(1)(c) GDPR) and tracked in immutable audit logs.

Pseudonymisation and minimisation. Where technically feasible, health data are pseudonymised or encrypted at the application level. Aggregate statistics for internal use or for partner clinics/companies are provided exclusively in anonymous and aggregate form, with no possibility of re-identifying the individual patient.

3. Categories of personal data processed

  • Identification data: first name, surname, tax code, date of birth, address, contact details.
  • Identity documents (image).
  • Authentication credentials: email, hashed password, Google token if accessed via OAuth.
  • Health data: medical history, pain, symptoms, treatment plans, results of assessment questionnaires. Video sessions are not recorded.
  • Payment data: handled by the Stripe provider (we do not store card details).
  • Technical data: IP address, access logs, device identifiers (if Capacitor is installed).
  • Usage data (pages viewed, buttons pressed), linked to a random browser identifier: only if you have accepted analytics cookies.
  • Advertising source data: source, campaign and click identifiers (e.g. gclid, fbclid) from the ri_utm cookie (§ 5.4).
  • Google ad click code, for ad campaign measurement: gclid, gbraid or wbraid, sent to Google Ads only if you arrive from one of its ads and have given the explicit consent described at § 5.2. Never email, phone, name or health data.

4. Purposes of processing

  • Provision of the online physiotherapy service (basis: contract; for health data, the purpose of care under professional secrecy, Art. 9(2)(h) and 9(3) GDPR, § 2).
  • Administrative and accounting management (basis: legal obligation).
  • App security, fraud prevention and diagnostics (basis: legitimate interest).
  • Service communications and notifications relating to appointments (basis: contract).
  • Marketing and newsletter only if you have given separate consent at registration (basis: consent, revocable at any time).
  • Usage statistics for the website and the app (analytics) only if you have accepted analytics cookies (basis: consent, which can be withdrawn at any time from the “Manage cookies” link).
  • Measuring visits to the pages of the website that do not talk about health through the Meta and TikTok pixels, only if you have accepted the "Marketing" category in the cookie banner (basis: consent, revocable from the “Manage cookies” link — § 5.1). We send no event to the pixels from the app.
  • Server-side measurement, towards Google Ads, of the booking and completion of the free consultation and of the first purchase, only if you arrive from a Google ad and have given the explicit, optional consent in the app (basis: consent, including explicit consent under Art. 9 — § 5.2).
  • Aggregate, anonymous internal statistics on visits to the site and the app, to know where people come from (no consent required, not a processing of personal data — § 5.3).

5. Advertising and measurement of advertising campaigns

This section explains, separately from our Cookie Policy, which tools we use to understand whether our advertising works: with what consent, what we send and to whom. For the list of individual cookies (name, duration) see the Cookie Policy.

5.1 Meta and TikTok pixels on the website (only with "Marketing" consent from the banner, and only on pages that do not talk about health)

On the ri-hub.it website we load the Meta pixel (Meta Platforms Ireland Ltd.) and the TikTok pixel (TikTok Technology Limited) only if you have accepted the "Marketing" category in the cookie banner and only on pages that do not talk about health: the home page, about us, how it works, formats and prices, work with us, contacts and the legal pages. From these pages we send the pixel only the page visit, no other event; from pages that talk about health (articles, conditions, exercises, services, creator pages and all the others) nothing is sent to Meta or TikTok. If you choose "Necessary only", or exclude Marketing when customising your choice, the pixels do not load. From the app we send no event to the pixels of Meta, TikTok or Google, not even the page visit, and the website does not use the Google Ads pixel. The pixels serve exclusively to measure the effectiveness of our advertising: we do not use them to show you personalised third-party advertising, nor to profile you for purposes other than measurement.

Legal basis: your consent (Art. 6(1)(a) GDPR), freely revocable at any time from the “Manage cookies” link at the bottom of every page, without affecting the lawfulness of what was measured before withdrawal. Non-EU transfers: Meta also processes these data in the United States on the basis of the EU-US Data Privacy Framework; TikTok on the basis of the Standard Contractual Clauses (Art. 46 GDPR), but the data collected by its pixel may also be accessed from China (§ 6).

5.2 Server-side measurement towards Google Ads (specific, optional consent given in the app)

For three moments that really matter — the booking of the free consultation, the consultation actually carried out and the first purchase — our server can report the fact to Google Ads (Google Ireland Limited), so the platform understands which ads lead to real outcomes and not just to a click. We only do this when both conditions are met: you came to us through a click on a Google ad (no more than 90 days earlier) and you have given an explicit, specific and optional consent in the app — a checkbox, not pre-ticked, at registration (or in the initial questionnaire), or a switch you can turn on or off at any time from the app's privacy settings — distinct from the cookie consent. If you did not arrive from a Google ad, we send nothing, even if you gave your consent. Meta and TikTok receive no event from our server.

What we send (only the minimum necessary): the click code of the Google ad that brought you to us (gclid, gbraid or wbraid: a code created by Google for that click, used to link the event to the ad); which of the three moments the event refers to; the date and time; a random code used only to avoid counting the same event twice; for the first purchase, the amount paid (for the completed visit we use a fixed conventional value, the same for everyone). We also tell Google that these data may not be used for personalised advertising. We never send: your name, your email or your phone number (not even encrypted), your IP address, data about your health, the content of sessions or messages. Child profiles (Ri-Hub Junior) never generate these events, regardless of the consent on the parent's account.

Legal basis. The processing is based on your consent (Art. 6(1)(a) GDPR); and since the mere fact that you booked or attended a visit at a physiotherapy platform can in itself reveal information about your health, we also rely on the explicit consent required for special categories of data (Art. 9(2)(a) GDPR). You can withdraw this consent at any time from the app's privacy settings: from that moment no new event is sent, and any event already awaiting delivery is cancelled.

Retention of delivery logs. We take the click code, at the time of sending, from the source saved with your account (§ 5.4). An event that cannot be sent within 6 days is cancelled. The record of what was sent — platform, event type, date, outcome, which fields were sent (never the values) — is kept to be able to demonstrate that delivery took place in line with the consent given, with the same retention as the account data indicated at § 9.

5.3 Anonymous visit counter (no consent required)

We also keep an internal counter of visits to the site and the app, to know how many people arrive, from which channel and which campaign, without identifying anyone: no cookie, no IP address stored, no personal or device identifier. We only count aggregate numbers per day (Rome time zone), by site, channel, campaign, ad and page type — for example "230 visits from campaign X on Tuesday". The IP address is used only for an instant, to compute a technical fingerprint that prevents an abnormal flood of requests from being counted more than once, and it is never stored. As this is not a processing of personal data, this counter does not require consent: its purpose is purely statistical and internal to Ri-Hub.

5.4 Where you come from (the ri_utm cookie)

When you arrive from an ad or from a link with campaign parameters, we remember the source, medium, campaign and click identifiers (for example gclid, fbclid, ttclid) of your arrival. Only if you have accepted the Analytics or Marketing category in the cookie banner do we save them, for a maximum of 90 days, in a first-party cookie called ri_utm, shared between ri-hub.it and app.ri-hub.it; without consent they are kept only for the length of your visit, in the memory of the browser tab, and never become a cookie. If you withdraw both consents, the cookie is deleted. This rule applies both on the website and in the app. We use it to know which advertising channel brought you to us, even if you register or book days later. When you register or book, the source of your visit is saved together with your account, for our internal statistics on which channels work; Google Ads receives only the click code, and only under the conditions of § 5.2.

6. Recipients and external processors

All the parties listed below are appointed as Data Processors under Art. 28 GDPR by a specific contract. No party outside this list has access to your data. Stored health data are accessible exclusively to the assigned physiotherapist; the video-call providers carry the audio and video of the sessions in real time without storing them; all other providers process strictly technical or administrative data.

  • Partner physiotherapists: access the health data of the assigned patient only in order to deliver the service. Registered with the professional Register and bound by professional secrecy under Art. 622 of the Italian Criminal Code. No physiotherapist may view data of patients not assigned to them.
  • EU cloud hosting (data centres located in the European Economic Area): application infrastructure and database, where health data are stored. TLS encryption in transit and encryption at rest on the volumes.
  • Stripe (Ireland + USA): payment processing. Processes administrative data only (amount, email, billing details). Never health data. Any non-EU transfer is based on Standard Contractual Clauses under Art. 46 GDPR.
  • Google LLC: only if you sign in with your Google account (OAuth limited to email + profile) or if the physiotherapist has enabled synchronisation of their own Google Calendar (scope calendar.events, read/write limited to events created by Ri-Hub). Never patient health data. Non-EU transfer based on Standard Contractual Clauses.
  • PostHog (EU cloud, eu.i.posthog.com): usage statistics for the website and the app, linked to a random browser identifier, only after the “Analytics” consent in the cookie banner. Session replay switched off; we ask for the IP address not to be saved in events. Never health data.
  • Brevo (Sendinblue): sending of transactional emails and newsletters. EU servers. Processes only email + name.
  • LiveKit (LiveKit, Inc., USA, LiveKit Cloud service): today it is the main provider of video sessions. Its servers relay the audio and video between physiotherapist and patient in real time, encrypted in transit, normally through the server closest to the participants. Video sessions are NOT recorded or stored.
  • Twilio (Twilio Inc., USA): backup video sessions with Twilio Video, when the monthly traffic included in our LiveKit plan runs out, with the same safeguards (encryption in transit, no recording); sending of service WhatsApp messages, for example appointment reminders. LiveKit and Twilio are based in the United States: we cannot rule out that audio, video and technical data of the sessions pass through or are accessible from there. We are checking with both the server region and the safeguards for the transfer (Data Privacy Framework or Standard Contractual Clauses, Art. 45–46 GDPR).
  • Apple Inc. (USA): only if you sign in with your Apple ID via "Sign in with Apple". Processes only the Apple identifier + email (optional anonymous relay). Never health data. Non-EU transfer based on SCC.
  • Firebase Cloud Messaging (Google LLC, USA): for push notifications on the Android and iOS app. Processes only an opaque device token. Never health data in the payload. Non-EU transfer based on SCC.
  • MinIO (self-hosted object storage, EU region): retention of signed informed-consent documents (PDF + ID card front/back). Internal Ri-Hub servers, access restricted to authorised technical staff only and to the assigned physiotherapist. Volume-level at-rest encryption.
  • Ri-Hub internal CRM (self-hosted EU server, domain crm.ri-hub.it): patient-record management system accessible only to Ri-Hub clinical/administrative staff bound by professional secrecy and confidentiality agreements. Receives automatic event sync: registration, scheduled anamnesis, signed consent, session purchases, completed sessions.
  • Calendly (USA): only if the physiotherapist has connected their Calendly account to synchronise availability outside Ri-Hub. Processes only slot metadata (dates/times), no clinical data. Non-EU transfer based on SCC.
  • Google Analytics 4 (Google LLC, USA): aggregate usage metrics only after explicit consent through the cookie banner. IP anonymised, ad personalisation disabled by default. Never health data. SCC.
  • Ahrefs Web Analytics (Ahrefs Pte. Ltd., Singapore): counts visits to the website's pages and where they come from, only after the “Analytics” consent in the cookie banner. In our checks it writes no cookies on the device, but it receives the technical data of the visit (page, referring site, IP address). Never health data. Non-EU transfer based on Standard Contractual Clauses (Art. 46 GDPR).
  • Meta Platforms Ireland Ltd. (Ireland + USA): advertising pixel on the website, only with "Marketing" consent from the cookie banner and only on pages that do not talk about health, from which it receives only the page visit. Measures the effectiveness of advertising on Facebook and Instagram. Receives no event from the app or from our server (§ 5.1, § 5.2). Never health data. Non-EU transfer based on the EU-US Data Privacy Framework.
  • TikTok Technology Limited (Ireland): advertising pixel on the website, only with “Marketing” consent from the cookie banner and only on pages that do not talk about health, from which it receives only the page visit. Receives no event from the app or from our server (§ 5.1, § 5.2). Never health data. Non-EU transfer based on Standard Contractual Clauses; the data may also be accessed from China, by staff of the TikTok group: in May 2025 the Irish data protection authority (Data Protection Commission) fined TikTok 530 million euros precisely for these transfers.
  • Google Ireland Limited — Google Ads: only for people who arrive from a Google ad and have given the explicit, optional consent in the app, receives from our server the events of free-visit booking, visit completed and first purchase: the ad click code (gclid, gbraid or wbraid), the event type, the date and, for the completed visit and the first purchase, a value in euros; never email, phone, name, health data or the content of sessions and messages. The website does not use the Google Ads pixel and the app sends it no events. Non-EU transfer based on the EU-US Data Privacy Framework. Details: § 5.2.

7. Google API Services User Data — specific disclosure

This section is provided to comply with the Google API Services User Data Policy and the Google APIs Terms of Service.

Important — who is concerned. The Google API integration is an opt-in feature available exclusively to physiotherapists partnering with Ri-Hub, who can choose to synchronise the appointments managed through the app onto their own Google Calendar. Patients do NOT use any Google API in the context of the service: patient authentication happens via email/password or "Sign in with Apple". If you are a patient, this section does not apply to your use of the service.

7.1 Google data accessed by Ri-Hub ("Data Accessed")

When a physiotherapist runs the Google OAuth flow inside Ri-Hub, the app requests only the minimum scopes strictly necessary for the feature being enabled. No other scope is ever requested.

  • Physiotherapist's Google identity: scope https://www.googleapis.com/auth/userinfo.email. Ri-Hub receives from Google only the verified email address, used to associate the integration with the physiotherapist's existing Ri-Hub account.
  • Google Calendar sync: scope https://www.googleapis.com/auth/calendar.events. Ri-Hub reads and writes only the events created and managed by the app itself. We do NOT request the full calendar scope nor calendar.readonly: the rest of the physiotherapist's calendar remains completely invisible to Ri-Hub.

Ri-Hub NEVER accesses: Gmail content, Drive/Docs, Photos, Contacts, search history, location, YouTube or any other Google service.

7.2 How Ri-Hub uses Google data ("Data Usage")

  • Google email: solely to associate the Calendar integration with the correct physiotherapist account in Ri-Hub. No other use. Never used for profiling nor for training AI/ML models.
  • Google Calendar events: to write on the physiotherapist's calendar the appointments confirmed with patients through Ri-Hub (each event is created as "Ri-Hub: Session with [Patient]"); to read back only the events previously created by Ri-Hub, in order to detect cancellations or edits made directly by the physiotherapist on Google Calendar and keep the app's availability in sync. Each Ri-Hub event carries a proprietary metadata marker that uniquely identifies it.

7.3 Sharing of Google data with third parties ("Data Sharing")

Ri-Hub does NOT transfer, sell or share data obtained through Google APIs with any third party, with two narrow exceptions strictly necessary to deliver the service:

  • Cloud hosting in the European Economic Area (EU data center) where the Ri-Hub backend runs: Google data received transits and resides there as part of normal service delivery. The hosting provider is appointed as Data Processor under Art. 28 GDPR.
  • Returning the data back to the physiotherapist themselves inside the Ri-Hub interface (e.g. showing the physio the sync status of a Calendar event they just managed).

Google data is never used for advertising, profiling, marketing, AI/ML model training, nor for any purpose other than the OAuth functionality described above. Google data is never transferred outside the EEA in the context of Ri-Hub's use.

7.4 Storage and protection ("Data Storage & Protection")

  • In transit: all calls to Google APIs use HTTPS/TLS 1.3.
  • At rest: Google access tokens and refresh tokens are encrypted at the application layer before being persisted to the database, on top of the volume-level at-rest encryption.
  • Access control: Google tokens and derived data are accessible only to the Ri-Hub backend running on EU infrastructure. No employee accesses tokens in cleartext: any operational access requires a documented exception logged in the audit trail.
  • Localisation: Google data received is stored exclusively within the European Economic Area.
  • Audit log: every meaningful token use (refresh, Calendar API call) is logged for security purposes.

7.5 Retention and deletion ("Data Retention & Deletion")

  • OAuth tokens (access + refresh): kept while the integration is active. Deleted immediately when the user disconnects the integration from the app, or when Google revokes them.
  • Physiotherapist's Google email: kept while the Calendar integration is active (see § 9 of this policy for general account retention criteria).
  • Google Calendar events created by Ri-Hub: the event on the physiotherapist's calendar remains until they delete it; the internal reference in Ri-Hub is removed when the appointment is cancelled in the app or when the integration is disconnected.

How to revoke / delete Google data from Ri-Hub:

  1. Inside the Ri-Hub app: Settings → Integrations / Google Calendar → "Disconnect" — this removes the access/refresh tokens, stops writing to Calendar, and clears sync metadata.
  2. From Google: Manage your Google Account permissions → revoke access for "Ri-Hub". Ri-Hub detects the revocation on the next call and clears the tokens.
  3. Full deletion of the Ri-Hub account: email privacy@ri-hub.it or use the in-app Delete account function. Removal of associated Google data happens together with account deletion.

Limited Use disclosure. Ri-Hub's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Your rights (Articles 15–22 GDPR)

You have the right to: access your data, rectify them, obtain their erasure ("right to be forgotten"), restrict processing, receive them in a portable format, object to processing, and withdraw at any time the consents you have given (including analytics and marketing cookies, and the specific consent to advertising campaign measurement given in the app, § 5.2) without prejudice to the lawfulness of processing based on consent before its withdrawal.

You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise your rights, write to privacy@ri-hub.it. Deletion of the account in the app entails the removal of personal data within 30 days; for tax and contractual obligations, certain records (e.g. invoicing, appointments) are retained in pseudonymised form for the period required by law.

9. Retention period

  • Account and health data: for the whole duration of the relationship and up to 10 years after it ends. The reason is the protection of rights, yours and ours: 10 years is the ordinary limitation period under Italian law (Art. 2946 of the Civil Code) within which any claims relating to healthcare services can be brought (Law 24/2017). Tax and accounting documents are kept for the period required by law.
  • Authentication tokens: refresh token renewed at each access, maximum validity of 365 days of inactivity.
  • Analytics data (PostHog): 12 months.
  • Technical security logs: 6 months.
  • Advertising campaign measurement (§ 5.2): an event that is not sent within 6 days is cancelled; the record of what was sent, when and with what outcome (never the values) follows the same account-data retention as this table.
  • ri_utm attribution cookie (§ 5.4): 90 days.
  • Anonymous visit counter (§ 5.3): aggregate daily counts, with no personal data; no deletion period applies as this is not a processing of personal data.

10. Security measures

We adopt technical and organisational measures appropriate to the risk pursuant to Art. 32 GDPR:

  • Encryption in transit: TLS 1.3 mandatory on all connections between app/site and backend; no communication in clear.
  • Encryption at rest: the volumes on which health data reside are encrypted at the disk level; OAuth tokens and the most sensitive data are further encrypted at the application level.
  • Authentication: refresh tokens with SHA-256 hashing and automatic rotation; passwords are never stored in clear (hashed with standard PBKDF2/argon2 algorithms).
  • Minimisation in campaign measurement: we send Google Ads only the ad click code, never email, phone or name, not even encrypted (§ 5.2); we send nothing to Meta and TikTok from our server or from the app.
  • Access control (RBAC): distinct patient / physiotherapist / administrator roles with least-privilege access; the physiotherapist sees only the data of patients assigned to them.
  • Audit log: immutable logging of access to health data, retained for 6 months for security purposes.
  • Backups: encrypted and versioned backups, stored in an EU region and tested periodically.
  • EU localisation: the health data we keep reside on cloud infrastructure in the European Economic Area. The audio and video of video sessions pass in real time through the video-call providers (§ 6) and are not stored.
  • Provider security standards: the hosting and cloud providers used operate with ISO 27001 / SOC 2 certifications and are GDPR-compliant.
  • Training and procedures: staff are trained on privacy + security; data breach management plan with notification to the Italian Data Protection Authority within 72 hours (Art. 33 GDPR) and to the data subject in case of high risk (Art. 34).

11. Minors

A minor cannot create a Ri-Hub account on their own: the account always belongs to an adult. A parent exercising parental responsibility, a court-appointed guardian or a foster carer can add a minor child's profile to their own account, cared for under the Ri-Hub Junior format.

Before the first session, the parent signs in the app, on the child's behalf, the informed consent to physiotherapy treatment and a self-declaration (Articles 46–47 of Presidential Decree 445/2000) stating whether the other parent is informed and in agreement, or that they are deciding alone as the sole holder of parental responsibility. We ask for the other parent's signature too only in case of doubt, disagreement, or at the request of the clinical director: without the required signatures, sessions do not start.

The child's health data is processed by the physiotherapist, bound by professional secrecy, solely to deliver the requested healthcare service (Art. 9(2)(h) and 9(3) GDPR), and is never used for marketing, profiling or advertising. The other parent who exercises parental responsibility has the right, once their identity is verified, to be informed about the treatment and to request that it be suspended. Child profiles (Ri-Hub Junior) are always excluded from the advertising campaign measurement described at § 5: no event ever concerns them, whatever consent was given on the parent's account.

Article 2-quinquies of the Italian Data Protection Code (Legislative Decree 196/2003, as introduced by Legislative Decree 101/2018) concerns information society services offered directly to the minor: for such services, from the age of 14 the minor's own consent is valid even without the parents' consent. This is not the case for Ri-Hub: our healthcare service is not offered directly to the minor, and the account always belongs to an adult parent, guardian or foster carer. If you suspect that a minor has created an account under their own name by falsely declaring to be of age, write to privacy@ri-hub.it to request verification and possible deletion.

For detailed information on the use of cookies (necessary, analytics, marketing) and on the app's technical data, see our Cookie Policy. You can change your choice at any time from the “Manage cookies” link at the bottom of every page (and in the app: Settings → Privacy & data). The ri_utm attribution cookie and the measurement of advertising campaigns are described in § 5 of this notice.

13. Changes

This notice may be updated. The current version is published at ri-hub.it/en/privacy and is mirrored in the app at app.ri-hub.it/privacy to ensure access also in Capacitor offline mode. Last revision: 16 October 2026.

Message us on WhatsApp